From c56102c5d8ac9eead1a5c827d41f08f8ce56266c Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 4 Nov 2025 18:31:57 -0500
Subject: [PATCH] Fixes for all trees

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...dd-mono-main-switch-to-presonus-s182.patch |   80 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...tests-traceroute-use-require_command.patch |   78 +
 queue-5.10/series                             |   79 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...an-data-race-warning-at-snd_seq_fifo.patch |   39 +
 ...dd-mono-main-switch-to-presonus-s182.patch |   80 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...-amd-add-more-cyan-skillfish-pci-ids.patch |   36 +
 ...use-cached-metrics-data-on-aldebaran.patch |   37 +
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...emdup_array_user-in-amdgpu_cs_wait_f.patch |   64 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...toggle-back-buffer-resync-after-prep.patch |   44 +
 ...phy_7nm-fix-missing-initial-vco-rate.patch |   54 +
 ...e-to-not-queue-up-recovery-more-than.patch |   43 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...tc-modesetting-parameters-with-adjus.patch |   48 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...ce-snprintf-with-scnprintf-in-dmar_l.patch |  131 ++
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...add-missing-lock-in-suspend-callback.patch |   57 +
 ...-not-write-format-to-device-in-set_f.patch |   50 +
 ...180-only-validate-format-in-querystd.patch |   85 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...rochip-sparx5-make-it-selectable-for.patch |   37 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ect-don-t-reply-to-icmp-error-messag.patch |  129 ++
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...tend-extend-records-as-regular-files.patch |   37 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...-add-gfp_nowarn-for-atomic-allocatio.patch |   43 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...-rockchip-inno-csidphy-allow-writes-.patch |   55 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...ptp-limit-time-setting-of-ptp-clocks.patch |   81 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 queue-5.15/rdma-irdma-update-kconfig.patch    |   42 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...otential-buffer-overflow-in-fc_ct_ms.patch |   70 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...-ndlp-kref-decrement-clause-for-f_po.patch |   64 +
 ...controller-init-failure-on-fault-dur.patch |   56 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...tests-traceroute-use-require_command.patch |   78 +
 queue-5.15/series                             |  103 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 ...is_pciehp-instead-of-is_hotplug_brid.patch |   63 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...-use-after-free-during-failed-initia.patch |   62 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 queue-5.4/series                              |   60 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...op-redundant-locking-and-refcounting.patch |  173 ++
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...an-data-race-warning-at-snd_seq_fifo.patch |   39 +
 ...-generic-remove-shared-static-buffer.patch |   71 +
 ...dd-mono-main-switch-to-presonus-s182.patch |   80 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...xp-explicitly-set-s16le-format-in-sc.patch |   47 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...check-for-unexpected-bytes-when-defr.patch |  122 ++
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...-amd-add-more-cyan-skillfish-pci-ids.patch |   36 +
 ...m-amd-avoid-evicting-resources-at-s5.patch |   48 +
 ...play-add-more-cyan-skillfish-devices.patch |   58 +
 ...use-cached-metrics-data-on-aldebaran.patch |   37 +
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...-support-for-cyan-skillfish-gpu_info.patch |   44 +
 ...llow-kfd-criu-with-no-buffer-objects.patch |   40 +
 ...u-don-t-enable-smu-on-cyan-skillfish.patch |   42 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...-reject-gang-submissions-under-sriov.patch |   52 +
 ...ct-max-pixel-clock-for-hdmi-and-dvi-.patch |  114 +
 ...emdup_array_user-in-amdgpu_cs_wait_f.patch |   64 +
 ...ram-allocation-failure-for-a-special.patch |   43 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...toggle-back-buffer-resync-after-prep.patch |   44 +
 ...phy_7nm-fix-missing-initial-vco-rate.patch |   54 +
 ...e-to-not-queue-up-recovery-more-than.patch |   43 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...tc-modesetting-parameters-with-adjus.patch |   48 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 ...-device_get_mac_address-to-use-nvmem.patch |   42 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...4-increase-io-priority-of-fastcommit.patch |   50 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...x-softlockup-in-ftrace_module_enable.patch |   44 +
 ...use-pk-through-printk-or-tracepoints.patch |  104 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...ce-snprintf-with-scnprintf-in-dmar_l.patch |  131 ++
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...reate_kern-interface-to-create-kerne.patch |   42 +
 ...add-missing-lock-in-suspend-callback.patch |   57 +
 ...-not-write-format-to-device-in-set_f.patch |   50 +
 ...180-only-validate-format-in-querystd.patch |   85 +
 ...lete-v4l2_fh-synchronously-in-.relea.patch |   91 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...g-ensure-a-dependency-on-have_clk-fo.patch |   42 +
 ...b-specify-monochrome-media-bus-forma.patch |   59 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...n-explicitly-disable-selection-api-i.patch |   64 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...iq-danube-add-model-to-easy50712-dts.patch |   36 +
 ...be-rename-stp-node-on-easy50712-refe.patch |   36 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...install-fdb-for-bridge-mac-on-vlan-0.patch |   82 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...rochip-sparx5-make-it-selectable-for.patch |   37 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...query-fec-statistics-when-fec-is-dis.patch |   66 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...y-let-fixed_phy_unregister-free-the-.patch |   74 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ect-don-t-reply-to-icmp-error-messag.patch |  129 ++
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...tend-extend-records-as-regular-files.patch |   37 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...-add-gfp_nowarn-for-atomic-allocatio.patch |   43 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...ming-to-d0-if-device-is-disconnected.patch |   60 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...-rockchip-inno-csidphy-allow-writes-.patch |   55 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...ptp-limit-time-setting-of-ptp-clocks.patch |   81 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 queue-6.1/rdma-irdma-update-kconfig.patch     |   42 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...i-use-pci_uevent_ers-in-pci-recovery.patch |   80 +
 ...otential-buffer-overflow-in-fc_ct_ms.patch |   70 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...-ndlp-kref-decrement-clause-for-f_po.patch |   64 +
 ...controller-init-failure-on-fault-dur.patch |   56 +
 ...-support-for-22.5-gbps-sas-link-rate.patch |   39 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...diatek-assign-power-mode-userdata-be.patch |   61 +
 ...diatek-change-reset-sequence-for-imp.patch |   44 +
 ...diatek-enhance-recovery-on-resume-fa.patch |   50 +
 ...diatek-fix-invalid-access-in-vccqx-h.patch |   41 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...place-sleeps-in-fcnal-test-with-wait.patch | 1849 +++++++++++++++++
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...tests-traceroute-use-require_command.patch |   78 +
 queue-6.1/series                              |  145 ++
 ...port-avoid-reconnects-triggered-by-p.patch |   70 +
 ...ond-read-of-eeprom-mac-when-possible.patch |   55 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 .../sparc64-fix-prototypes-of-reads-bwl.patch |   51 +
 ...is_pciehp-instead-of-is_hotplug_brid.patch |   63 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...-use-after-free-during-failed-initia.patch |   62 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...notty-for-unsupported-device-feature.patch |   40 +
 ..._wdt-fix-max_timeout-being-calculate.patch |   59 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...11-fix-he-capabilities-element-check.patch |   37 +
 ...-add-160mhz-beamformee-capability-fo.patch |   43 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...op-redundant-locking-and-refcounting.patch |  173 ++
 ...-gaudi2-fix-bmon-disable-configurati.patch |   37 +
 ...-gaudi2-read-preboot-status-after-re.patch |   53 +
 ...-return-enomem-if-less-than-requeste.patch |   42 +
 ...-support-mapping-cb-with-vmalloc-bac.patch |   84 +
 ...pdate-honor-list-for-rpmi-system-msi.patch |   45 +
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...an-data-race-warning-at-snd_seq_fifo.patch |   39 +
 ...-generic-remove-shared-static-buffer.patch |   71 +
 ...dd-mono-main-switch-to-presonus-s182.patch |   80 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...ve-a-race-in-amdgpu_amdkfd_device_fi.patch |  121 ++
 ...use-snd_jack_avout-for-hdmi-dp-jacks.patch |  157 ++
 ...xp-explicitly-set-s16le-format-in-sc.patch |   47 +
 ...-sof-ipc4-pcm-add-fixup-for-channels.patch |  101 +
 ...anage-context-in-set_sysclk-callback.patch |   49 +
 ...-fix-class-d-initialization-for-tlv3.patch |   99 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...add-new-vid-pid-13d3-3633-for-mt7922.patch |   77 +
 ...check-for-unexpected-bytes-when-defr.patch |  122 ++
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 queue-6.12/bnxt_en-add-hyper-v-vf-id.patch    |   69 +
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...rove-mhi_sync_power_up-handling-for-.patch |   56 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...isc_register-reentry-for-miscdevice-.patch |   71 +
 ...ct-the-dynamic-range-to-exclude-rese.patch |  100 +
 ...l_init-in-misc_deregister-to-reiniti.patch |   52 +
 ...le-the-entropy-delay-interval-for-re.patch |   49 +
 ...ncorrect-payload-size-calculation-in.patch |   44 +
 ...skip-sev-and-snp-init-for-kdump-boot.patch |   58 +
 ...-qm-clear-all-vf-configurations-in-t.patch |   87 +
 ...isilicon-qm-invalidate-queues-in-use.patch |  145 ++
 ...calloc-in-qat_uclo_map_objs_from_mof.patch |   43 +
 ...un8i-ce-remove-channel-timeout-field.patch |  120 ++
 ...r-mark-as-dm_target_passes_integrity.patch |   41 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...-amd-add-more-cyan-skillfish-pci-ids.patch |   36 +
 ...-release-xcp-drm-memory-after-unplug.patch |  147 ++
 ...m-amd-avoid-evicting-resources-at-s5.patch |   48 +
 ...add-avi-infoframe-copy-in-copy_strea.patch |  105 +
 ...splay-add-fallback-path-for-ycbcr422.patch |  121 ++
 ...play-add-more-cyan-skillfish-devices.patch |   58 +
 ...change-dc-stream-color-settings-only.patch |  218 ++
 ...drm-amd-display-disable-vrr-on-dce-6.patch |   79 +
 ...dml2-guard-dml21_map_dc_state_into_d.patch |   71 +
 ...ensure-committing-streams-is-seamles.patch |   53 +
 ...fix-condition-for-setting-timing_adj.patch |   43 +
 ...splay-fix-dml-ms-order-of-operations.patch |   42 +
 ...-amd-display-fix-dvi-d-hdmi-adapters.patch |   57 +
 ...fix-for-test-crash-due-to-power-gati.patch |   39 +
 ...isplay-fix-pbn_div-calculation-error.patch |   96 +
 ...incorrect-conditions-for-failing-dto.patch |   41 +
 ...increase-aux-intra-hop-done-max-wait.patch |   59 +
 ...increase-minimum-clock-for-tmds-420-.patch |   84 +
 ...init-dispclk-from-bootup-clock-for-d.patch |  271 +++
 ...-display-move-setup_stream_attribute.patch |  122 ++
 ...reset-apply_eamless_boot_optimizatio.patch |   44 +
 ...y-set-up-pixel-encoding-for-ycbcr422.patch |   45 +
 ...support-hw-cursor-180-rot-for-any-nu.patch |  162 ++
 ...update-dpp-disp-clock-from-smu-clock.patch |  123 ++
 ...wait-until-otg-enable-state-is-clear.patch |   48 +
 ...use-cached-metrics-data-on-aldebaran.patch |   37 +
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...range-check-for-ras-bad-page-address.patch |  137 ++
 ...-support-for-cyan-skillfish-gpu_info.patch |   44 +
 ...llow-kfd-criu-with-no-buffer-objects.patch |   40 +
 ...check-kcalloc-for-ws-buffer-in-amdgp.patch |   41 +
 ...avoid-rma-causes-gpu-duplicate-reset.patch |  103 +
 ...-vcn-v5.0.1-poison-irq-call-trace-on.patch |   36 +
 ...gpu-check-vcn-sram-load-return-value.patch |  255 +++
 ...ct-the-counts-of-nr_banks-and-nr_err.patch |   43 +
 ...u-don-t-enable-smu-on-cyan-skillfish.patch |   42 +
 ...u-fix-nullptr-err-of-vm_handle_moved.patch |   52 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...-reject-gang-submissions-under-sriov.patch |   52 +
 ...ct-max-pixel-clock-for-hdmi-and-dvi-.patch |  114 +
 ...skip-poison-aca-bank-from-ue-channel.patch |   98 +
 ...emdup_array_user-in-amdgpu_cs_wait_f.patch |   64 +
 ...ram-allocation-failure-for-a-special.patch |   43 +
 ...e-lack-of-read-permissions-in-svm-ma.patch |   67 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...dsi-don-t-fail-on-mipi_dsi_mode_vide.patch |   44 +
 ...e-cdns-dsi-fix-reg_wakeup_time-value.patch |   58 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...toggle-back-buffer-resync-after-prep.patch |   44 +
 ...phy_7nm-fix-missing-initial-vco-rate.patch |   54 +
 ...e-to-not-queue-up-recovery-more-than.patch |   43 +
 ...s-generate-_hi-lo-builders-for-reg64.patch |   61 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...ight-quirks-make-edid-match-optional.patch |   44 +
 ...check-bo-offset-alignment-in-vm-bind.patch |   48 +
 ...serialize-gpu-cache-flush-operations.patch |   61 +
 ...tc-modesetting-parameters-with-adjus.patch |   48 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...in-xe_gem_fault-when-running-core_ho.patch |   77 +
 ...add-more-guc-load-error-status-codes.patch |  103 +
 ...-increase-guc-crash-dump-buffer-size.patch |   37 +
 ...n-an-error-code-if-the-guc-load-fail.patch |   94 +
 ...-upper-limit-of-h2g-retries-over-ctb.patch |   76 +
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 ...-device_get_mac_address-to-use-nvmem.patch |   42 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...luster-allocation-bits-of-the-alloca.patch |  130 ++
 ...4-increase-io-priority-of-fastcommit.patch |   50 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...nfinite-loop-in-__insert_extent_tree.patch |   42 +
 ...ct-potential-corrupted-nid-in-free_n.patch |   76 +
 ...rong-layout-information-on-16kb-page.patch |   44 +
 ...deo_is_primary_device-when-compiled-.patch |   74 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...x-softlockup-in-ftrace_module_enable.patch |   44 +
 ...e-zero-initialize-inode-private-data.patch |   46 +
 ...-folio-to-generic-group-for-multitou.patch |   65 +
 ...lve-touchpad-issues-on-dell-systems-.patch |  130 ++
 ...rmissive_control-quirk-autodetection.patch |   59 +
 ...rection-fix-only-for-conditional-eff.patch |  150 ++
 .../ib-ipoib-ignore-l3-master-device.patch    |   97 +
 ...use-pk-through-printk-or-tracepoints.patch |  104 +
 ...dpf-do-not-linearize-big-tso-packets.patch |  345 +++
 ...c-load-calibrated-values-even-calibr.patch |   88 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...ima_digsig-flag-when-setting-or-remo.patch |  156 ++
 ...notate-data-races-in-inet_diag_bc_sk.patch |   62 +
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...-clear-stream-error-indicator-bits-f.patch |   49 +
 ...ce-snprintf-with-scnprintf-in-dmar_l.patch |  131 ++
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...reate_kern-interface-to-create-kerne.patch |   42 +
 ...add-missing-lock-in-suspend-callback.patch |   57 +
 ...-not-write-format-to-device-in-set_f.patch |   50 +
 ...180-only-validate-format-in-querystd.patch |   85 +
 ...lete-v4l2_fh-synchronously-in-.relea.patch |   91 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...g-ensure-a-dependency-on-have_clk-fo.patch |   42 +
 ...b-specify-monochrome-media-bus-forma.patch |   59 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...set-embedded-data-type-correctly-for.patch |   40 +
 ...8x40-fix-the-horizontal-flip-control.patch |   39 +
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...ix-timings-comparison-in-vidioc_s_dv.patch |   40 +
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...n-explicitly-disable-selection-api-i.patch |   64 +
 ...x-add-ndo_eth_ioctl-handler-to-enabl.patch |   44 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...iq-danube-add-model-to-easy50712-dts.patch |   36 +
 ...be-rename-stp-node-on-easy50712-refe.patch |   36 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...install-fdb-for-bridge-mac-on-vlan-0.patch |   82 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...mem-expose-tcp_recvmsg_locked-errors.patch |   52 +
 ...sa-felix-support-phy-mode-10g-qxgmii.patch |   98 +
 ...p-set-spi-as-bus-interface-during-re.patch |  106 +
 ...rochip-sparx5-make-it-selectable-for.patch |   37 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...irected-broadcast-routes-to-use-dst-.patch |   75 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...query-fec-statistics-when-fec-is-dis.patch |   66 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...r-link-parameters-on-admin-link-down.patch |   62 +
 ...y-let-fixed_phy_unregister-free-the-.patch |   74 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...ctly-handle-rx-checksum-offload-erro.patch |   49 +
 ...c-est-drop-frames-causing-hlbs-error.patch |   92 +
 ...un-limit-tx_max_coalesced_frames_irq.patch |   42 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ect-don-t-reply-to-icmp-error-messag.patch |  129 ++
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...tend-extend-records-as-regular-files.patch |   37 +
 ...r1k_32_pcrel-relocation-type-module-.patch |   40 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...-add-gfp_nowarn-for-atomic-allocatio.patch |   43 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...he-single-edma-irq-in-dw_pcie_edma_i.patch |   53 +
 ...-epf-test-limit-pcie-bar-size-for-fi.patch |   58 +
 ...evice-error_state-already-after-rese.patch |  107 +
 ...-enable-the-vaux-supply-if-available.patch |   42 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...ming-to-d0-if-device-is-disconnected.patch |   60 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...79f0-ether-serdes-add-new-step-added.patch |   77 +
 ...-rockchip-inno-csidphy-allow-writes-.patch |   55 +
 ...el-uncore-freq-fix-warning-in-partit.patch |   54 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...ptp-limit-time-setting-of-ptp-clocks.patch |   81 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 queue-6.12/rdma-irdma-update-kconfig.patch    |   42 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...m3-use-devm_pm_runtime_enable-helper.patch |   54 +
 ...t-alias-for-rpmsg-id-rpmsg-raw-from-.patch |   56 +
 ...i-use-pci_uevent_ers-in-pci-recovery.patch |   80 +
 ...otential-buffer-overflow-in-fc_ct_ms.patch |   70 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...up-allocated-queues-when-queue-setup.patch |   49 +
 ...ent-ndlp-kref-after-fdisc-retries-ex.patch |   43 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...-plogi_acc-is-sent-prior-to-prli-in-.patch |  100 +
 ...-ndlp-kref-decrement-clause-for-f_po.patch |   64 +
 ...controller-init-failure-on-fault-dur.patch |   56 +
 ...i-o-failures-during-controller-reset.patch |   74 +
 ...-support-for-22.5-gbps-sas-link-rate.patch |   39 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...sable-timestamp-functionality-if-not.patch |   67 +
 ...fsd-gate-ref_clk-and-put-ufs-device-.patch |   57 +
 ...diatek-assign-power-mode-userdata-be.patch |   61 +
 ...diatek-change-reset-sequence-for-imp.patch |   44 +
 ...host-mediatek-correct-system-pm-flow.patch |   69 +
 ...diatek-disable-auto-hibern8-during-p.patch |  109 +
 ...diatek-enhance-recovery-on-hibernati.patch |   99 +
 ...diatek-enhance-recovery-on-resume-fa.patch |   50 +
 ...diatek-fix-auto-hibern8-timer-config.patch |  147 ++
 ...diatek-fix-invalid-access-in-vccqx-h.patch |   41 +
 ...t-mediatek-fix-pwm-mode-switch-issue.patch |   77 +
 ...diatek-fix-unbalanced-irq-enable-iss.patch |   36 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...et-rss_ctx-fix-the-queue-count-check.patch |   47 +
 ...t-rss_ctx-make-the-test-pass-with-fe.patch |   45 +
 ...ding-reorder-ar-ping-arguments-to-ob.patch |  171 ++
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...join-allow-more-time-to-send-add_add.patch |   52 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...place-sleeps-in-fcnal-test-with-wait.patch | 1849 +++++++++++++++++
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...oute-return-correct-value-on-failure.patch |  124 ++
 ...tests-traceroute-use-require_command.patch |   78 +
 queue-6.12/series                             |  285 +++
 ...port-avoid-reconnects-triggered-by-p.patch |   70 +
 ...ond-read-of-eeprom-mac-when-possible.patch |   55 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 .../sparc64-fix-prototypes-of-reads-bwl.patch |   51 +
 ...rcu-in-tcp_fastopen_active_disable_o.patch |   44 +
 ...is_pciehp-instead-of-is_hotplug_brid.patch |   63 +
 ...ilog-use-platform-device-for-probing.patch |  534 +++++
 ...rial-modify-the-use-of-dev_err_probe.patch |   54 +
 ...ng-return-value-for-vt_resize-in-vt_.patch |   39 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...-use-after-free-during-failed-initia.patch |   62 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...-support-for-hosts-with-zero-usb3-po.patch |   97 +
 ...-fix-usb2-only-root-hub-registration.patch |   61 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...x-handling-on-legacy-non-pci-2.3-dev.patch |   77 +
 ...notty-for-unsupported-device-feature.patch |   40 +
 ..._wdt-fix-max_timeout-being-calculate.patch |   59 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...increase-dp_reo_cmd_ring_size-to-256.patch |   41 +
 ...ifi-fw-add-asus-to-ppag-and-tas-list.patch |   64 +
 ...x-6-ghz-band-capabilities-element-ad.patch |   66 +
 ...11-fix-he-capabilities-element-check.patch |   37 +
 ...80211-track-nan-interface-start-stop.patch |  124 ++
 ...ifi-mt76-mt76_eeprom_override-to-int.patch |  249 +++
 ...-add-160mhz-beamformee-capability-fo.patch |   43 +
 ...-fix-memory-leak-on-mt7996_mcu_sta_k.patch |   37 +
 ...mt76-mt7996-temporarily-disable-epcs.patch |   36 +
 ...use-indirect-io-for-device-registers.patch |   52 +
 ...ssid-comparison-for-non-transmitted-.patch |   47 +
 ...obtain-rx-path-from-ppdu-status-ie00.patch |   51 +
 ...int-just-once-for-unknown-c2h-events.patch |   84 +
 ...-a-completion-for-each-h2c-command-w.patch |  157 ++
 ...emove-notify-during-wowlan-net-detec.patch |   45 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...op-redundant-locking-and-refcounting.patch |  173 ++
 ...ify-pm-and-rpm-suspend-and-resume-ca.patch |  380 ++++
 ...-gaudi2-fix-bmon-disable-configurati.patch |   37 +
 ...-gaudi2-read-preboot-status-after-re.patch |   53 +
 ...-return-enomem-if-less-than-requeste.patch |   42 +
 ...-support-mapping-cb-with-vmalloc-bac.patch |   84 +
 ...pdate-honor-list-for-rpmi-system-msi.patch |   45 +
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...an-data-race-warning-at-snd_seq_fifo.patch |   39 +
 ...-generic-remove-shared-static-buffer.patch |   71 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...on-t-apply-interface-quirk-to-preson.patch |   46 +
 ...ce-kfd-process-check-in-switch-parti.patch |  157 ++
 ...ve-a-race-in-amdgpu_amdkfd_device_fi.patch |  121 ++
 ...83x-handle-shared-reset-gpio-for-wsa.patch |  129 ++
 ...proper-left-right-mixer-controls-via.patch |   43 +
 ...le-dapm-power-widgets-for-playback-d.patch |   52 +
 ...ve-dac-enablement-write-from-es8323_.patch |   36 +
 ...o-not-share-the-name-pointer-between.patch |   60 +
 ...use-snd_jack_avout-for-hdmi-dp-jacks.patch |  157 ++
 .../asoc-ops-improve-snd_soc_get_volsw.patch  |   41 +
 ...xp-explicitly-set-s16le-format-in-sc.patch |   47 +
 ...of-add-.symmetric_xxx-on-snd_soc_dai.patch |   37 +
 ...oc-renesas-msiof-set-sifctr-register.patch |   41 +
 ...enesas-msiof-tidyup-dmac-stop-timing.patch |   48 +
 ...c-renesas-msiof-use-reset-controller.patch |  131 ++
 ...-sof-ipc4-pcm-add-fixup-for-channels.patch |  101 +
 ...anage-context-in-set_sysclk-callback.patch |   49 +
 ...-add-keyword-init-in-profile-section.patch |   92 +
 ...-fix-class-d-initialization-for-tlv3.patch |   99 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...tintel-add-support-for-blazariw-core.patch |   76 +
 ...tel_pcie-define-hdev-wakeup-callback.patch |   54 +
 ...add-new-vid-pid-13d3-3627-for-mt7925.patch |   77 +
 ...add-new-vid-pid-13d3-3633-for-mt7922.patch |   77 +
 ...check-for-unexpected-bytes-when-defr.patch |  122 ++
 ...n-t-initiate-cis-connections-if-ther.patch |   40 +
 ...-iso-use-sk_sndtimeo-as-conn_timeout.patch |  199 ++
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...ge_alloc_ring-self-unwind-on-failure.patch |   55 +
 ...og-trace-support-for-5731x-5741x-chi.patch |  128 ++
 queue-6.17/bnxt_en-add-hyper-v-vf-id.patch    |   69 +
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...rove-mhi_sync_power_up-handling-for-.patch |   56 +
 ..._generic-add-support-for-all-foxconn.patch |   53 +
 ...pdate-bit-rate-constants-for-rz-g3e-.patch |   42 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...isc_register-reentry-for-miscdevice-.patch |   71 +
 ...l_init-in-misc_deregister-to-reiniti.patch |   52 +
 ...le-the-entropy-delay-interval-for-re.patch |   49 +
 ...ncorrect-payload-size-calculation-in.patch |   44 +
 ...skip-sev-and-snp-init-for-kdump-boot.patch |   58 +
 ...-qm-clear-all-vf-configurations-in-t.patch |   87 +
 ...isilicon-qm-invalidate-queues-in-use.patch |  145 ++
 ...calloc-in-qat_uclo_map_objs_from_mof.patch |   43 +
 ...un8i-ce-remove-channel-timeout-field.patch |  120 ++
 ...r-mark-as-dm_target_passes_integrity.patch |   41 +
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...dd-a-new-iaa-device-id-for-wildcat-l.patch |   52 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...avoid-script-crash-on-ancient-python.patch |  146 ++
 ...-amd-add-more-cyan-skillfish-pci-ids.patch |   36 +
 ...-release-xcp-drm-memory-after-unplug.patch |  147 ++
 ...m-amd-avoid-evicting-resources-at-s5.patch |   48 +
 ...add-avi-infoframe-copy-in-copy_strea.patch |  105 +
 ...splay-add-fallback-path-for-ycbcr422.patch |  121 ++
 ...add-fast-sync-field-in-ultra-sleep-m.patch |   64 +
 ...-display-add-missing-post-flip-calls.patch |   70 +
 ...play-add-more-cyan-skillfish-devices.patch |   58 +
 ...cache-streams-targeting-link-when-pe.patch |   69 +
 ...change-dc-stream-color-settings-only.patch |  218 ++
 ...consider-sink-max-slice-width-limita.patch |   44 +
 ...drm-amd-display-disable-vrr-on-dce-6.patch |   79 +
 ...dml2-guard-dml21_map_dc_state_into_d.patch |   71 +
 ...don-t-use-non-registered-vupdate-on-.patch |   92 +
 ...dont-wait-for-pipe-update-during-med.patch |   40 +
 ...ensure-committing-streams-is-seamles.patch |   53 +
 ...fix-condition-for-setting-timing_adj.patch |   43 +
 ...fix-dmcub-loading-sequence-for-dcn3..patch |  178 ++
 ...splay-fix-dml-ms-order-of-operations.patch |   42 +
 ...splay-fix-dmub-access-race-condition.patch |  139 ++
 ...isplay-fix-dmub_cmd-header-alignment.patch |   59 +
 ...-amd-display-fix-dvi-d-hdmi-adapters.patch |   57 +
 ...fix-for-test-crash-due-to-power-gati.patch |   39 +
 ...isplay-fix-pbn_div-calculation-error.patch |   96 +
 ...incorrect-conditions-for-failing-dto.patch |   41 +
 ...increase-aux-intra-hop-done-max-wait.patch |   59 +
 ...increase-minimum-clock-for-tmds-420-.patch |   84 +
 ...indicate-when-custom-brightness-curv.patch |   48 +
 ...init-dispclk-from-bootup-clock-for-d.patch |  271 +++
 ...keep-pll0-running-on-dce-6.0-and-6.4.patch |   67 +
 ...-display-move-setup_stream_attribute.patch |  122 ++
 ...remove-check-dpia-hpd-status-for-bw-.patch |  137 ++
 ...reset-apply_eamless_boot_optimizatio.patch |   44 +
 ...y-set-up-pixel-encoding-for-ycbcr422.patch |   45 +
 ...support-hw-cursor-180-rot-for-any-nu.patch |  162 ++
 ...update-dpp-disp-clock-from-smu-clock.patch |  123 ++
 ...y-update-tiled-to-tiled-copy-command.patch |   40 +
 ...wait-for-otg-update-pending-latch-be.patch |  110 +
 ...wait-until-otg-enable-state-is-clear.patch |   48 +
 ...crease-smc-timeout-on-si-and-warn-v3.patch |  104 +
 ...fine-amdgpu-pm-sysfs-node-error-code.patch |   44 +
 ...use-cached-metrics-data-on-aldebaran.patch |   37 +
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...allback-to-pipe-reset-if-kcq-ring-re.patch |   70 +
 ...range-check-for-ras-bad-page-address.patch |  137 ++
 ...-support-for-cyan-skillfish-gpu_info.patch |   44 +
 ...o-custom-amdgpu_drm_release-drm_dev_.patch |   50 +
 ...llow-kfd-criu-with-no-buffer-objects.patch |   40 +
 ...check-kcalloc-for-ws-buffer-in-amdgp.patch |   41 +
 ...-jpeg-v5.0.1-poison-irq-call-trace-o.patch |   36 +
 ...avoid-rma-causes-gpu-duplicate-reset.patch |  103 +
 ...-vcn-v5.0.1-poison-irq-call-trace-on.patch |   36 +
 ...gpu-check-vcn-sram-load-return-value.patch |  255 +++
 ...ct-info-field-of-bad-page-threshold-.patch |   46 +
 ...ct-the-counts-of-nr_banks-and-nr_err.patch |   43 +
 ...orrect-the-loss-of-aca-bank-reg-info.patch |  215 ++
 ...u-don-t-enable-smu-on-cyan-skillfish.patch |   43 +
 ...-effective-health-check-before-reset.patch |   97 +
 ...uild-error-when-config_suspend-is-di.patch |   52 +
 ...ence-signaling-race-condition-in-use.patch |   54 +
 ...u-fix-nullptr-err-of-vm_handle_moved.patch |   52 +
 ...fix-vcn-v5.0.1-poison-irq-call-trace.patch |   90 +
 ...-initialize-jpeg-v5_0_1-ras-function.patch |   42 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...ify-pmfw-bad-page-threshold-exceeded.patch |   40 +
 ...tor-bad_page_work-for-corner-case-ha.patch |  207 ++
 ...-reject-gang-submissions-under-sriov.patch |   52 +
 ...dgpu-release-hive-reference-properly.patch |   63 +
 ...ct-max-pixel-clock-for-hdmi-and-dvi-.patch |  114 +
 ...gpu-skip-mgpu-fan-boost-for-multi-vf.patch |   36 +
 ...skip-poison-aca-bank-from-ue-channel.patch |   98 +
 ...e-ipid-value-for-bad-page-threshold-.patch |   56 +
 ...emdup_array_user-in-amdgpu_cs_wait_f.patch |   64 +
 ...ate-userq-buffer-virtual-address-and.patch |  149 ++
 ...drm-amdgpu-validate-userq-input-args.patch |  161 ++
 ...u-vpe-cancel-delayed-work-in-hw_fini.patch |   47 +
 ...ram-allocation-failure-for-a-special.patch |   43 +
 ...e-lack-of-read-permissions-in-svm-ma.patch |   67 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...dsi-don-t-fail-on-mipi_dsi_mode_vide.patch |   44 +
 ...e-cdns-dsi-fix-reg_wakeup_time-value.patch |   58 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...rm-bridge-write-full-audio-infoframe.patch |  119 ++
 ...pusvm-fix-hmm_pfn_to_map_order-usage.patch |   93 +
 ...rm-msm-a6xx-switch-to-gmu-ao-counter.patch |   86 +
 ...m-adreno-add-fenced-regwrite-support.patch |  205 ++
 ...dreno-add-speedbin-data-for-a623-gpu.patch |   39 +
 ...sm-adreno-add-speedbins-for-a663-gpu.patch |   39 +
 ...er-modes-based-on-adjusted-mode-cloc.patch |  144 ++
 ...toggle-back-buffer-resync-after-prep.patch |   44 +
 ...phy_7nm-fix-missing-initial-vco-rate.patch |   54 +
 .../drm-msm-fix-32b-size-truncation.patch     |  134 ++
 ...e-to-not-queue-up-recovery-more-than.patch |   43 +
 ...s-generate-_hi-lo-builders-for-reg64.patch |   61 +
 ...eserved_mem_region_to_resource-for-m.patch |   73 +
 ...ys-set-rmdevidcheckignore-for-gsp-rm.patch |   61 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...ight-quirks-make-edid-match-optional.patch |   44 +
 ...d-shp-lq134z1-panel-for-dell-xps-934.patch |   59 +
 ...-ili9881c-move-display_on-_off-dcs-c.patch |   94 +
 ...-ili9881c-turn-off-power-supply-when.patch |   63 +
 ...check-bo-offset-alignment-in-vm-bind.patch |   48 +
 ...serialize-gpu-cache-flush-operations.patch |   61 +
 ...-do-not-access-gem-dma-vaddr-directl.patch |  139 ++
 ...dd-support-for-inverted-pixel-format.patch |   80 +
 queue-6.17/drm-tidss-remove-early-fb.patch    |   56 +
 ...tc-modesetting-parameters-with-adjus.patch |   48 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...ending-tlb-inval-workers-on-teardown.patch |   78 +
 ...figfs-enforce-canonical-device-names.patch |   70 +
 ...xe-ensure-gt-is-in-c0-during-resumes.patch |   66 +
 ..._13012615864-to-additional-xe2-and-x.patch |   66 +
 ...tend-wa_22021007897-to-xe3-platforms.patch |   43 +
 ...in-xe_gem_fault-when-running-core_ho.patch |   77 +
 ...evm-release-action-to-safely-tear-do.patch |  155 ++
 ...add-more-guc-load-error-status-codes.patch |  103 +
 ...s-add-ct-disable-action-during-secon.patch |   55 +
 ...-increase-guc-crash-dump-buffer-size.patch |   37 +
 ...n-an-error-code-if-the-guc-load-fail.patch |   94 +
 ...-upper-limit-of-h2g-retries-over-ctb.patch |   76 +
 .../drm-xe-i2c-enable-bus-mastering.patch     |   37 +
 ...-dma-resv-handling-for-backup-object.patch |   92 +
 ...xe-make-page-size-consistent-in-loop.patch |   40 +
 ...tialize-data0-for-pcode-read-routine.patch |  137 ++
 ...-t-resume-device-from-restart-worker.patch |   89 +
 ...m-lmtt-directory-pointer-on-all-gts-.patch |   59 +
 .../drm-xe-ptl-apply-wa_16026007364.patch     |  100 +
 ...rm-xe-rework-pde-pat-index-selection.patch |  181 ++
 ...-wedged-before-sending-wedged-uevent.patch |   61 +
 ...xe-wcl-extend-l3bank-mask-workaround.patch |   40 +
 ...lay-msm-gmu-update-adreno-623-bindin.patch |   70 +
 ...port-cypress-frams-without-device-id.patch |  150 ++
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 ...-fbnic-reset-hw-stats-upon-pci-error.patch |   43 +
 ...-device_get_mac_address-to-use-nvmem.patch |   42 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...luster-allocation-bits-of-the-alloca.patch |  130 ++
 ...4-increase-io-priority-of-fastcommit.patch |   50 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...x-wakeup-source-leaks-on-device-unbi.patch |   37 +
 ...ix-wakeup-source-leaks-on-device-unb.patch |   37 +
 ...nfinite-loop-in-__insert_extent_tree.patch |   42 +
 ...ct-potential-corrupted-nid-in-free_n.patch |   76 +
 ...rong-layout-information-on-16kb-page.patch |   44 +
 ...e-screen-info-to-find-primary-device.patch |   79 +
 ...deo_is_primary_device-when-compiled-.patch |   74 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...x-softlockup-in-ftrace_module_enable.patch |   44 +
 ...e-zero-initialize-inode-private-data.patch |   46 +
 ...e-register-allow-fields-named-offset.patch |   70 +
 ...-folio-to-generic-group-for-multitou.patch |   65 +
 ...lve-touchpad-issues-on-dell-systems-.patch |  130 ++
 ...rmissive_control-quirk-autodetection.patch |   59 +
 ...rection-fix-only-for-conditional-eff.patch |  150 ++
 ...ing-napi-dev-in-netif_queue_set_napi.patch |   44 +
 ...3-queue-pair-endianness-improvements.patch |  376 ++++
 ...em-use-us_to_ktime-where-appropriate.patch |   35 +
 .../ib-ipoib-ignore-l3-master-device.patch    |   97 +
 ...use-pk-through-printk-or-tracepoints.patch |  104 +
 ...dpf-do-not-linearize-big-tso-packets.patch |  345 +++
 queue-6.17/idpf-link-napis-to-queues.patch    |  229 ++
 .../iio-adc-ad7124-do-not-require-mclk.patch  |  128 ++
 ...c-load-calibrated-values-even-calibr.patch |   88 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...atch-pnp-id-found-on-newer-gpd-firmw.patch |   74 +
 ...25-use-iio_push_to_buffers_with_ts-t.patch |   66 +
 ...ima_digsig-flag-when-setting-or-remo.patch |  156 ++
 ...notate-data-races-in-inet_diag_bc_sk.patch |   62 +
 ...pport-to-remap-unmap-iommu-buffers-f.patch |  279 +++
 ...mmu-amd-reuse-device-table-for-kdump.patch |  229 ++
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...-clear-stream-error-indicator-bits-f.patch |   49 +
 ...e-lpig-from-page-group-response-desc.patch |   76 +
 ...ce-snprintf-with-scnprintf-in-dmar_l.patch |  131 ++
 ...pe-for-err-in-ionic_get_module_eepro.patch |   45 +
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...mber-of-reads-when-getting-orom-data.patch |  147 ++
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...reate_kern-interface-to-create-kerne.patch |   42 +
 ...add-missing-lock-in-suspend-callback.patch |   57 +
 ...-not-write-format-to-device-in-set_f.patch |   50 +
 ...180-only-validate-format-in-querystd.patch |   85 +
 ...lete-v4l2_fh-synchronously-in-.relea.patch |   91 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...g-ensure-a-dependency-on-have_clk-fo.patch |   42 +
 ...b-specify-monochrome-media-bus-forma.patch |   59 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...sis-only-set-clock-rate-when-specifi.patch |   87 +
 ...set-embedded-data-type-correctly-for.patch |   40 +
 ...isi-fix-streaming-cleanup-on-release.patch |  286 +++
 ...8x40-fix-the-horizontal-flip-control.patch |   39 +
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...ix-timings-comparison-in-vidioc_s_dv.patch |   40 +
 ...-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch |  152 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...n-explicitly-disable-selection-api-i.patch |   64 +
 ...local-copy-of-client-uuid-in-connect.patch |   87 +
 ...x-add-ndo_eth_ioctl-handler-to-enabl.patch |   44 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...iq-danube-add-model-to-easy50712-dts.patch |   36 +
 ...be-rename-stp-node-on-easy50712-refe.patch |   36 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...t_test-skip-irq-tests-if-irq-is-out-.patch |   58 +
 ...e-sanity-checks-in-beneath-case-into.patch |   74 +
 ...install-fdb-for-bridge-mac-on-vlan-0.patch |   82 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...mem-expose-tcp_recvmsg_locked-errors.patch |   52 +
 ...sa-felix-support-phy-mode-10g-qxgmii.patch |   98 +
 ...p-set-spi-as-bus-interface-during-re.patch |  106 +
 ...rochip-sparx5-make-it-selectable-for.patch |   37 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...irected-broadcast-routes-to-use-dst-.patch |   75 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...e-waiting-time-if-hwc-not-responding.patch |   43 +
 ...query-fec-statistics-when-fec-is-dis.patch |   66 +
 ...t-entering-switchdev-mode-with-incon.patch |  102 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...e-runtime-state-in-phy_halted-phy_er.patch |   44 +
 ...r-link-parameters-on-admin-link-down.patch |   62 +
 ...improve-phydev-and-driver-removal-ha.patch |  129 ++
 ...y-let-fixed_phy_unregister-free-the-.patch |   74 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...ort-and-configure-in-band-auto-negot.patch |  174 ++
 ...-rps-table-overwrite-of-active-flows.patch |  261 +++
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...ctly-handle-rx-checksum-offload-erro.patch |   49 +
 ...c-est-drop-frames-causing-hlbs-error.patch |   92 +
 ...un-limit-tx_max_coalesced_frames_irq.patch |   42 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ect-don-t-reply-to-icmp-error-messag.patch |  129 ++
 ...les-all-transaction-allocations-can-.patch |  179 ++
 ...cs-fou-change-local-v6-peer-v6-check.patch |   74 +
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...tend-extend-records-as-regular-files.patch |   37 +
 ...tx2-af-broadcast-xon-on-all-channels.patch |   92 +
 ...r1k_32_pcrel-relocation-type-module-.patch |   40 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...at-ovl_create_real-returns-a-hashed-.patch |   80 +
 ...-add-gfp_nowarn-for-atomic-allocatio.patch |   43 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...-fix-null-pointer-access-by-aer_info.patch |   38 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...he-single-edma-irq-in-dw_pcie_edma_i.patch |   53 +
 ...-epf-test-limit-pcie-bar-size-for-fi.patch |   58 +
 ...evice-error_state-already-after-rese.patch |  107 +
 ...-enable-the-vaux-supply-if-available.patch |   42 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...ming-to-d0-if-device-is-disconnected.patch |   60 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...79f0-ether-serdes-add-new-step-added.patch |   77 +
 ...-rockchip-inno-csidphy-allow-writes-.patch |   55 +
 ...-pmf-fix-the-custom-bios-input-handl.patch |  154 ++
 ...el-uncore-freq-fix-warning-in-partit.patch |   54 +
 ...el-uncore-freq-present-unique-domain.patch |  145 ++
 ...nk-lmi-add-extra-tc-bios-error-messa.patch |   53 +
 ...-android-tablets-stop-using-eprobe_d.patch |   67 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...ptp-limit-time-setting-of-ptp-clocks.patch |   81 +
 ..._ocp-driver-compatible-with-ptp_extt.patch |   53 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 queue-6.17/rdma-irdma-update-kconfig.patch    |   43 +
 ...dma-mana_ib-drain-send-wrs-of-gsi-qp.patch |  104 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...m3-use-devm_pm_runtime_enable-helper.patch |   54 +
 ...t-alias-for-rpmsg-id-rpmsg-raw-from-.patch |   56 +
 ...i-use-pci_uevent_ers-in-pci-recovery.patch |   80 +
 ...otential-buffer-overflow-in-fc_ct_ms.patch |   70 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...up-allocated-queues-when-queue-setup.patch |   49 +
 ...ent-ndlp-kref-after-fdisc-retries-ex.patch |   43 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...-plogi_acc-is-sent-prior-to-prli-in-.patch |  100 +
 ...-ndlp-kref-decrement-clause-for-f_po.patch |   64 +
 ...controller-init-failure-on-fault-dur.patch |   56 +
 ...device-loss-during-enclosure-reboot-.patch |   94 +
 ...i-o-failures-during-controller-reset.patch |   74 +
 ...-support-for-22.5-gbps-sas-link-rate.patch |   39 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...ore-change-mcq-interrupt-enable-flow.patch |  118 ++
 ...sable-timestamp-functionality-if-not.patch |   67 +
 ...fsd-gate-ref_clk-and-put-ufs-device-.patch |   57 +
 ...diatek-assign-power-mode-userdata-be.patch |   61 +
 ...diatek-change-reset-sequence-for-imp.patch |   44 +
 ...host-mediatek-correct-system-pm-flow.patch |   69 +
 ...diatek-disable-auto-hibern8-during-p.patch |  109 +
 ...diatek-enhance-recovery-on-hibernati.patch |   99 +
 ...diatek-enhance-recovery-on-resume-fa.patch |   50 +
 ...diatek-fix-adapt-issue-after-pa_init.patch |   50 +
 ...diatek-fix-auto-hibern8-timer-config.patch |  147 ++
 ...diatek-fix-invalid-access-in-vccqx-h.patch |   41 +
 ...t-mediatek-fix-pwm-mode-switch-issue.patch |   77 +
 ...diatek-fix-unbalanced-irq-enable-iss.patch |   36 +
 ...m-align-programming-sequence-of-shar.patch |   92 +
 ...m-disable-lane-clocks-during-phy-hib.patch |   61 +
 ...-fix-error-message-if-empty-variable.patch |   45 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...t-devmem-add-correct-the-ipv6-suppor.patch |   37 +
 ...t-devmem-flip-the-direction-of-tx-te.patch |   59 +
 ...sts-drv-net-hds-restore-hds-settings.patch |  123 ++
 ...et-rss_ctx-fix-the-queue-count-check.patch |   47 +
 ...t-rss_ctx-make-the-test-pass-with-fe.patch |   45 +
 .../selftests-drv-net-wait-for-carrier.patch  |  151 ++
 ...ding-reorder-ar-ping-arguments-to-ob.patch |  171 ++
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...join-allow-more-time-to-send-add_add.patch |   52 +
 ...elftests-ncdevmem-don-t-retry-efault.patch |   50 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...t-lib.sh-don-t-defer-failed-commands.patch |  117 ++
 ...ke-the-dump-test-less-sensitive-to-m.patch |  129 ++
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...place-sleeps-in-fcnal-test-with-wait.patch | 1849 +++++++++++++++++
 ...dpoint-skip-irq-test-if-irq-is-out-o.patch |   48 +
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...oute-return-correct-value-on-failure.patch |  124 ++
 ...tests-traceroute-use-require_command.patch |   78 +
 ...erdev-drop-dev_pm_domain_detach-call.patch |   65 +
 ...-add-dfs-clock-mode-support-to-geni-.patch |  166 ++
 queue-6.17/series                             |  457 ++++
 ...port-avoid-reconnects-triggered-by-p.patch |   70 +
 ...e-cfid-last_access_time-in-open_cach.patch |   39 +
 ...ond-read-of-eeprom-mac-when-possible.patch |   55 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 .../sparc64-fix-prototypes-of-reads-bwl.patch |   51 +
 ...te-bind-bucket-state-on-port-release.patch |  279 +++
 ...rcu-in-tcp_fastopen_active_disable_o.patch |   44 +
 ...is_pciehp-instead-of-is_hotplug_brid.patch |   63 +
 ...tools-ynl-gen-validate-nested-arrays.patch |  139 ++
 ...ilog-use-platform-device-for-probing.patch |  534 +++++
 ...rial-modify-the-use-of-dev_err_probe.patch |   54 +
 ...ng-return-value-for-vt_resize-in-vt_.patch |   39 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...-use-after-free-during-failed-initia.patch |   62 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...-support-for-hosts-with-zero-usb3-po.patch |   97 +
 ...-fix-usb2-only-root-hub-registration.patch |   61 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...gpu-add-gb300-sku-to-the-devid-table.patch |   38 +
 ...x-handling-on-legacy-non-pci-2.3-dev.patch |   77 +
 ...notty-for-unsupported-device-feature.patch |   40 +
 ...e-hash-table-using-in-virtio_fs_enqu.patch |   73 +
 ..._wdt-fix-max_timeout-being-calculate.patch |   59 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...increase-dp_reo_cmd_ring_size-to-256.patch |   41 +
 ...pdate-the-time-stamps-in-hidden-ssid.patch |   63 +
 ...ifi-fw-add-asus-to-ppag-and-tas-list.patch |   64 +
 ...-trigger-mlo-scan-only-when-not-in-e.patch |   67 +
 ...e-remember-when-interrupts-are-disab.patch |   47 +
 ...unt-reg-connection-element-in-the-si.patch |   41 +
 ...x-6-ghz-band-capabilities-element-ad.patch |   66 +
 ...11-fix-he-capabilities-element-check.patch |   37 +
 ...t-the-correct-interface-for-non-netd.patch |  136 ++
 ...80211-track-nan-interface-start-stop.patch |  124 ++
 ...mt76-improve-phy-reset-on-hw-restart.patch |   35 +
 ...ifi-mt76-mt76_eeprom_override-to-int.patch |  249 +++
 ...-add-160mhz-beamformee-capability-fo.patch |   43 +
 ...mt7925-add-pci-restore-for-hibernate.patch |   84 +
 ...-disable-promiscuous-mode-by-default.patch |   38 +
 ...-fix-memory-leak-on-mt7996_mcu_sta_k.patch |   37 +
 ...-fix-mt7996_reverse_frag0_hdr_trans-.patch |   63 +
 ...-set-def_wcid-pointer-in-mt7996_mac_.patch |   37 +
 ...-support-writing-mac-txd-for-addba-r.patch |  177 ++
 ...mt76-mt7996-temporarily-disable-epcs.patch |   36 +
 ...tx-queue-for-offchannel-tx-on-connac.patch |   36 +
 ...use-indirect-io-for-device-registers.patch |   52 +
 ...w89-8851b-rfk-update-iqk-tia-setting.patch |  215 ++
 ...ummy-c2h-handlers-for-bcn-resend-and.patch |   88 +
 ...sb-id-2001-3327-for-d-link-ax18u-rev.patch |   38 +
 ...sb-id-2001-332a-for-d-link-ax9u-rev..patch |   40 +
 ...limit-wi-fi-scan-slot-cost-to-avoid-.patch |   62 +
 ...le-rtw89_physts_ie09_ftr_0-for-ppdu-.patch |   37 +
 ...ssid-comparison-for-non-transmitted-.patch |   47 +
 ...obtain-rx-path-from-ppdu-status-ie00.patch |   51 +
 ...int-just-once-for-unknown-c2h-events.patch |   84 +
 ...-a-completion-for-each-h2c-command-w.patch |  157 ++
 ...emove-notify-during-wowlan-net-detec.patch |   45 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...-precalculated-tdvpr-page-physical-a.patch |  177 ++
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 ...op-redundant-locking-and-refcounting.patch |  173 ++
 ...-gaudi2-fix-bmon-disable-configurati.patch |   37 +
 ...-gaudi2-read-preboot-status-after-re.patch |   53 +
 ...-return-enomem-if-less-than-requeste.patch |   42 +
 ...-support-mapping-cb-with-vmalloc-bac.patch |   84 +
 ...method.c-to-get-rid-of-unused-variab.patch |   36 +
 .../allow-finish_no_open-file-err_ptr-e.patch |   50 +
 ...an-data-race-warning-at-snd_seq_fifo.patch |   39 +
 ...-generic-remove-shared-static-buffer.patch |   71 +
 ...dd-mono-main-switch-to-presonus-s182.patch |   80 +
 ...dd-validation-of-uac2-uac3-effect-un.patch |   52 +
 ...udio-apply-quirk-for-moondrop-quark2.patch |   42 +
 ...ve-a-race-in-amdgpu_amdkfd_device_fi.patch |  121 ++
 ...xp-explicitly-set-s16le-format-in-sc.patch |   47 +
 ...anage-context-in-set_sysclk-callback.patch |   49 +
 ...-fix-class-d-initialization-for-tlv3.patch |   99 +
 ...bcsp-receive-data-only-if-registered.patch |   58 +
 ...check-for-unexpected-bytes-when-defr.patch |  122 ++
 ...uetooth-sco-fix-uaf-on-sco_conn_free.patch |  124 ++
 ...to-backup-port-when-port-is-administ.patch |   61 +
 ...ot-request-module-for-miscdevice-wit.patch |   58 +
 ...isc_register-reentry-for-miscdevice-.patch |   71 +
 ...ct-the-dynamic-range-to-exclude-rese.patch |  100 +
 ...l_init-in-misc_deregister-to-reiniti.patch |   52 +
 ...le-the-entropy-delay-interval-for-re.patch |   49 +
 ...calloc-in-qat_uclo_map_objs_from_mof.patch |   43 +
 ...un8i-ce-remove-channel-timeout-field.patch |  120 ++
 ...-edma-set-status-for-callback_result.patch |   74 +
 ...ne-mv_xor-match-alloc_wc-and-free_wc.patch |   44 +
 ...aengine-sh-setup_xref-error-handling.patch |  118 ++
 ...-amd-add-more-cyan-skillfish-pci-ids.patch |   36 +
 ...m-amd-avoid-evicting-resources-at-s5.patch |   48 +
 ...add-avi-infoframe-copy-in-copy_strea.patch |  105 +
 ...play-add-more-cyan-skillfish-devices.patch |   58 +
 ...drm-amd-display-disable-vrr-on-dce-6.patch |   79 +
 ...ensure-committing-streams-is-seamles.patch |   53 +
 ...-amd-display-fix-dvi-d-hdmi-adapters.patch |   57 +
 ...increase-aux-intra-hop-done-max-wait.patch |   58 +
 ...update-dpp-disp-clock-from-smu-clock.patch |  123 ++
 ...use-cached-metrics-data-on-aldebaran.patch |   37 +
 ...-use-cached-metrics-data-on-arcturus.patch |   37 +
 ...-support-for-cyan-skillfish-gpu_info.patch |   44 +
 ...llow-kfd-criu-with-no-buffer-objects.patch |   40 +
 ...u-don-t-enable-smu-on-cyan-skillfish.patch |   42 +
 ...eg-hold-pg_lock-before-jpeg-poweroff.patch |   42 +
 ...-reject-gang-submissions-under-sriov.patch |   52 +
 ...ct-max-pixel-clock-for-hdmi-and-dvi-.patch |  114 +
 ...emdup_array_user-in-amdgpu_cs_wait_f.patch |   64 +
 ...ram-allocation-failure-for-a-special.patch |   43 +
 ...e-lack-of-read-permissions-in-svm-ma.patch |   67 +
 ...return-enotty-for-unsupported-ioctls.patch |   53 +
 ...ie-unmap_latency-to-queue_preemption.patch |   48 +
 ...dsi-don-t-fail-on-mipi_dsi_mode_vide.patch |   44 +
 ...e-cdns-dsi-fix-reg_wakeup_time-value.patch |   58 +
 ...ay-connector-don-t-set-op_detect-for.patch |   51 +
 ...toggle-back-buffer-resync-after-prep.patch |   44 +
 ...phy_7nm-fix-missing-initial-vco-rate.patch |   54 +
 ...e-to-not-queue-up-recovery-more-than.patch |   43 +
 ...ace-snprintf-with-scnprintf-in-nvkm_.patch |   41 +
 ...tc-modesetting-parameters-with-adjus.patch |   48 +
 ...e-crtc_-timings-when-programming-the.patch |   76 +
 ...-8139too_pio-depend-on-no_ioport_map.patch |   44 +
 ...-device_get_mac_address-to-use-nvmem.patch |   42 +
 .../exfat-limit-log-print-for-io-error.patch  |   85 +
 ...4-increase-io-priority-of-fastcommit.patch |   50 +
 ...fix-wakeup-source-leaks-on-device-un.patch |   37 +
 ...nfinite-loop-in-__insert_extent_tree.patch |   42 +
 ...fp_kernel-to-gfp_nofs-to-avoid-deadl.patch |   34 +
 ...x-softlockup-in-ftrace_module_enable.patch |   44 +
 ...e-zero-initialize-inode-private-data.patch |   46 +
 ...-folio-to-generic-group-for-multitou.patch |   65 +
 ...lve-touchpad-issues-on-dell-systems-.patch |  130 ++
 ...use-pk-through-printk-or-tracepoints.patch |  104 +
 ...c-load-calibrated-values-even-calibr.patch |   88 +
 ...c-mask-spear_adc_status-channel-and-.patch |   65 +
 ...ima_digsig-flag-when-setting-or-remo.patch |  155 ++
 ...nabling-command-event-buffers-for-kd.patch |   79 +
 ...-clear-stream-error-indicator-bits-f.patch |   49 +
 ...ce-snprintf-with-scnprintf-in-dmar_l.patch |  131 ++
 ...checks-on-ipv6_devconf.rpl_seg_enabl.patch |   39 +
 .../ipv6-np-rxpmtu-race-annotation.patch      |   58 +
 ...lized-waitqueue-in-transaction-manag.patch |   61 +
 ...fy-inode-mode-when-loading-from-disk.patch |   46 +
 ...reate_kern-interface-to-create-kerne.patch |   42 +
 ...add-missing-lock-in-suspend-callback.patch |   57 +
 ...-not-write-format-to-device-in-set_f.patch |   50 +
 ...180-only-validate-format-in-querystd.patch |   85 +
 ...lete-v4l2_fh-synchronously-in-.relea.patch |   91 +
 ...ia-fix-uninitialized-symbol-warnings.patch |  113 +
 ...g-ensure-a-dependency-on-have_clk-fo.patch |   42 +
 ...b-specify-monochrome-media-bus-forma.patch |   59 +
 ...ia-imon-make-send_packet-more-robust.patch |  184 ++
 ...8x40-fix-the-horizontal-flip-control.patch |   39 +
 ...a-pci-ivtv-don-t-create-fake-v4l2_fh.patch |  180 ++
 ...e-int-type-to-store-negative-error-c.patch |   40 +
 ...n-explicitly-disable-selection-api-i.patch |   64 +
 ...be-add-missing-device_type-in-pci-no.patch |   36 +
 ...be-add-missing-properties-to-cpu-nod.patch |   44 +
 ...iq-danube-add-model-to-easy50712-dts.patch |   36 +
 ...be-rename-stp-node-on-easy50712-refe.patch |   36 +
 ...lantiq-xway-sysctrl-rename-stp-clock.patch |   38 +
 ...install-fdb-for-bridge-mac-on-vlan-0.patch |   82 +
 ...resched-less-often-in-__release_sock.patch |  109 +
 ...ock_exceed_buf_limit-for-memcg-failu.patch |   48 +
 ...ix-task_get_classid-during-qdisc-run.patch |  107 +
 ...rochip-sparx5-make-it-selectable-for.patch |   37 +
 ...k-fix-parameter-idx-set-but-not-used.patch |   92 +
 ...ld-spanning-memcpy-warning-in-ah-out.patch |  117 ++
 ...ealing-with-endianness-in-macb_set_h.patch |   57 +
 ...query-fec-statistics-when-fec-is-dis.patch |   66 +
 ...increase-nci_data_timeout-to-3000-ms.patch |   47 +
 ...r-link-parameters-on-admin-link-down.patch |   62 +
 ...y-let-fixed_phy_unregister-free-the-.patch |   74 +
 ...fix-88e1510-downshift-counter-errata.patch |   89 +
 ...isable-wol-if-system-can-not-suspend.patch |   59 +
 ...eck-stmmac_hw_setup-in-stmmac_resume.patch |   46 +
 ...ctly-handle-rx-checksum-offload-erro.patch |   49 +
 ...g-nexthops-don-t-call-synchronize_ne.patch |   98 +
 ...ect-don-t-reply-to-icmp-error-messag.patch |  129 ++
 ...ir-insufficient-locking-for-d_parent.patch |   41 +
 ...ndle-err_grace-on-delegation-recalls.patch |   39 +
 ...nt-hang-after-create_session-failure.patch |   49 +
 ...tend-extend-records-as-regular-files.patch |   37 +
 ...fs-fix-xattr-related-buffer-overflow.patch |   86 +
 ...-add-gfp_nowarn-for-atomic-allocatio.patch |   43 +
 ...ool-clamp-pool-size-to-max-16k-pages.patch |   52 +
 ...k-for-the-existence-of-cdns_pcie-ops.patch |   94 +
 ...sable-msi-on-rdc-pci-to-pcie-bridges.patch |   39 +
 ...he-single-edma-irq-in-dw_pcie_edma_i.patch |   53 +
 ...ncorrect-pointer-usage-in-devm_kfree.patch |   45 +
 ...ming-to-d0-if-device-is-disconnected.patch |   60 +
 ...-dphy-enable-lower-resolutions-in-dp.patch |   51 +
 ...79f0-ether-serdes-add-new-step-added.patch |   77 +
 ...-rockchip-inno-csidphy-allow-writes-.patch |   55 +
 ...e-result-of-error_detected-in-uevent.patch |   48 +
 ...ptp-limit-time-setting-of-ptp-clocks.patch |   81 +
 .../r8169-set-eee-speed-down-ratio-to-1.patch |   63 +
 queue-6.6/rdma-irdma-update-kconfig.patch     |   42 +
 ...anness-annotation-for-rds_mpath_hash.patch |   39 +
 ...m-q6v5-avoid-handling-handover-twice.patch |   42 +
 ...m3-use-devm_pm_runtime_enable-helper.patch |   54 +
 ...i-use-pci_uevent_ers-in-pci-recovery.patch |   80 +
 ...otential-buffer-overflow-in-fc_ct_ms.patch |   70 +
 ...return-status-of-lpfc_reset_flush_io.patch |   66 +
 ...-size-of-debugfs-entry-for-xri-rebal.patch |   40 +
 ...-ndlp-kref-decrement-clause-for-f_po.patch |   64 +
 ...controller-init-failure-on-fault-dur.patch |   56 +
 ...-support-for-22.5-gbps-sas-link-rate.patch |   39 +
 ...int-instead-of-u32-to-store-error-co.patch |   36 +
 ...race-condition-caused-by-static-vari.patch |   94 +
 ...sable-timestamp-functionality-if-not.patch |   67 +
 ...diatek-assign-power-mode-userdata-be.patch |   61 +
 ...diatek-change-reset-sequence-for-imp.patch |   44 +
 ...diatek-disable-auto-hibern8-during-p.patch |  109 +
 ...diatek-enhance-recovery-on-hibernati.patch |   99 +
 ...diatek-enhance-recovery-on-resume-fa.patch |   50 +
 ...diatek-fix-auto-hibern8-timer-config.patch |  147 ++
 ...diatek-fix-invalid-access-in-vccqx-h.patch |   41 +
 ...isable-dad-for-ipv6-in-fcnal-test.sh.patch |   37 +
 ...le-include-install_dep_targets-in-cl.patch |   44 +
 ...sure-assert-triggers-in-psock_tpacke.patch |   45 +
 ...place-non-standard-__wordsize-with-s.patch |   54 +
 ...place-sleeps-in-fcnal-test-with-wait.patch | 1849 +++++++++++++++++
 ...elftests-replace-sleep-with-slowwait.patch |   36 +
 ...tests-traceroute-use-require_command.patch |   78 +
 queue-6.6/series                              |  187 ++
 ...port-avoid-reconnects-triggered-by-p.patch |   70 +
 ...ond-read-of-eeprom-mac-when-possible.patch |   55 +
 ...add-r_sparc_ua64-relocation-handling.patch |   48 +
 .../sparc64-fix-prototypes-of-reads-bwl.patch |   51 +
 ...is_pciehp-instead-of-is_hotplug_brid.patch |   63 +
 ...e-netdev_warn-instead-of-netdev_warn.patch |   44 +
 ...-use-after-free-during-failed-initia.patch |   62 +
 ...fix-epfile-null-pointer-access-after.patch |   60 +
 ..._hid-fix-zero-length-packet-transfer.patch |   47 +
 ..._ncm-fix-mac-assignment-ncm-ethernet.patch |   56 +
 ...-buff_max-to-64-mib-to-support-multi.patch |   85 +
 ...cilitate-using-autosuspend-for-xhci-.patch |   40 +
 ...notty-for-unsupported-device-feature.patch |   40 +
 ..._wdt-fix-max_timeout-being-calculate.patch |   59 +
 ...0k-fix-connection-after-gtk-rekeying.patch |   66 +
 ...increase-dp_reo_cmd_ring_size-to-256.patch |   41 +
 ...11-fix-he-capabilities-element-check.patch |   37 +
 ...-add-160mhz-beamformee-capability-fo.patch |   43 +
 ...mt76-mt7996-temporarily-disable-epcs.patch |   36 +
 ...use-indirect-io-for-device-registers.patch |   52 +
 ...ative-qspinlock-for-dedicated-vcpus-.patch |   81 +
 ...not-require-x86_pf_instr-to-emulate-.patch |   79 +
 1323 files changed, 101456 insertions(+)
 create mode 100644 queue-5.10/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-5.10/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-5.10/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
 create mode 100644 queue-5.10/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-5.10/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-5.10/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-5.10/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-5.10/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-5.10/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-5.10/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-5.10/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-5.10/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-5.10/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-5.10/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-5.10/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-5.10/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-5.10/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-5.10/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-5.10/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-5.10/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-5.10/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-5.10/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-5.10/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-5.10/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-5.10/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-5.10/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-5.10/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-5.10/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-5.10/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-5.10/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-5.10/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-5.10/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-5.10/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-5.10/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-5.10/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-5.10/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-5.10/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-5.10/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-5.10/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-5.10/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-5.10/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-5.10/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-5.10/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-5.10/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-5.10/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-5.10/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-5.10/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-5.10/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-5.10/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-5.10/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-5.10/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-5.10/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-5.10/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-5.10/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-5.10/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-5.10/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-5.10/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-5.10/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-5.10/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-5.10/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-5.10/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-5.10/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-5.10/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-5.10/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-5.10/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-5.10/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-5.10/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-5.10/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-5.10/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-5.10/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-5.10/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-5.10/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-5.10/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-5.10/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-5.10/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-5.10/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-5.10/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-5.10/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-5.10/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-5.15/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-5.15/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-5.15/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
 create mode 100644 queue-5.15/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
 create mode 100644 queue-5.15/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-5.15/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-5.15/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-5.15/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-5.15/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-5.15/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-5.15/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-5.15/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-5.15/drm-amd-add-more-cyan-skillfish-pci-ids.patch
 create mode 100644 queue-5.15/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
 create mode 100644 queue-5.15/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-5.15/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-5.15/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
 create mode 100644 queue-5.15/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-5.15/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-5.15/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-5.15/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
 create mode 100644 queue-5.15/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
 create mode 100644 queue-5.15/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
 create mode 100644 queue-5.15/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-5.15/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
 create mode 100644 queue-5.15/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-5.15/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-5.15/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-5.15/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-5.15/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-5.15/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-5.15/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-5.15/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
 create mode 100644 queue-5.15/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-5.15/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-5.15/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-5.15/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-5.15/media-adv7180-add-missing-lock-in-suspend-callback.patch
 create mode 100644 queue-5.15/media-adv7180-do-not-write-format-to-device-in-set_f.patch
 create mode 100644 queue-5.15/media-adv7180-only-validate-format-in-querystd.patch
 create mode 100644 queue-5.15/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-5.15/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-5.15/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-5.15/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-5.15/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-5.15/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-5.15/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-5.15/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-5.15/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-5.15/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-5.15/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
 create mode 100644 queue-5.15/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-5.15/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-5.15/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-5.15/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-5.15/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-5.15/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-5.15/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-5.15/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-5.15/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
 create mode 100644 queue-5.15/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-5.15/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-5.15/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-5.15/ntfs3-pretend-extend-records-as-regular-files.patch
 create mode 100644 queue-5.15/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-5.15/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
 create mode 100644 queue-5.15/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-5.15/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-5.15/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-5.15/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-5.15/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-5.15/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
 create mode 100644 queue-5.15/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-5.15/ptp-limit-time-setting-of-ptp-clocks.patch
 create mode 100644 queue-5.15/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-5.15/rdma-irdma-update-kconfig.patch
 create mode 100644 queue-5.15/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-5.15/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-5.15/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
 create mode 100644 queue-5.15/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-5.15/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-5.15/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
 create mode 100644 queue-5.15/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
 create mode 100644 queue-5.15/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-5.15/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-5.15/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-5.15/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-5.15/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-5.15/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-5.15/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-5.15/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-5.15/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-5.15/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
 create mode 100644 queue-5.15/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-5.15/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
 create mode 100644 queue-5.15/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-5.15/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-5.15/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-5.15/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-5.15/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-5.15/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-5.15/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-5.15/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-5.4/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-5.4/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-5.4/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-5.4/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-5.4/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-5.4/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-5.4/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-5.4/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-5.4/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-5.4/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-5.4/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-5.4/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-5.4/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-5.4/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-5.4/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-5.4/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-5.4/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-5.4/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-5.4/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-5.4/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-5.4/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-5.4/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-5.4/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-5.4/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-5.4/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-5.4/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-5.4/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-5.4/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-5.4/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-5.4/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-5.4/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-5.4/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-5.4/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-5.4/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-5.4/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-5.4/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-5.4/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-5.4/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-5.4/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-5.4/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-5.4/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-5.4/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-5.4/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-5.4/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-5.4/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-5.4/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-5.4/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-5.4/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-5.4/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-5.4/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-5.4/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-5.4/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-5.4/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-5.4/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-5.4/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-5.4/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-5.4/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-5.4/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-5.4/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-5.4/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-6.1/6pack-drop-redundant-locking-and-refcounting.patch
 create mode 100644 queue-6.1/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-6.1/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-6.1/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
 create mode 100644 queue-6.1/alsa-serial-generic-remove-shared-static-buffer.patch
 create mode 100644 queue-6.1/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
 create mode 100644 queue-6.1/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-6.1/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-6.1/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
 create mode 100644 queue-6.1/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-6.1/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
 create mode 100644 queue-6.1/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-6.1/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-6.1/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-6.1/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-6.1/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-6.1/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-6.1/drm-amd-add-more-cyan-skillfish-pci-ids.patch
 create mode 100644 queue-6.1/drm-amd-avoid-evicting-resources-at-s5.patch
 create mode 100644 queue-6.1/drm-amd-display-add-more-cyan-skillfish-devices.patch
 create mode 100644 queue-6.1/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
 create mode 100644 queue-6.1/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-6.1/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
 create mode 100644 queue-6.1/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
 create mode 100644 queue-6.1/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
 create mode 100644 queue-6.1/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-6.1/drm-amdgpu-reject-gang-submissions-under-sriov.patch
 create mode 100644 queue-6.1/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
 create mode 100644 queue-6.1/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
 create mode 100644 queue-6.1/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
 create mode 100644 queue-6.1/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-6.1/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-6.1/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-6.1/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
 create mode 100644 queue-6.1/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
 create mode 100644 queue-6.1/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
 create mode 100644 queue-6.1/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-6.1/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
 create mode 100644 queue-6.1/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-6.1/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-6.1/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
 create mode 100644 queue-6.1/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-6.1/ext4-increase-io-priority-of-fastcommit.patch
 create mode 100644 queue-6.1/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-6.1/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-6.1/ftrace-fix-softlockup-in-ftrace_module_enable.patch
 create mode 100644 queue-6.1/ice-don-t-use-pk-through-printk-or-tracepoints.patch
 create mode 100644 queue-6.1/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-6.1/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-6.1/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
 create mode 100644 queue-6.1/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-6.1/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-6.1/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-6.1/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-6.1/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
 create mode 100644 queue-6.1/media-adv7180-add-missing-lock-in-suspend-callback.patch
 create mode 100644 queue-6.1/media-adv7180-do-not-write-format-to-device-in-set_f.patch
 create mode 100644 queue-6.1/media-adv7180-only-validate-format-in-querystd.patch
 create mode 100644 queue-6.1/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
 create mode 100644 queue-6.1/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-6.1/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
 create mode 100644 queue-6.1/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
 create mode 100644 queue-6.1/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-6.1/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-6.1/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-6.1/media-verisilicon-explicitly-disable-selection-api-i.patch
 create mode 100644 queue-6.1/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-6.1/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-6.1/mips-lantiq-danube-add-model-to-easy50712-dts.patch
 create mode 100644 queue-6.1/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
 create mode 100644 queue-6.1/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-6.1/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
 create mode 100644 queue-6.1/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-6.1/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-6.1/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-6.1/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
 create mode 100644 queue-6.1/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-6.1/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-6.1/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-6.1/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
 create mode 100644 queue-6.1/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-6.1/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
 create mode 100644 queue-6.1/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-6.1/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-6.1/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-6.1/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-6.1/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
 create mode 100644 queue-6.1/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-6.1/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-6.1/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-6.1/ntfs3-pretend-extend-records-as-regular-files.patch
 create mode 100644 queue-6.1/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-6.1/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
 create mode 100644 queue-6.1/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-6.1/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-6.1/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-6.1/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-6.1/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
 create mode 100644 queue-6.1/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-6.1/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
 create mode 100644 queue-6.1/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-6.1/ptp-limit-time-setting-of-ptp-clocks.patch
 create mode 100644 queue-6.1/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-6.1/rdma-irdma-update-kconfig.patch
 create mode 100644 queue-6.1/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-6.1/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-6.1/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
 create mode 100644 queue-6.1/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
 create mode 100644 queue-6.1/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-6.1/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-6.1/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
 create mode 100644 queue-6.1/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
 create mode 100644 queue-6.1/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
 create mode 100644 queue-6.1/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-6.1/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-6.1/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
 create mode 100644 queue-6.1/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
 create mode 100644 queue-6.1/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
 create mode 100644 queue-6.1/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
 create mode 100644 queue-6.1/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-6.1/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-6.1/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-6.1/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-6.1/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
 create mode 100644 queue-6.1/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-6.1/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-6.1/smb-client-transport-avoid-reconnects-triggered-by-p.patch
 create mode 100644 queue-6.1/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
 create mode 100644 queue-6.1/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-6.1/sparc64-fix-prototypes-of-reads-bwl.patch
 create mode 100644 queue-6.1/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
 create mode 100644 queue-6.1/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-6.1/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
 create mode 100644 queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-6.1/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-6.1/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-6.1/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-6.1/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-6.1/vfio-return-enotty-for-unsupported-device-feature.patch
 create mode 100644 queue-6.1/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
 create mode 100644 queue-6.1/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-6.1/wifi-mac80211-fix-he-capabilities-element-check.patch
 create mode 100644 queue-6.1/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
 create mode 100644 queue-6.1/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-6.1/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-6.12/6pack-drop-redundant-locking-and-refcounting.patch
 create mode 100644 queue-6.12/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
 create mode 100644 queue-6.12/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
 create mode 100644 queue-6.12/accel-habanalabs-return-enomem-if-less-than-requeste.patch
 create mode 100644 queue-6.12/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
 create mode 100644 queue-6.12/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
 create mode 100644 queue-6.12/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-6.12/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-6.12/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
 create mode 100644 queue-6.12/alsa-serial-generic-remove-shared-static-buffer.patch
 create mode 100644 queue-6.12/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
 create mode 100644 queue-6.12/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-6.12/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-6.12/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
 create mode 100644 queue-6.12/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
 create mode 100644 queue-6.12/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
 create mode 100644 queue-6.12/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
 create mode 100644 queue-6.12/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
 create mode 100644 queue-6.12/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
 create mode 100644 queue-6.12/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-6.12/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
 create mode 100644 queue-6.12/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
 create mode 100644 queue-6.12/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-6.12/bnxt_en-add-hyper-v-vf-id.patch
 create mode 100644 queue-6.12/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-6.12/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
 create mode 100644 queue-6.12/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-6.12/char-misc-make-misc_register-reentry-for-miscdevice-.patch
 create mode 100644 queue-6.12/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
 create mode 100644 queue-6.12/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
 create mode 100644 queue-6.12/crypto-caam-double-the-entropy-delay-interval-for-re.patch
 create mode 100644 queue-6.12/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
 create mode 100644 queue-6.12/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
 create mode 100644 queue-6.12/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
 create mode 100644 queue-6.12/crypto-hisilicon-qm-invalidate-queues-in-use.patch
 create mode 100644 queue-6.12/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
 create mode 100644 queue-6.12/crypto-sun8i-ce-remove-channel-timeout-field.patch
 create mode 100644 queue-6.12/dm-error-mark-as-dm_target_passes_integrity.patch
 create mode 100644 queue-6.12/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-6.12/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-6.12/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-6.12/drm-amd-add-more-cyan-skillfish-pci-ids.patch
 create mode 100644 queue-6.12/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
 create mode 100644 queue-6.12/drm-amd-avoid-evicting-resources-at-s5.patch
 create mode 100644 queue-6.12/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
 create mode 100644 queue-6.12/drm-amd-display-add-fallback-path-for-ycbcr422.patch
 create mode 100644 queue-6.12/drm-amd-display-add-more-cyan-skillfish-devices.patch
 create mode 100644 queue-6.12/drm-amd-display-change-dc-stream-color-settings-only.patch
 create mode 100644 queue-6.12/drm-amd-display-disable-vrr-on-dce-6.patch
 create mode 100644 queue-6.12/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
 create mode 100644 queue-6.12/drm-amd-display-ensure-committing-streams-is-seamles.patch
 create mode 100644 queue-6.12/drm-amd-display-fix-condition-for-setting-timing_adj.patch
 create mode 100644 queue-6.12/drm-amd-display-fix-dml-ms-order-of-operations.patch
 create mode 100644 queue-6.12/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
 create mode 100644 queue-6.12/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
 create mode 100644 queue-6.12/drm-amd-display-fix-pbn_div-calculation-error.patch
 create mode 100644 queue-6.12/drm-amd-display-incorrect-conditions-for-failing-dto.patch
 create mode 100644 queue-6.12/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
 create mode 100644 queue-6.12/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
 create mode 100644 queue-6.12/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
 create mode 100644 queue-6.12/drm-amd-display-move-setup_stream_attribute.patch
 create mode 100644 queue-6.12/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
 create mode 100644 queue-6.12/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
 create mode 100644 queue-6.12/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
 create mode 100644 queue-6.12/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
 create mode 100644 queue-6.12/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
 create mode 100644 queue-6.12/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
 create mode 100644 queue-6.12/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-6.12/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
 create mode 100644 queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
 create mode 100644 queue-6.12/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
 create mode 100644 queue-6.12/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
 create mode 100644 queue-6.12/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
 create mode 100644 queue-6.12/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
 create mode 100644 queue-6.12/drm-amdgpu-check-vcn-sram-load-return-value.patch
 create mode 100644 queue-6.12/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
 create mode 100644 queue-6.12/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
 create mode 100644 queue-6.12/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
 create mode 100644 queue-6.12/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-6.12/drm-amdgpu-reject-gang-submissions-under-sriov.patch
 create mode 100644 queue-6.12/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
 create mode 100644 queue-6.12/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
 create mode 100644 queue-6.12/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
 create mode 100644 queue-6.12/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
 create mode 100644 queue-6.12/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
 create mode 100644 queue-6.12/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-6.12/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-6.12/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
 create mode 100644 queue-6.12/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
 create mode 100644 queue-6.12/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-6.12/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
 create mode 100644 queue-6.12/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
 create mode 100644 queue-6.12/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
 create mode 100644 queue-6.12/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
 create mode 100644 queue-6.12/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-6.12/drm-panel-backlight-quirks-make-edid-match-optional.patch
 create mode 100644 queue-6.12/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
 create mode 100644 queue-6.12/drm-panthor-serialize-gpu-cache-flush-operations.patch
 create mode 100644 queue-6.12/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
 create mode 100644 queue-6.12/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-6.12/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
 create mode 100644 queue-6.12/drm-xe-guc-add-more-guc-load-error-status-codes.patch
 create mode 100644 queue-6.12/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
 create mode 100644 queue-6.12/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
 create mode 100644 queue-6.12/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
 create mode 100644 queue-6.12/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-6.12/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
 create mode 100644 queue-6.12/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-6.12/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
 create mode 100644 queue-6.12/ext4-increase-io-priority-of-fastcommit.patch
 create mode 100644 queue-6.12/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-6.12/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
 create mode 100644 queue-6.12/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
 create mode 100644 queue-6.12/f2fs-fix-wrong-layout-information-on-16kb-page.patch
 create mode 100644 queue-6.12/fix-access-to-video_is_primary_device-when-compiled-.patch
 create mode 100644 queue-6.12/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-6.12/ftrace-fix-softlockup-in-ftrace_module_enable.patch
 create mode 100644 queue-6.12/fuse-zero-initialize-inode-private-data.patch
 create mode 100644 queue-6.12/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
 create mode 100644 queue-6.12/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
 create mode 100644 queue-6.12/hid-pidff-permissive_control-quirk-autodetection.patch
 create mode 100644 queue-6.12/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
 create mode 100644 queue-6.12/ib-ipoib-ignore-l3-master-device.patch
 create mode 100644 queue-6.12/ice-don-t-use-pk-through-printk-or-tracepoints.patch
 create mode 100644 queue-6.12/idpf-do-not-linearize-big-tso-packets.patch
 create mode 100644 queue-6.12/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
 create mode 100644 queue-6.12/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-6.12/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
 create mode 100644 queue-6.12/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
 create mode 100644 queue-6.12/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-6.12/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
 create mode 100644 queue-6.12/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
 create mode 100644 queue-6.12/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-6.12/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-6.12/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-6.12/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-6.12/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
 create mode 100644 queue-6.12/media-adv7180-add-missing-lock-in-suspend-callback.patch
 create mode 100644 queue-6.12/media-adv7180-do-not-write-format-to-device-in-set_f.patch
 create mode 100644 queue-6.12/media-adv7180-only-validate-format-in-querystd.patch
 create mode 100644 queue-6.12/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
 create mode 100644 queue-6.12/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-6.12/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
 create mode 100644 queue-6.12/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
 create mode 100644 queue-6.12/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-6.12/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
 create mode 100644 queue-6.12/media-ov08x40-fix-the-horizontal-flip-control.patch
 create mode 100644 queue-6.12/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-6.12/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
 create mode 100644 queue-6.12/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-6.12/media-verisilicon-explicitly-disable-selection-api-i.patch
 create mode 100644 queue-6.12/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
 create mode 100644 queue-6.12/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-6.12/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-6.12/mips-lantiq-danube-add-model-to-easy50712-dts.patch
 create mode 100644 queue-6.12/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
 create mode 100644 queue-6.12/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-6.12/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
 create mode 100644 queue-6.12/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-6.12/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-6.12/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-6.12/net-devmem-expose-tcp_recvmsg_locked-errors.patch
 create mode 100644 queue-6.12/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
 create mode 100644 queue-6.12/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
 create mode 100644 queue-6.12/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
 create mode 100644 queue-6.12/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-6.12/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
 create mode 100644 queue-6.12/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-6.12/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-6.12/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
 create mode 100644 queue-6.12/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-6.12/net-phy-clear-link-parameters-on-admin-link-down.patch
 create mode 100644 queue-6.12/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
 create mode 100644 queue-6.12/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-6.12/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-6.12/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-6.12/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
 create mode 100644 queue-6.12/net-stmmac-est-drop-frames-causing-hlbs-error.patch
 create mode 100644 queue-6.12/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
 create mode 100644 queue-6.12/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-6.12/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
 create mode 100644 queue-6.12/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-6.12/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-6.12/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-6.12/ntfs3-pretend-extend-records-as-regular-files.patch
 create mode 100644 queue-6.12/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
 create mode 100644 queue-6.12/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-6.12/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
 create mode 100644 queue-6.12/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-6.12/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-6.12/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-6.12/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
 create mode 100644 queue-6.12/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
 create mode 100644 queue-6.12/pci-err-update-device-error_state-already-after-rese.patch
 create mode 100644 queue-6.12/pci-imx6-enable-the-vaux-supply-if-available.patch
 create mode 100644 queue-6.12/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-6.12/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
 create mode 100644 queue-6.12/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-6.12/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
 create mode 100644 queue-6.12/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
 create mode 100644 queue-6.12/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
 create mode 100644 queue-6.12/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-6.12/ptp-limit-time-setting-of-ptp-clocks.patch
 create mode 100644 queue-6.12/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-6.12/rdma-irdma-update-kconfig.patch
 create mode 100644 queue-6.12/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-6.12/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-6.12/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
 create mode 100644 queue-6.12/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
 create mode 100644 queue-6.12/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
 create mode 100644 queue-6.12/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
 create mode 100644 queue-6.12/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-6.12/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
 create mode 100644 queue-6.12/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
 create mode 100644 queue-6.12/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-6.12/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
 create mode 100644 queue-6.12/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
 create mode 100644 queue-6.12/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
 create mode 100644 queue-6.12/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
 create mode 100644 queue-6.12/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
 create mode 100644 queue-6.12/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-6.12/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-6.12/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
 create mode 100644 queue-6.12/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
 create mode 100644 queue-6.12/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
 create mode 100644 queue-6.12/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-6.12/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
 create mode 100644 queue-6.12/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
 create mode 100644 queue-6.12/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
 create mode 100644 queue-6.12/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-6.12/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
 create mode 100644 queue-6.12/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-6.12/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-6.12/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
 create mode 100644 queue-6.12/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-6.12/selftests-traceroute-return-correct-value-on-failure.patch
 create mode 100644 queue-6.12/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-6.12/smb-client-transport-avoid-reconnects-triggered-by-p.patch
 create mode 100644 queue-6.12/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
 create mode 100644 queue-6.12/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-6.12/sparc64-fix-prototypes-of-reads-bwl.patch
 create mode 100644 queue-6.12/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
 create mode 100644 queue-6.12/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
 create mode 100644 queue-6.12/tty-serial-ip22zilog-use-platform-device-for-probing.patch
 create mode 100644 queue-6.12/tty-serial-modify-the-use-of-dev_err_probe.patch
 create mode 100644 queue-6.12/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
 create mode 100644 queue-6.12/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-6.12/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
 create mode 100644 queue-6.12/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-6.12/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-6.12/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-6.12/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-6.12/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
 create mode 100644 queue-6.12/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
 create mode 100644 queue-6.12/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-6.12/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
 create mode 100644 queue-6.12/vfio-return-enotty-for-unsupported-device-feature.patch
 create mode 100644 queue-6.12/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
 create mode 100644 queue-6.12/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-6.12/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
 create mode 100644 queue-6.12/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
 create mode 100644 queue-6.12/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
 create mode 100644 queue-6.12/wifi-mac80211-fix-he-capabilities-element-check.patch
 create mode 100644 queue-6.12/wifi-mac80211-track-nan-interface-start-stop.patch
 create mode 100644 queue-6.12/wifi-mt76-mt76_eeprom_override-to-int.patch
 create mode 100644 queue-6.12/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
 create mode 100644 queue-6.12/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
 create mode 100644 queue-6.12/wifi-mt76-mt7996-temporarily-disable-epcs.patch
 create mode 100644 queue-6.12/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
 create mode 100644 queue-6.12/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
 create mode 100644 queue-6.12/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
 create mode 100644 queue-6.12/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
 create mode 100644 queue-6.12/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
 create mode 100644 queue-6.12/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
 create mode 100644 queue-6.12/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-6.12/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-6.17/6pack-drop-redundant-locking-and-refcounting.patch
 create mode 100644 queue-6.17/accel-amdxdna-unify-pm-and-rpm-suspend-and-resume-ca.patch
 create mode 100644 queue-6.17/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
 create mode 100644 queue-6.17/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
 create mode 100644 queue-6.17/accel-habanalabs-return-enomem-if-less-than-requeste.patch
 create mode 100644 queue-6.17/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
 create mode 100644 queue-6.17/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
 create mode 100644 queue-6.17/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-6.17/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-6.17/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
 create mode 100644 queue-6.17/alsa-serial-generic-remove-shared-static-buffer.patch
 create mode 100644 queue-6.17/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-6.17/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-6.17/alsa-usb-audio-don-t-apply-interface-quirk-to-preson.patch
 create mode 100644 queue-6.17/amd-amdkfd-enhance-kfd-process-check-in-switch-parti.patch
 create mode 100644 queue-6.17/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
 create mode 100644 queue-6.17/asoc-codecs-wsa883x-handle-shared-reset-gpio-for-wsa.patch
 create mode 100644 queue-6.17/asoc-es8323-add-proper-left-right-mixer-controls-via.patch
 create mode 100644 queue-6.17/asoc-es8323-enable-dapm-power-widgets-for-playback-d.patch
 create mode 100644 queue-6.17/asoc-es8323-remove-dac-enablement-write-from-es8323_.patch
 create mode 100644 queue-6.17/asoc-intel-avs-do-not-share-the-name-pointer-between.patch
 create mode 100644 queue-6.17/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
 create mode 100644 queue-6.17/asoc-ops-improve-snd_soc_get_volsw.patch
 create mode 100644 queue-6.17/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
 create mode 100644 queue-6.17/asoc-renesas-msiof-add-.symmetric_xxx-on-snd_soc_dai.patch
 create mode 100644 queue-6.17/asoc-renesas-msiof-set-sifctr-register.patch
 create mode 100644 queue-6.17/asoc-renesas-msiof-tidyup-dmac-stop-timing.patch
 create mode 100644 queue-6.17/asoc-renesas-msiof-use-reset-controller.patch
 create mode 100644 queue-6.17/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
 create mode 100644 queue-6.17/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
 create mode 100644 queue-6.17/asoc-tas2781-add-keyword-init-in-profile-section.patch
 create mode 100644 queue-6.17/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
 create mode 100644 queue-6.17/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-6.17/bluetooth-btintel-add-support-for-blazariw-core.patch
 create mode 100644 queue-6.17/bluetooth-btintel_pcie-define-hdev-wakeup-callback.patch
 create mode 100644 queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3627-for-mt7925.patch
 create mode 100644 queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
 create mode 100644 queue-6.17/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
 create mode 100644 queue-6.17/bluetooth-iso-don-t-initiate-cis-connections-if-ther.patch
 create mode 100644 queue-6.17/bluetooth-iso-use-sk_sndtimeo-as-conn_timeout.patch
 create mode 100644 queue-6.17/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-6.17/bng_en-make-bnge_alloc_ring-self-unwind-on-failure.patch
 create mode 100644 queue-6.17/bnxt_en-add-fw-log-trace-support-for-5731x-5741x-chi.patch
 create mode 100644 queue-6.17/bnxt_en-add-hyper-v-vf-id.patch
 create mode 100644 queue-6.17/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-6.17/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
 create mode 100644 queue-6.17/bus-mhi-host-pci_generic-add-support-for-all-foxconn.patch
 create mode 100644 queue-6.17/can-rcar_canfd-update-bit-rate-constants-for-rz-g3e-.patch
 create mode 100644 queue-6.17/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-6.17/char-misc-make-misc_register-reentry-for-miscdevice-.patch
 create mode 100644 queue-6.17/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
 create mode 100644 queue-6.17/crypto-caam-double-the-entropy-delay-interval-for-re.patch
 create mode 100644 queue-6.17/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
 create mode 100644 queue-6.17/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
 create mode 100644 queue-6.17/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
 create mode 100644 queue-6.17/crypto-hisilicon-qm-invalidate-queues-in-use.patch
 create mode 100644 queue-6.17/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
 create mode 100644 queue-6.17/crypto-sun8i-ce-remove-channel-timeout-field.patch
 create mode 100644 queue-6.17/dm-error-mark-as-dm_target_passes_integrity.patch
 create mode 100644 queue-6.17/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-6.17/dmaengine-idxd-add-a-new-iaa-device-id-for-wildcat-l.patch
 create mode 100644 queue-6.17/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-6.17/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-6.17/docs-kernel-doc-avoid-script-crash-on-ancient-python.patch
 create mode 100644 queue-6.17/drm-amd-add-more-cyan-skillfish-pci-ids.patch
 create mode 100644 queue-6.17/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
 create mode 100644 queue-6.17/drm-amd-avoid-evicting-resources-at-s5.patch
 create mode 100644 queue-6.17/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
 create mode 100644 queue-6.17/drm-amd-display-add-fallback-path-for-ycbcr422.patch
 create mode 100644 queue-6.17/drm-amd-display-add-fast-sync-field-in-ultra-sleep-m.patch
 create mode 100644 queue-6.17/drm-amd-display-add-missing-post-flip-calls.patch
 create mode 100644 queue-6.17/drm-amd-display-add-more-cyan-skillfish-devices.patch
 create mode 100644 queue-6.17/drm-amd-display-cache-streams-targeting-link-when-pe.patch
 create mode 100644 queue-6.17/drm-amd-display-change-dc-stream-color-settings-only.patch
 create mode 100644 queue-6.17/drm-amd-display-consider-sink-max-slice-width-limita.patch
 create mode 100644 queue-6.17/drm-amd-display-disable-vrr-on-dce-6.patch
 create mode 100644 queue-6.17/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
 create mode 100644 queue-6.17/drm-amd-display-don-t-use-non-registered-vupdate-on-.patch
 create mode 100644 queue-6.17/drm-amd-display-dont-wait-for-pipe-update-during-med.patch
 create mode 100644 queue-6.17/drm-amd-display-ensure-committing-streams-is-seamles.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-condition-for-setting-timing_adj.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-dmcub-loading-sequence-for-dcn3..patch
 create mode 100644 queue-6.17/drm-amd-display-fix-dml-ms-order-of-operations.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-dmub-access-race-condition.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-dmub_cmd-header-alignment.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
 create mode 100644 queue-6.17/drm-amd-display-fix-pbn_div-calculation-error.patch
 create mode 100644 queue-6.17/drm-amd-display-incorrect-conditions-for-failing-dto.patch
 create mode 100644 queue-6.17/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
 create mode 100644 queue-6.17/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
 create mode 100644 queue-6.17/drm-amd-display-indicate-when-custom-brightness-curv.patch
 create mode 100644 queue-6.17/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
 create mode 100644 queue-6.17/drm-amd-display-keep-pll0-running-on-dce-6.0-and-6.4.patch
 create mode 100644 queue-6.17/drm-amd-display-move-setup_stream_attribute.patch
 create mode 100644 queue-6.17/drm-amd-display-remove-check-dpia-hpd-status-for-bw-.patch
 create mode 100644 queue-6.17/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
 create mode 100644 queue-6.17/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
 create mode 100644 queue-6.17/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
 create mode 100644 queue-6.17/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
 create mode 100644 queue-6.17/drm-amd-display-update-tiled-to-tiled-copy-command.patch
 create mode 100644 queue-6.17/drm-amd-display-wait-for-otg-update-pending-latch-be.patch
 create mode 100644 queue-6.17/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
 create mode 100644 queue-6.17/drm-amd-pm-increase-smc-timeout-on-si-and-warn-v3.patch
 create mode 100644 queue-6.17/drm-amd-pm-refine-amdgpu-pm-sysfs-node-error-code.patch
 create mode 100644 queue-6.17/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
 create mode 100644 queue-6.17/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-6.17/drm-amdgpu-add-fallback-to-pipe-reset-if-kcq-ring-re.patch
 create mode 100644 queue-6.17/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
 create mode 100644 queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
 create mode 100644 queue-6.17/drm-amdgpu-add-to-custom-amdgpu_drm_release-drm_dev_.patch
 create mode 100644 queue-6.17/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
 create mode 100644 queue-6.17/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
 create mode 100644 queue-6.17/drm-amdgpu-avoid-jpeg-v5.0.1-poison-irq-call-trace-o.patch
 create mode 100644 queue-6.17/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
 create mode 100644 queue-6.17/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
 create mode 100644 queue-6.17/drm-amdgpu-check-vcn-sram-load-return-value.patch
 create mode 100644 queue-6.17/drm-amdgpu-correct-info-field-of-bad-page-threshold-.patch
 create mode 100644 queue-6.17/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
 create mode 100644 queue-6.17/drm-amdgpu-correct-the-loss-of-aca-bank-reg-info.patch
 create mode 100644 queue-6.17/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
 create mode 100644 queue-6.17/drm-amdgpu-effective-health-check-before-reset.patch
 create mode 100644 queue-6.17/drm-amdgpu-fix-build-error-when-config_suspend-is-di.patch
 create mode 100644 queue-6.17/drm-amdgpu-fix-fence-signaling-race-condition-in-use.patch
 create mode 100644 queue-6.17/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
 create mode 100644 queue-6.17/drm-amdgpu-fix-vcn-v5.0.1-poison-irq-call-trace.patch
 create mode 100644 queue-6.17/drm-amdgpu-initialize-jpeg-v5_0_1-ras-function.patch
 create mode 100644 queue-6.17/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-6.17/drm-amdgpu-notify-pmfw-bad-page-threshold-exceeded.patch
 create mode 100644 queue-6.17/drm-amdgpu-refactor-bad_page_work-for-corner-case-ha.patch
 create mode 100644 queue-6.17/drm-amdgpu-reject-gang-submissions-under-sriov.patch
 create mode 100644 queue-6.17/drm-amdgpu-release-hive-reference-properly.patch
 create mode 100644 queue-6.17/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
 create mode 100644 queue-6.17/drm-amdgpu-skip-mgpu-fan-boost-for-multi-vf.patch
 create mode 100644 queue-6.17/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
 create mode 100644 queue-6.17/drm-amdgpu-update-ipid-value-for-bad-page-threshold-.patch
 create mode 100644 queue-6.17/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
 create mode 100644 queue-6.17/drm-amdgpu-validate-userq-buffer-virtual-address-and.patch
 create mode 100644 queue-6.17/drm-amdgpu-validate-userq-input-args.patch
 create mode 100644 queue-6.17/drm-amdgpu-vpe-cancel-delayed-work-in-hw_fini.patch
 create mode 100644 queue-6.17/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
 create mode 100644 queue-6.17/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
 create mode 100644 queue-6.17/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-6.17/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-6.17/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
 create mode 100644 queue-6.17/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
 create mode 100644 queue-6.17/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-6.17/drm-bridge-write-full-audio-infoframe.patch
 create mode 100644 queue-6.17/drm-gpusvm-fix-hmm_pfn_to_map_order-usage.patch
 create mode 100644 queue-6.17/drm-msm-a6xx-switch-to-gmu-ao-counter.patch
 create mode 100644 queue-6.17/drm-msm-adreno-add-fenced-regwrite-support.patch
 create mode 100644 queue-6.17/drm-msm-adreno-add-speedbin-data-for-a623-gpu.patch
 create mode 100644 queue-6.17/drm-msm-adreno-add-speedbins-for-a663-gpu.patch
 create mode 100644 queue-6.17/drm-msm-dpu-filter-modes-based-on-adjusted-mode-cloc.patch
 create mode 100644 queue-6.17/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
 create mode 100644 queue-6.17/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
 create mode 100644 queue-6.17/drm-msm-fix-32b-size-truncation.patch
 create mode 100644 queue-6.17/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
 create mode 100644 queue-6.17/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
 create mode 100644 queue-6.17/drm-msm-use-of_reserved_mem_region_to_resource-for-m.patch
 create mode 100644 queue-6.17/drm-nouveau-always-set-rmdevidcheckignore-for-gsp-rm.patch
 create mode 100644 queue-6.17/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-6.17/drm-panel-backlight-quirks-make-edid-match-optional.patch
 create mode 100644 queue-6.17/drm-panel-edp-add-shp-lq134z1-panel-for-dell-xps-934.patch
 create mode 100644 queue-6.17/drm-panel-ilitek-ili9881c-move-display_on-_off-dcs-c.patch
 create mode 100644 queue-6.17/drm-panel-ilitek-ili9881c-turn-off-power-supply-when.patch
 create mode 100644 queue-6.17/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
 create mode 100644 queue-6.17/drm-panthor-serialize-gpu-cache-flush-operations.patch
 create mode 100644 queue-6.17/drm-sharp-memory-do-not-access-gem-dma-vaddr-directl.patch
 create mode 100644 queue-6.17/drm-st7571-i2c-add-support-for-inverted-pixel-format.patch
 create mode 100644 queue-6.17/drm-tidss-remove-early-fb.patch
 create mode 100644 queue-6.17/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
 create mode 100644 queue-6.17/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-6.17/drm-xe-cancel-pending-tlb-inval-workers-on-teardown.patch
 create mode 100644 queue-6.17/drm-xe-configfs-enforce-canonical-device-names.patch
 create mode 100644 queue-6.17/drm-xe-ensure-gt-is-in-c0-during-resumes.patch
 create mode 100644 queue-6.17/drm-xe-extend-wa_13012615864-to-additional-xe2-and-x.patch
 create mode 100644 queue-6.17/drm-xe-extend-wa_22021007897-to-xe3-platforms.patch
 create mode 100644 queue-6.17/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
 create mode 100644 queue-6.17/drm-xe-guc-add-devm-release-action-to-safely-tear-do.patch
 create mode 100644 queue-6.17/drm-xe-guc-add-more-guc-load-error-status-codes.patch
 create mode 100644 queue-6.17/drm-xe-guc-always-add-ct-disable-action-during-secon.patch
 create mode 100644 queue-6.17/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
 create mode 100644 queue-6.17/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
 create mode 100644 queue-6.17/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
 create mode 100644 queue-6.17/drm-xe-i2c-enable-bus-mastering.patch
 create mode 100644 queue-6.17/drm-xe-improve-dma-resv-handling-for-backup-object.patch
 create mode 100644 queue-6.17/drm-xe-make-page-size-consistent-in-loop.patch
 create mode 100644 queue-6.17/drm-xe-pcode-initialize-data0-for-pcode-read-routine.patch
 create mode 100644 queue-6.17/drm-xe-pf-don-t-resume-device-from-restart-worker.patch
 create mode 100644 queue-6.17/drm-xe-pf-program-lmtt-directory-pointer-on-all-gts-.patch
 create mode 100644 queue-6.17/drm-xe-ptl-apply-wa_16026007364.patch
 create mode 100644 queue-6.17/drm-xe-rework-pde-pat-index-selection.patch
 create mode 100644 queue-6.17/drm-xe-set-gt-as-wedged-before-sending-wedged-uevent.patch
 create mode 100644 queue-6.17/drm-xe-wcl-extend-l3bank-mask-workaround.patch
 create mode 100644 queue-6.17/dt-bindings-display-msm-gmu-update-adreno-623-bindin.patch
 create mode 100644 queue-6.17/eeprom-at25-support-cypress-frams-without-device-id.patch
 create mode 100644 queue-6.17/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-6.17/eth-fbnic-reset-hw-stats-upon-pci-error.patch
 create mode 100644 queue-6.17/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
 create mode 100644 queue-6.17/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-6.17/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
 create mode 100644 queue-6.17/ext4-increase-io-priority-of-fastcommit.patch
 create mode 100644 queue-6.17/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-6.17/extcon-axp288-fix-wakeup-source-leaks-on-device-unbi.patch
 create mode 100644 queue-6.17/extcon-fsa9480-fix-wakeup-source-leaks-on-device-unb.patch
 create mode 100644 queue-6.17/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
 create mode 100644 queue-6.17/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
 create mode 100644 queue-6.17/f2fs-fix-wrong-layout-information-on-16kb-page.patch
 create mode 100644 queue-6.17/fbcon-use-screen-info-to-find-primary-device.patch
 create mode 100644 queue-6.17/fix-access-to-video_is_primary_device-when-compiled-.patch
 create mode 100644 queue-6.17/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-6.17/ftrace-fix-softlockup-in-ftrace_module_enable.patch
 create mode 100644 queue-6.17/fuse-zero-initialize-inode-private-data.patch
 create mode 100644 queue-6.17/gpu-nova-core-register-allow-fields-named-offset.patch
 create mode 100644 queue-6.17/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
 create mode 100644 queue-6.17/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
 create mode 100644 queue-6.17/hid-pidff-permissive_control-quirk-autodetection.patch
 create mode 100644 queue-6.17/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
 create mode 100644 queue-6.17/hinic3-fix-missing-napi-dev-in-netif_queue_set_napi.patch
 create mode 100644 queue-6.17/hinic3-queue-pair-endianness-improvements.patch
 create mode 100644 queue-6.17/hwrng-timeriomem-use-us_to_ktime-where-appropriate.patch
 create mode 100644 queue-6.17/ib-ipoib-ignore-l3-master-device.patch
 create mode 100644 queue-6.17/ice-don-t-use-pk-through-printk-or-tracepoints.patch
 create mode 100644 queue-6.17/idpf-do-not-linearize-big-tso-packets.patch
 create mode 100644 queue-6.17/idpf-link-napis-to-queues.patch
 create mode 100644 queue-6.17/iio-adc-ad7124-do-not-require-mclk.patch
 create mode 100644 queue-6.17/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
 create mode 100644 queue-6.17/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-6.17/iio-imu-bmi270-match-pnp-id-found-on-newer-gpd-firmw.patch
 create mode 100644 queue-6.17/iio-light-isl29125-use-iio_push_to_buffers_with_ts-t.patch
 create mode 100644 queue-6.17/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
 create mode 100644 queue-6.17/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
 create mode 100644 queue-6.17/iommu-amd-add-support-to-remap-unmap-iommu-buffers-f.patch
 create mode 100644 queue-6.17/iommu-amd-reuse-device-table-for-kdump.patch
 create mode 100644 queue-6.17/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-6.17/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
 create mode 100644 queue-6.17/iommu-vt-d-remove-lpig-from-page-group-response-desc.patch
 create mode 100644 queue-6.17/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
 create mode 100644 queue-6.17/ionic-use-int-type-for-err-in-ionic_get_module_eepro.patch
 create mode 100644 queue-6.17/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-6.17/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-6.17/ixgbe-reduce-number-of-reads-when-getting-orom-data.patch
 create mode 100644 queue-6.17/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-6.17/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-6.17/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
 create mode 100644 queue-6.17/media-adv7180-add-missing-lock-in-suspend-callback.patch
 create mode 100644 queue-6.17/media-adv7180-do-not-write-format-to-device-in-set_f.patch
 create mode 100644 queue-6.17/media-adv7180-only-validate-format-in-querystd.patch
 create mode 100644 queue-6.17/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
 create mode 100644 queue-6.17/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-6.17/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
 create mode 100644 queue-6.17/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
 create mode 100644 queue-6.17/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-6.17/media-imx-mipi-csis-only-set-clock-rate-when-specifi.patch
 create mode 100644 queue-6.17/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
 create mode 100644 queue-6.17/media-nxp-imx8-isi-fix-streaming-cleanup-on-release.patch
 create mode 100644 queue-6.17/media-ov08x40-fix-the-horizontal-flip-control.patch
 create mode 100644 queue-6.17/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-6.17/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
 create mode 100644 queue-6.17/media-qcom-camss-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch
 create mode 100644 queue-6.17/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-6.17/media-verisilicon-explicitly-disable-selection-api-i.patch
 create mode 100644 queue-6.17/mei-make-a-local-copy-of-client-uuid-in-connect.patch
 create mode 100644 queue-6.17/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
 create mode 100644 queue-6.17/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-6.17/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-6.17/mips-lantiq-danube-add-model-to-easy50712-dts.patch
 create mode 100644 queue-6.17/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
 create mode 100644 queue-6.17/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-6.17/misc-pci_endpoint_test-skip-irq-tests-if-irq-is-out-.patch
 create mode 100644 queue-6.17/move_mount-2-take-sanity-checks-in-beneath-case-into.patch
 create mode 100644 queue-6.17/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
 create mode 100644 queue-6.17/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-6.17/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-6.17/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-6.17/net-devmem-expose-tcp_recvmsg_locked-errors.patch
 create mode 100644 queue-6.17/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
 create mode 100644 queue-6.17/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
 create mode 100644 queue-6.17/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
 create mode 100644 queue-6.17/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-6.17/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
 create mode 100644 queue-6.17/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-6.17/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-6.17/net-mana-reduce-waiting-time-if-hwc-not-responding.patch
 create mode 100644 queue-6.17/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
 create mode 100644 queue-6.17/net-mlx5e-prevent-entering-switchdev-mode-with-incon.patch
 create mode 100644 queue-6.17/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-6.17/net-phy-clear-eee-runtime-state-in-phy_halted-phy_er.patch
 create mode 100644 queue-6.17/net-phy-clear-link-parameters-on-admin-link-down.patch
 create mode 100644 queue-6.17/net-phy-dp83640-improve-phydev-and-driver-removal-ha.patch
 create mode 100644 queue-6.17/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
 create mode 100644 queue-6.17/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-6.17/net-phy-mscc-report-and-configure-in-band-auto-negot.patch
 create mode 100644 queue-6.17/net-prevent-rps-table-overwrite-of-active-flows.patch
 create mode 100644 queue-6.17/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-6.17/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-6.17/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
 create mode 100644 queue-6.17/net-stmmac-est-drop-frames-causing-hlbs-error.patch
 create mode 100644 queue-6.17/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
 create mode 100644 queue-6.17/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-6.17/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
 create mode 100644 queue-6.17/netfilter-nf_tables-all-transaction-allocations-can-.patch
 create mode 100644 queue-6.17/netlink-specs-fou-change-local-v6-peer-v6-check.patch
 create mode 100644 queue-6.17/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-6.17/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-6.17/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-6.17/ntfs3-pretend-extend-records-as-regular-files.patch
 create mode 100644 queue-6.17/octeontx2-af-broadcast-xon-on-all-channels.patch
 create mode 100644 queue-6.17/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
 create mode 100644 queue-6.17/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-6.17/ovl-make-sure-that-ovl_create_real-returns-a-hashed-.patch
 create mode 100644 queue-6.17/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
 create mode 100644 queue-6.17/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-6.17/pci-aer-fix-null-pointer-access-by-aer_info.patch
 create mode 100644 queue-6.17/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-6.17/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-6.17/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
 create mode 100644 queue-6.17/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
 create mode 100644 queue-6.17/pci-err-update-device-error_state-already-after-rese.patch
 create mode 100644 queue-6.17/pci-imx6-enable-the-vaux-supply-if-available.patch
 create mode 100644 queue-6.17/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-6.17/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
 create mode 100644 queue-6.17/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-6.17/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
 create mode 100644 queue-6.17/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
 create mode 100644 queue-6.17/platform-x86-amd-pmf-fix-the-custom-bios-input-handl.patch
 create mode 100644 queue-6.17/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
 create mode 100644 queue-6.17/platform-x86-intel-uncore-freq-present-unique-domain.patch
 create mode 100644 queue-6.17/platform-x86-think-lmi-add-extra-tc-bios-error-messa.patch
 create mode 100644 queue-6.17/platform-x86-x86-android-tablets-stop-using-eprobe_d.patch
 create mode 100644 queue-6.17/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-6.17/ptp-limit-time-setting-of-ptp-clocks.patch
 create mode 100644 queue-6.17/ptp_ocp-make-ptp_ocp-driver-compatible-with-ptp_extt.patch
 create mode 100644 queue-6.17/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-6.17/rdma-irdma-update-kconfig.patch
 create mode 100644 queue-6.17/rdma-mana_ib-drain-send-wrs-of-gsi-qp.patch
 create mode 100644 queue-6.17/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-6.17/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-6.17/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
 create mode 100644 queue-6.17/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
 create mode 100644 queue-6.17/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
 create mode 100644 queue-6.17/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
 create mode 100644 queue-6.17/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-6.17/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
 create mode 100644 queue-6.17/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
 create mode 100644 queue-6.17/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-6.17/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
 create mode 100644 queue-6.17/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
 create mode 100644 queue-6.17/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
 create mode 100644 queue-6.17/scsi-mpi3mr-fix-device-loss-during-enclosure-reboot-.patch
 create mode 100644 queue-6.17/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
 create mode 100644 queue-6.17/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
 create mode 100644 queue-6.17/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-6.17/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-6.17/scsi-ufs-core-change-mcq-interrupt-enable-flow.patch
 create mode 100644 queue-6.17/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
 create mode 100644 queue-6.17/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-fix-adapt-issue-after-pa_init.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
 create mode 100644 queue-6.17/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
 create mode 100644 queue-6.17/scsi-ufs-ufs-qcom-align-programming-sequence-of-shar.patch
 create mode 100644 queue-6.17/scsi-ufs-ufs-qcom-disable-lane-clocks-during-phy-hib.patch
 create mode 100644 queue-6.17/selftest-net-fix-error-message-if-empty-variable.patch
 create mode 100644 queue-6.17/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-6.17/selftests-drv-net-devmem-add-correct-the-ipv6-suppor.patch
 create mode 100644 queue-6.17/selftests-drv-net-devmem-flip-the-direction-of-tx-te.patch
 create mode 100644 queue-6.17/selftests-drv-net-hds-restore-hds-settings.patch
 create mode 100644 queue-6.17/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
 create mode 100644 queue-6.17/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
 create mode 100644 queue-6.17/selftests-drv-net-wait-for-carrier.patch
 create mode 100644 queue-6.17/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
 create mode 100644 queue-6.17/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-6.17/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
 create mode 100644 queue-6.17/selftests-ncdevmem-don-t-retry-efault.patch
 create mode 100644 queue-6.17/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-6.17/selftests-net-lib.sh-don-t-defer-failed-commands.patch
 create mode 100644 queue-6.17/selftests-net-make-the-dump-test-less-sensitive-to-m.patch
 create mode 100644 queue-6.17/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-6.17/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
 create mode 100644 queue-6.17/selftests-pci_endpoint-skip-irq-test-if-irq-is-out-o.patch
 create mode 100644 queue-6.17/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-6.17/selftests-traceroute-return-correct-value-on-failure.patch
 create mode 100644 queue-6.17/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-6.17/serdev-drop-dev_pm_domain_detach-call.patch
 create mode 100644 queue-6.17/serial-qcom-geni-add-dfs-clock-mode-support-to-geni-.patch
 create mode 100644 queue-6.17/smb-client-transport-avoid-reconnects-triggered-by-p.patch
 create mode 100644 queue-6.17/smb-client-update-cfid-last_access_time-in-open_cach.patch
 create mode 100644 queue-6.17/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
 create mode 100644 queue-6.17/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-6.17/sparc64-fix-prototypes-of-reads-bwl.patch
 create mode 100644 queue-6.17/tcp-update-bind-bucket-state-on-port-release.patch
 create mode 100644 queue-6.17/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
 create mode 100644 queue-6.17/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
 create mode 100644 queue-6.17/tools-ynl-gen-validate-nested-arrays.patch
 create mode 100644 queue-6.17/tty-serial-ip22zilog-use-platform-device-for-probing.patch
 create mode 100644 queue-6.17/tty-serial-modify-the-use-of-dev_err_probe.patch
 create mode 100644 queue-6.17/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
 create mode 100644 queue-6.17/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-6.17/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
 create mode 100644 queue-6.17/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-6.17/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-6.17/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-6.17/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-6.17/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
 create mode 100644 queue-6.17/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
 create mode 100644 queue-6.17/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-6.17/vfio-nvgrace-gpu-add-gb300-sku-to-the-devid-table.patch
 create mode 100644 queue-6.17/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
 create mode 100644 queue-6.17/vfio-return-enotty-for-unsupported-device-feature.patch
 create mode 100644 queue-6.17/virtio_fs-fix-the-hash-table-using-in-virtio_fs_enqu.patch
 create mode 100644 queue-6.17/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
 create mode 100644 queue-6.17/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-6.17/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
 create mode 100644 queue-6.17/wifi-cfg80211-update-the-time-stamps-in-hidden-ssid.patch
 create mode 100644 queue-6.17/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
 create mode 100644 queue-6.17/wifi-iwlwifi-mld-trigger-mlo-scan-only-when-not-in-e.patch
 create mode 100644 queue-6.17/wifi-iwlwifi-pcie-remember-when-interrupts-are-disab.patch
 create mode 100644 queue-6.17/wifi-mac80211-count-reg-connection-element-in-the-si.patch
 create mode 100644 queue-6.17/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
 create mode 100644 queue-6.17/wifi-mac80211-fix-he-capabilities-element-check.patch
 create mode 100644 queue-6.17/wifi-mac80211-get-the-correct-interface-for-non-netd.patch
 create mode 100644 queue-6.17/wifi-mac80211-track-nan-interface-start-stop.patch
 create mode 100644 queue-6.17/wifi-mt76-improve-phy-reset-on-hw-restart.patch
 create mode 100644 queue-6.17/wifi-mt76-mt76_eeprom_override-to-int.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7925-add-pci-restore-for-hibernate.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-disable-promiscuous-mode-by-default.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-fix-mt7996_reverse_frag0_hdr_trans-.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-set-def_wcid-pointer-in-mt7996_mac_.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-support-writing-mac-txd-for-addba-r.patch
 create mode 100644 queue-6.17/wifi-mt76-mt7996-temporarily-disable-epcs.patch
 create mode 100644 queue-6.17/wifi-mt76-use-altx-queue-for-offchannel-tx-on-connac.patch
 create mode 100644 queue-6.17/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
 create mode 100644 queue-6.17/wifi-rtw89-8851b-rfk-update-iqk-tia-setting.patch
 create mode 100644 queue-6.17/wifi-rtw89-add-dummy-c2h-handlers-for-bcn-resend-and.patch
 create mode 100644 queue-6.17/wifi-rtw89-add-usb-id-2001-3327-for-d-link-ax18u-rev.patch
 create mode 100644 queue-6.17/wifi-rtw89-add-usb-id-2001-332a-for-d-link-ax9u-rev..patch
 create mode 100644 queue-6.17/wifi-rtw89-coex-limit-wi-fi-scan-slot-cost-to-avoid-.patch
 create mode 100644 queue-6.17/wifi-rtw89-disable-rtw89_physts_ie09_ftr_0-for-ppdu-.patch
 create mode 100644 queue-6.17/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
 create mode 100644 queue-6.17/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
 create mode 100644 queue-6.17/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
 create mode 100644 queue-6.17/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
 create mode 100644 queue-6.17/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
 create mode 100644 queue-6.17/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-6.17/x86-virt-tdx-use-precalculated-tdvpr-page-physical-a.patch
 create mode 100644 queue-6.17/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
 create mode 100644 queue-6.6/6pack-drop-redundant-locking-and-refcounting.patch
 create mode 100644 queue-6.6/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
 create mode 100644 queue-6.6/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
 create mode 100644 queue-6.6/accel-habanalabs-return-enomem-if-less-than-requeste.patch
 create mode 100644 queue-6.6/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
 create mode 100644 queue-6.6/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
 create mode 100644 queue-6.6/allow-finish_no_open-file-err_ptr-e.patch
 create mode 100644 queue-6.6/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
 create mode 100644 queue-6.6/alsa-serial-generic-remove-shared-static-buffer.patch
 create mode 100644 queue-6.6/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
 create mode 100644 queue-6.6/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
 create mode 100644 queue-6.6/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
 create mode 100644 queue-6.6/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
 create mode 100644 queue-6.6/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
 create mode 100644 queue-6.6/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
 create mode 100644 queue-6.6/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
 create mode 100644 queue-6.6/bluetooth-bcsp-receive-data-only-if-registered.patch
 create mode 100644 queue-6.6/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
 create mode 100644 queue-6.6/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
 create mode 100644 queue-6.6/bridge-redirect-to-backup-port-when-port-is-administ.patch
 create mode 100644 queue-6.6/char-misc-does-not-request-module-for-miscdevice-wit.patch
 create mode 100644 queue-6.6/char-misc-make-misc_register-reentry-for-miscdevice-.patch
 create mode 100644 queue-6.6/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
 create mode 100644 queue-6.6/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
 create mode 100644 queue-6.6/crypto-caam-double-the-entropy-delay-interval-for-re.patch
 create mode 100644 queue-6.6/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
 create mode 100644 queue-6.6/crypto-sun8i-ce-remove-channel-timeout-field.patch
 create mode 100644 queue-6.6/dmaengine-dw-edma-set-status-for-callback_result.patch
 create mode 100644 queue-6.6/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
 create mode 100644 queue-6.6/dmaengine-sh-setup_xref-error-handling.patch
 create mode 100644 queue-6.6/drm-amd-add-more-cyan-skillfish-pci-ids.patch
 create mode 100644 queue-6.6/drm-amd-avoid-evicting-resources-at-s5.patch
 create mode 100644 queue-6.6/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
 create mode 100644 queue-6.6/drm-amd-display-add-more-cyan-skillfish-devices.patch
 create mode 100644 queue-6.6/drm-amd-display-disable-vrr-on-dce-6.patch
 create mode 100644 queue-6.6/drm-amd-display-ensure-committing-streams-is-seamles.patch
 create mode 100644 queue-6.6/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
 create mode 100644 queue-6.6/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
 create mode 100644 queue-6.6/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
 create mode 100644 queue-6.6/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
 create mode 100644 queue-6.6/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
 create mode 100644 queue-6.6/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
 create mode 100644 queue-6.6/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
 create mode 100644 queue-6.6/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
 create mode 100644 queue-6.6/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
 create mode 100644 queue-6.6/drm-amdgpu-reject-gang-submissions-under-sriov.patch
 create mode 100644 queue-6.6/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
 create mode 100644 queue-6.6/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
 create mode 100644 queue-6.6/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
 create mode 100644 queue-6.6/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
 create mode 100644 queue-6.6/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
 create mode 100644 queue-6.6/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
 create mode 100644 queue-6.6/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
 create mode 100644 queue-6.6/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
 create mode 100644 queue-6.6/drm-bridge-display-connector-don-t-set-op_detect-for.patch
 create mode 100644 queue-6.6/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
 create mode 100644 queue-6.6/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
 create mode 100644 queue-6.6/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
 create mode 100644 queue-6.6/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
 create mode 100644 queue-6.6/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
 create mode 100644 queue-6.6/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
 create mode 100644 queue-6.6/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
 create mode 100644 queue-6.6/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
 create mode 100644 queue-6.6/exfat-limit-log-print-for-io-error.patch
 create mode 100644 queue-6.6/ext4-increase-io-priority-of-fastcommit.patch
 create mode 100644 queue-6.6/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
 create mode 100644 queue-6.6/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
 create mode 100644 queue-6.6/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
 create mode 100644 queue-6.6/ftrace-fix-softlockup-in-ftrace_module_enable.patch
 create mode 100644 queue-6.6/fuse-zero-initialize-inode-private-data.patch
 create mode 100644 queue-6.6/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
 create mode 100644 queue-6.6/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
 create mode 100644 queue-6.6/ice-don-t-use-pk-through-printk-or-tracepoints.patch
 create mode 100644 queue-6.6/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
 create mode 100644 queue-6.6/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
 create mode 100644 queue-6.6/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
 create mode 100644 queue-6.6/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
 create mode 100644 queue-6.6/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
 create mode 100644 queue-6.6/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
 create mode 100644 queue-6.6/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
 create mode 100644 queue-6.6/ipv6-np-rxpmtu-race-annotation.patch
 create mode 100644 queue-6.6/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
 create mode 100644 queue-6.6/jfs-verify-inode-mode-when-loading-from-disk.patch
 create mode 100644 queue-6.6/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
 create mode 100644 queue-6.6/media-adv7180-add-missing-lock-in-suspend-callback.patch
 create mode 100644 queue-6.6/media-adv7180-do-not-write-format-to-device-in-set_f.patch
 create mode 100644 queue-6.6/media-adv7180-only-validate-format-in-querystd.patch
 create mode 100644 queue-6.6/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
 create mode 100644 queue-6.6/media-fix-uninitialized-symbol-warnings.patch
 create mode 100644 queue-6.6/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
 create mode 100644 queue-6.6/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
 create mode 100644 queue-6.6/media-imon-make-send_packet-more-robust.patch
 create mode 100644 queue-6.6/media-ov08x40-fix-the-horizontal-flip-control.patch
 create mode 100644 queue-6.6/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
 create mode 100644 queue-6.6/media-redrat3-use-int-type-to-store-negative-error-c.patch
 create mode 100644 queue-6.6/media-verisilicon-explicitly-disable-selection-api-i.patch
 create mode 100644 queue-6.6/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
 create mode 100644 queue-6.6/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
 create mode 100644 queue-6.6/mips-lantiq-danube-add-model-to-easy50712-dts.patch
 create mode 100644 queue-6.6/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
 create mode 100644 queue-6.6/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
 create mode 100644 queue-6.6/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
 create mode 100644 queue-6.6/net-call-cond_resched-less-often-in-__release_sock.patch
 create mode 100644 queue-6.6/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
 create mode 100644 queue-6.6/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
 create mode 100644 queue-6.6/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
 create mode 100644 queue-6.6/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
 create mode 100644 queue-6.6/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
 create mode 100644 queue-6.6/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
 create mode 100644 queue-6.6/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
 create mode 100644 queue-6.6/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
 create mode 100644 queue-6.6/net-phy-clear-link-parameters-on-admin-link-down.patch
 create mode 100644 queue-6.6/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
 create mode 100644 queue-6.6/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
 create mode 100644 queue-6.6/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
 create mode 100644 queue-6.6/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
 create mode 100644 queue-6.6/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
 create mode 100644 queue-6.6/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
 create mode 100644 queue-6.6/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
 create mode 100644 queue-6.6/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
 create mode 100644 queue-6.6/nfsv4-handle-err_grace-on-delegation-recalls.patch
 create mode 100644 queue-6.6/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
 create mode 100644 queue-6.6/ntfs3-pretend-extend-records-as-regular-files.patch
 create mode 100644 queue-6.6/orangefs-fix-xattr-related-buffer-overflow.patch
 create mode 100644 queue-6.6/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
 create mode 100644 queue-6.6/page_pool-clamp-pool-size-to-max-16k-pages.patch
 create mode 100644 queue-6.6/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
 create mode 100644 queue-6.6/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
 create mode 100644 queue-6.6/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
 create mode 100644 queue-6.6/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
 create mode 100644 queue-6.6/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
 create mode 100644 queue-6.6/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
 create mode 100644 queue-6.6/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
 create mode 100644 queue-6.6/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
 create mode 100644 queue-6.6/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
 create mode 100644 queue-6.6/ptp-limit-time-setting-of-ptp-clocks.patch
 create mode 100644 queue-6.6/r8169-set-eee-speed-down-ratio-to-1.patch
 create mode 100644 queue-6.6/rdma-irdma-update-kconfig.patch
 create mode 100644 queue-6.6/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
 create mode 100644 queue-6.6/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
 create mode 100644 queue-6.6/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
 create mode 100644 queue-6.6/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
 create mode 100644 queue-6.6/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
 create mode 100644 queue-6.6/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
 create mode 100644 queue-6.6/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
 create mode 100644 queue-6.6/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
 create mode 100644 queue-6.6/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
 create mode 100644 queue-6.6/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
 create mode 100644 queue-6.6/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
 create mode 100644 queue-6.6/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
 create mode 100644 queue-6.6/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
 create mode 100644 queue-6.6/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
 create mode 100644 queue-6.6/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
 create mode 100644 queue-6.6/selftests-makefile-include-install_dep_targets-in-cl.patch
 create mode 100644 queue-6.6/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
 create mode 100644 queue-6.6/selftests-net-replace-non-standard-__wordsize-with-s.patch
 create mode 100644 queue-6.6/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
 create mode 100644 queue-6.6/selftests-replace-sleep-with-slowwait.patch
 create mode 100644 queue-6.6/selftests-traceroute-use-require_command.patch
 create mode 100644 queue-6.6/smb-client-transport-avoid-reconnects-triggered-by-p.patch
 create mode 100644 queue-6.6/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
 create mode 100644 queue-6.6/sparc-module-add-r_sparc_ua64-relocation-handling.patch
 create mode 100644 queue-6.6/sparc64-fix-prototypes-of-reads-bwl.patch
 create mode 100644 queue-6.6/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
 create mode 100644 queue-6.6/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
 create mode 100644 queue-6.6/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
 create mode 100644 queue-6.6/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
 create mode 100644 queue-6.6/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
 create mode 100644 queue-6.6/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
 create mode 100644 queue-6.6/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
 create mode 100644 queue-6.6/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
 create mode 100644 queue-6.6/vfio-return-enotty-for-unsupported-device-feature.patch
 create mode 100644 queue-6.6/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
 create mode 100644 queue-6.6/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
 create mode 100644 queue-6.6/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
 create mode 100644 queue-6.6/wifi-mac80211-fix-he-capabilities-element-check.patch
 create mode 100644 queue-6.6/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
 create mode 100644 queue-6.6/wifi-mt76-mt7996-temporarily-disable-epcs.patch
 create mode 100644 queue-6.6/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
 create mode 100644 queue-6.6/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
 create mode 100644 queue-6.6/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch

diff --git a/queue-5.10/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-5.10/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..bc4be64424
--- /dev/null
+++ b/queue-5.10/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From 7296d679fe51c9ad919eabecb6060db31433697c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 5a2081ee37f55..0f4770a48912d 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/allow-finish_no_open-file-err_ptr-e.patch b/queue-5.10/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..52d81775f7
--- /dev/null
+++ b/queue-5.10/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 33560ed39c6a8a6244d1393754614029c9e66298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 7bcc26b14cd79..f081f09e411ef 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -896,18 +896,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.10/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch b/queue-5.10/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
new file mode 100644
index 0000000000..41af88a851
--- /dev/null
+++ b/queue-5.10/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
@@ -0,0 +1,80 @@
+From bde05a90b13e2eca0dacb1c85c9c41ff7d4fc9f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 17:27:30 +0200
+Subject: ALSA: usb-audio: add mono main switch to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
+
+The 1824c does not have the A/B switch that the 1810c has,
+but instead it has a mono main switch that sums the two
+main output channels to mono.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 457e07f6fc7c8..e3056bc576d28 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
+ 
+ #define SC1810C_CTL_LINE_SW	0
+ #define SC1810C_CTL_MUTE_SW	1
++#define SC1824C_CTL_MONO_SW	2
+ #define SC1810C_CTL_AB_SW	3
+ #define SC1810C_CTL_48V_SW	4
+ 
+@@ -123,6 +124,7 @@ struct s1810c_state_packet {
+ #define SC1810C_STATE_48V_SW	58
+ #define SC1810C_STATE_LINE_SW	59
+ #define SC1810C_STATE_MUTE_SW	60
++#define SC1824C_STATE_MONO_SW	61
+ #define SC1810C_STATE_AB_SW	62
+ 
+ struct s1810_mixer_state {
+@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
+ 	.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
+ };
+ 
++static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
++	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++	.name = "Mono Main Out Switch",
++	.info = snd_ctl_boolean_mono_info,
++	.get = snd_s1810c_switch_get,
++	.put = snd_s1810c_switch_set,
++	.private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
++};
++
+ static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
+ 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ 	.name = "48V Phantom Power On Mic Inputs Switch",
+@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+-	if (ret < 0)
+-		return ret;
++	// The 1824c has a Mono Main switch instead of a
++	// A/B select switch.
++	if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
++		if (ret < 0)
++			return ret;
++	} else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.10/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-5.10/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..3d3ba2701e
--- /dev/null
+++ b/queue-5.10/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From bd1030b5d47103b14a356d13065dd105eb110642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-5.10/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-5.10/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..d8280530ad
--- /dev/null
+++ b/queue-5.10/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From c6c2e5825d06e5862ae86ab1cab01f8a06439214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 8826a588f5ab8..c84e25b2b1fb9 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1192,6 +1192,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-5.10/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..2b4bd85ede
--- /dev/null
+++ b/queue-5.10/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From 7d19caff6e598e83a33569f9bec6b6498b4c6c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 8055f63603f45..8ff69111ceede 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-5.10/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..a3880f4681
--- /dev/null
+++ b/queue-5.10/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From fb42ed7bc0d5a5bc724b1d757ef814321c3a88d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index ae788d3e0c53a..ce084a184a1cd 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -400,6 +400,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-5.10/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-5.10/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..cce8f3be8c
--- /dev/null
+++ b/queue-5.10/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From 219d3276afff592a901bc1a0b46e4efcf026c2d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index ada03d49e7c1a..4db9a51438790 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -142,7 +142,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-5.10/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-5.10/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..eb6417f141
--- /dev/null
+++ b/queue-5.10/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From 31ff9b19e7ae390fe73a974f8b0c553ad0faf8a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index f6a147427029a..cbe86a1f2244b 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		}
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 				break;
+ 			}
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-5.10/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-5.10/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..8ce0ca8a8f
--- /dev/null
+++ b/queue-5.10/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From d0cf654b3c198ad0d40e9c949e2ef12de74b97a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index f91dbf43a5980..df2874f6f4620 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -488,6 +488,25 @@ dw_edma_device_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t paddr,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -503,6 +522,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -541,6 +562,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.10/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-5.10/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..dc64cc4316
--- /dev/null
+++ b/queue-5.10/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From 6052c51aafb3e90c9551e3354e12f9f850f6ed52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 94a12f3267c14..8224d52d16901 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-5.10/dmaengine-sh-setup_xref-error-handling.patch b/queue-5.10/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..8579649210
--- /dev/null
+++ b/queue-5.10/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From 0c2a9792827b5e423828dbef2a5329d686dedd11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 7f72b3f4cd1ae..e1b8808f2a984 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 5aafe548ca5f3..2b9774ae7fd32 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-5.10/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..c36263327e
--- /dev/null
+++ b/queue-5.10/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From b93d860c9d87a3364d7217bfadf037b17db6824c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index 3a31058b029e3..729f6d60fac0a 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2276,7 +2276,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-5.10/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..618e4cfb0b
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From df00df18230ac0099977e47e93b19a92bed7a4eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 8996cb4ed57a8..1341a7f866cd2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 		fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-5.10/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..0bb793d33e
--- /dev/null
+++ b/queue-5.10/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 672d586bef38fa9c10996801e761d14f6eaf214b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 869c8786df5c9..04367ae4b425d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1887,8 +1887,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	unsigned int usize, asize;
+ 	int retcode = -EINVAL;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -1901,8 +1903,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-5.10/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..e8ea550b6b
--- /dev/null
+++ b/queue-5.10/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 15e12f94e0653f2973129dd6cfb7bd26ba76ca29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 057c48a9b53a7..af2ea008340cc 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -108,7 +108,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ /*
+  * 512 = 0x200
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-5.10/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..960e46a471
--- /dev/null
+++ b/queue-5.10/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From adc24f2d47f3baa0aa80ef63438676b4ecd4a18d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index 544a47335cac4..d34120eb5e674 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -229,7 +229,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-5.10/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..def79bd0f4
--- /dev/null
+++ b/queue-5.10/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From 32f5598457f38d6c52e14c0391ebd28c18ae7b1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-5.10/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-5.10/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..0235df8a17
--- /dev/null
+++ b/queue-5.10/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From bdde9144a8ca8d5d64cf518a8c796226e0d3843c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 26fd2761e80db..d39c865e126bd 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -226,7 +226,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index b1093dc1b79a2..14bf95d901ada 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -978,13 +978,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1026,8 +1026,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.10/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-5.10/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..af15635a36
--- /dev/null
+++ b/queue-5.10/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From 7c08ea3c0c70a63a7ddb53c69ba86d6e1865b2af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index 93d9df55b361a..01811924c4db4 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-5.10/exfat-limit-log-print-for-io-error.patch b/queue-5.10/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..9c0396aea8
--- /dev/null
+++ b/queue-5.10/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From 0b121835799ea992d0bf52cf6621bb22a50341d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index b6cce8225d058..38a7b129f731e 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -88,35 +88,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-5.10/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-5.10/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..44a9c4d291
--- /dev/null
+++ b/queue-5.10/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From 81ad3fadee7117fc135aa1ba1f175a97221c40e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 0317b614b6805..ea06cd4340525 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-5.10/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..d9d659ce88
--- /dev/null
+++ b/queue-5.10/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 91aea66203cfd657a87c801de2beca20398a309a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 203ffcc999400..fa8ce1c66d123 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1492,7 +1492,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-5.10/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-5.10/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..78d3658158
--- /dev/null
+++ b/queue-5.10/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From 427bc5ffa4c54d944b73e7eec09fc89653b37a82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index 1bc986a7009d2..4d4aff88aa6ce 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -148,8 +149,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&indio_dev->mlock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-5.10/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-5.10/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..0054355cfa
--- /dev/null
+++ b/queue-5.10/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From 02511ee0817e6acdcf3bd1ee9e31611e244487e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 1ba6adb5b9124..8ac0ac915efd3 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -697,11 +697,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -750,10 +755,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-5.10/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-5.10/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..e19d9b9227
--- /dev/null
+++ b/queue-5.10/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From e73ae1692a2ffdb2f6eeb25410958a51b13694bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index d38d15ccc7501..ced20abf4ef8e 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -6978,7 +6978,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		/* sentinel */
+-- 
+2.51.0
+
diff --git a/queue-5.10/ipv6-np-rxpmtu-race-annotation.patch b/queue-5.10/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..acc96167b4
--- /dev/null
+++ b/queue-5.10/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From e910279f6c3f21ef6ab9dd7c7819e197369cc641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 7ff06fa7ed19a..3308b9a4d5237 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, noblock, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index a23780434edd3..db04e753ed5a3 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -361,7 +361,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-5.10/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-5.10/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..8a14c19f8e
--- /dev/null
+++ b/queue-5.10/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From 0569c42bb7910c9d9c7ecca3406d7792e8d392f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 6f6a5b9203d3f..97a2eb0f0b75d 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-5.10/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-5.10/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..5594a0c1a5
--- /dev/null
+++ b/queue-5.10/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From d822ab31ba676e00cebc5ea95c26cea3be290b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 2472b33e3a2d8..01f55fac31cf3 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-5.10/media-fix-uninitialized-symbol-warnings.patch b/queue-5.10/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..aa916a427e
--- /dev/null
+++ b/queue-5.10/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 9119d9aa05b11453c2f5d5d54c2cbc545a7e7280 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index 56674173524fd..0c1c54b5a6f5e 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 849df4d1c573c..c8aa193e04e71 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-5.10/media-imon-make-send_packet-more-robust.patch b/queue-5.10/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..57196db2af
--- /dev/null
+++ b/queue-5.10/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 28ac1762ca8d3c258f87f5f1d53c06318b043098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 1de0fe3e58799..565826cff0db4 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1759,14 +1762,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1775,16 +1770,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1800,14 +1808,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1816,16 +1816,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-5.10/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..3b053b70a0
--- /dev/null
+++ b/queue-5.10/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From bc2cd2c15b6bdab95c5e4dd7056cfc875bdffb29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index 00caf60ff9890..7c3fc594cee56 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -324,6 +324,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -333,7 +334,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 4202c3a47d33e..7ed0d2d85253e 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-5.10/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..e7c5327c55
--- /dev/null
+++ b/queue-5.10/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From fd2584f47750843d3e3a6254fea1af76690746b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index a61f9820ade95..dc4e9b14baa9f 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-5.10/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-5.10/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..b1ee37eba6
--- /dev/null
+++ b/queue-5.10/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From e0df579f391cc001de0ebb90a98fa2230b91c35c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index ff6ff9568e1bc..1a5f4faa0831f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -105,6 +105,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-5.10/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-5.10/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..3b35ec8837
--- /dev/null
+++ b/queue-5.10/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From 22f7047f815ce6be932ede71b5b0344b839d173a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 510be63c8bdf1..ff6ff9568e1bc 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-5.10/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..74185e0c88
--- /dev/null
+++ b/queue-5.10/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From 87be1b768dc8c0bf2099a541873a367750657dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 084f6caba5f23..96a62b42e2971 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -463,7 +463,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-5.10/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..5b2691d13b
--- /dev/null
+++ b/queue-5.10/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From 69f5475bb5597a1aa3a3fcf286d4fddbf7f21dbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 37f2a79c23b23..6c93381cf0bdf 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2561,23 +2561,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-5.10/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..2ade3c8eec
--- /dev/null
+++ b/queue-5.10/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From 66e91397ef98d33602a8701d330e562fd6af1122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3108c999ccdbb..37f2a79c23b23 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2695,8 +2695,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 			return 1;
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-5.10/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..5927986021
--- /dev/null
+++ b/queue-5.10/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From 9ecb773cb144f6bd3d9d0b6d80afefeac9b120aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-5.10/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..9921aca550
--- /dev/null
+++ b/queue-5.10/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From eeacde886439bb51bf4bd07f76db1006eca1a3e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index c0780c3624c82..7e0e790f38b70 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index dc8ccd378ec92..6a3aebd56e6c4 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-5.10/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..d2ff957efc
--- /dev/null
+++ b/queue-5.10/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From 562f7b50356026c2e4d65e312d639fd31a0524be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 080ee7f44c649..4bc6767c7e139 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-5.10/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..a4d0441ff1
--- /dev/null
+++ b/queue-5.10/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From 912010a007355dead933234c9b85d64b6d86a7ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 2a103be1c9d8a..c407e8d0eb618 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -276,9 +276,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	/* Clear unused address register sets */
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-5.10/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..1afc11f988
--- /dev/null
+++ b/queue-5.10/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From abe9b86c2987a0534a82789499d031e92b40d7fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index 004e49f748419..beea7e014b157 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-5.10/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..4cb2cb9b9b
--- /dev/null
+++ b/queue-5.10/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From a77b647ee58a202fabaaab83c4a091bb80a3cb06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 54786712a9913..6504aa0f1889d 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1596,6 +1596,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -2845,7 +2882,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.did_interrupt = m88e1121_did_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-5.10/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..0b6a2424cd
--- /dev/null
+++ b/queue-5.10/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From d68a903b5b9db84e3aa0f5c25f105cf8606e0df0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index e2019dc3ac563..88ba7972ce635 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-5.10/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..b327b76466
--- /dev/null
+++ b/queue-5.10/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From 514f3cffa28e18c8983889956b887284df54131d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index e6fa2782d28f2..ac278d81f1614 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5415,7 +5415,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	stmmac_set_rx_mode(ndev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-5.10/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..226b4c10dc
--- /dev/null
+++ b/queue-5.10/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From f371499810c89b8ccd972179671a731c5c0e48d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index 477d6a6f0de36..75e1c8d3bd835 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -843,6 +843,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-5.10/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..028cb7de61
--- /dev/null
+++ b/queue-5.10/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From f20d7bbe119cbb727bc6a235667bfb46516745db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c454fb042ab2b..12f5c240a2689 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -365,7 +365,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-5.10/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-5.10/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..96017b40a6
--- /dev/null
+++ b/queue-5.10/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From 51ac6fffe6ec35c024548c2b30cf3dd400c2a953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 87774f3b4c354..c454fb042ab2b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7473,10 +7473,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-5.10/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..74e2da883d
--- /dev/null
+++ b/queue-5.10/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From 2f0e289c80f803414eb83328a5918f4b96a5e4f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e3cabced1aead..171bc21eb945b 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2724,6 +2724,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-5.10/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-5.10/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..01300ba11d
--- /dev/null
+++ b/queue-5.10/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From 00c5eb0265bed91ac391d7e0062b5344dfb912cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index bdc285aea3600..5e355d9d9a819 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-5.10/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..46bc35d815
--- /dev/null
+++ b/queue-5.10/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 9694eda37b7e5f5f11db5ecd8c3edb69966108ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index a11809b3149b4..15ad99330bb9b 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -33,11 +33,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-5.10/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-5.10/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..409ce0578a
--- /dev/null
+++ b/queue-5.10/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From c6da75c24f6f1bf6434d449fdb233e718f495d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index c29176bdecd19..28e1497a4fc40 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -444,7 +444,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 52767f26048fd..7b4d403569ecd 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 3139ea9f02c89..f01f683d1cb95 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -471,7 +471,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -479,13 +479,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-5.10/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-5.10/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..cafa35bd34
--- /dev/null
+++ b/queue-5.10/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 0809a5f48955f6c46d48b844d6e0da7690eba7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7d9f048ed18f8..ac355ae17bfee 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2554,6 +2554,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-5.10/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-5.10/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..87175a8841
--- /dev/null
+++ b/queue-5.10/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From d180cbb54798af29a2846e9e14fe622c3d3d295b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index f07c5dbc94e10..6c9dca2dd57e7 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -215,7 +215,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-5.10/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-5.10/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..30e70285b8
--- /dev/null
+++ b/queue-5.10/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 702a286d03ae843bb1b9639d106c4d5a96a72107 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index 90c4e9b5aac83..04cee5a00a5b4 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-5.10/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-5.10/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..5dfbce8311
--- /dev/null
+++ b/queue-5.10/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From 9fedc7db95f1388ac3156d5b7754f4230a616aee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index ed5be1bff60ca..2f13d906e1fcb 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -335,7 +335,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-5.10/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..a89be70ef0
--- /dev/null
+++ b/queue-5.10/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From 7c3d8ff69fc11d2587c64ef24310a2258e30d75b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 9fb8fdd5b2619..fc3e42c1ee0d9 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3278,7 +3278,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3433,7 +3433,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3628,7 +3628,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
+-- 
+2.51.0
+
diff --git a/queue-5.10/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-5.10/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..d0272a533d
--- /dev/null
+++ b/queue-5.10/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 2899357dae697e500bf1baa42d7a4aa9d11ff258 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index d35d1fc398076..1257867e85e4e 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-5.10/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-5.10/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..50b190475f
--- /dev/null
+++ b/queue-5.10/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From 0299e8ec3d2685f79c58b06ded420ddb56c77fdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index f2080738ca05e..82e28eb4d477d 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -123,6 +123,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-5.10/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..93dc05f9f7
--- /dev/null
+++ b/queue-5.10/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From 19abf78bdc0d9ee0ce377a78509876cf4ef7efd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 7ab6d3b086982..cb14a62bffb28 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-5.10/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-5.10/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..f79b9fe14a
--- /dev/null
+++ b/queue-5.10/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From 43752f404a12a91bca7e3f9183ae5efb49653234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 9c117e4e7f5bb..d5d5965fa7a0e 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -683,7 +683,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-5.10/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-5.10/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..bdcbd9709d
--- /dev/null
+++ b/queue-5.10/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From b7956cf31037b36fbf98b637aee3da3e3d01659f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 12035baf0997b..9c117e4e7f5bb 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 45bffa49f8766..8fe26597bf905 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -505,6 +505,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 74099d82e4364..c0aba3493d470 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -540,6 +540,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-5.10/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..649dfbf0cd
--- /dev/null
+++ b/queue-5.10/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From 439b2cd847a03ada27e5cd81df123275ab6c5133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index acffe0029fdd1..806c409de124e 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -400,6 +400,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-5.10/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..b226fddd24
--- /dev/null
+++ b/queue-5.10/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 40a2571c51951f0119670e8b91471ea16bad5089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index db1e24d7155fa..1d33d2d298dfc 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -257,7 +257,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-5.10/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..2ffc865a32
--- /dev/null
+++ b/queue-5.10/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From 2ef23f9d784e0f3c5728859b2327eaa2ca5448e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-5.10/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..89c999cb83
--- /dev/null
+++ b/queue-5.10/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From 78c4169aa2082e7127b66932953797a82e57d630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-replace-sleep-with-slowwait.patch b/queue-5.10/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..89e642d4cd
--- /dev/null
+++ b/queue-5.10/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From cda087f21fc4e00888dc558b2716a0409c22e944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 806c409de124e..2f5cdbc5dee39 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -183,7 +183,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ do_run_cmd()
+-- 
+2.51.0
+
diff --git a/queue-5.10/selftests-traceroute-use-require_command.patch b/queue-5.10/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..df32bd21f0
--- /dev/null
+++ b/queue-5.10/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From d555d4014919a787ec9a779a25fa15de928e7a6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index de9ca97abc306..9cb5e96e64333 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -209,11 +209,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -278,11 +273,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -316,6 +306,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-5.10/series b/queue-5.10/series
index fc5e0b497f..7d299a719c 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -63,3 +63,82 @@ mfd-stmpe-remove-irq-domain-upon-removal.patch
 mfd-stmpe-i2c-add-missing-module_license.patch
 mfd-madera-work-around-false-positive-wininitialized.patch
 mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+media-fix-uninitialized-symbol-warnings.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-traceroute-use-require_command.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+selftests-replace-sleep-with-slowwait.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+ipv6-np-rxpmtu-race-annotation.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
+exfat-limit-log-print-for-io-error.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-5.10/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-5.10/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..fff5d4783c
--- /dev/null
+++ b/queue-5.10/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From fd6bea87fe448a14f15f5ac7844e74effa16a1ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 7e078bc73ef56..d3dda47d0bc5a 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -59,6 +59,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index df39580f398d3..737f7a5c28359 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-5.10/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-5.10/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..35c8be8497
--- /dev/null
+++ b/queue-5.10/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 5027c45d72ed9b478df7fd812826c6e784766e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index bc3a043a5d5c7..72b0210cdead7 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-5.10/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-5.10/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..0068b05fb4
--- /dev/null
+++ b/queue-5.10/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From e41c80a8dfb86814637c986439fd225a007ce750 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 47b70bcc9dc29..e6c7844b8d1c2 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1993,7 +1993,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2017,6 +2022,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-5.10/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-5.10/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..7b1615b91c
--- /dev/null
+++ b/queue-5.10/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From 5a5d1195dd8ff44b2a1671bb760b842a572668e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 2f30699f0426f..c285b23c3707c 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-5.10/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-5.10/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..29fc205688
--- /dev/null
+++ b/queue-5.10/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From 11027dddfdd0e94f9ac77bf5d2e1478660896458 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 752951b56ad3f..ea5f2cf330206 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us)) {
+@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-5.10/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-5.10/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..3b330343d9
--- /dev/null
+++ b/queue-5.10/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From 68a963e81ad18ed428fd32b8c0ec4c3b69162fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index 35483217b1f6c..93998d328d9aa 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-5.10/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-5.10/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..1812b6e991
--- /dev/null
+++ b/queue-5.10/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From 6429184a3148dda58852e3e4ccb4dd012f0f5d61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index daf93bee7669b..c6ef7863c3e97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -242,6 +242,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.10/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-5.10/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..38d37dbd98
--- /dev/null
+++ b/queue-5.10/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From 65165f9b75b07350ceb2a63225c6f16ba251b388 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 5dd0239e9d51b..3a708b3c9d4ec 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -13,6 +13,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -275,8 +276,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-5.10/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-5.10/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..0943fd3191
--- /dev/null
+++ b/queue-5.10/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From ba39c4171a1ef2d197657e3754fef34b5d68b980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index fe9babe94861f..d7d2eb79120d6 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -964,16 +964,6 @@ ASM_RET
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -993,6 +983,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-5.10/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-5.10/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..45353e0d66
--- /dev/null
+++ b/queue-5.10/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 2978682de59085c5d99472f620e5a2f92c468489 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index f0b817eb6e8ba..3e60a355dd5ad 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-5.15/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-5.15/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..fcc0ebf7dc
--- /dev/null
+++ b/queue-5.15/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From 606392f793e518c2f0f8f06b681e23501d3983f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 9aa7a24777e95..f97286c6cb176 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/allow-finish_no_open-file-err_ptr-e.patch b/queue-5.15/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..de7153d2d3
--- /dev/null
+++ b/queue-5.15/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From eba0135d06449b1f3fb738ddddc59d4a3dc2f2f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 84e5dcc31c0e4..bdfe88fab1f1c 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -921,18 +921,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch b/queue-5.15/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
new file mode 100644
index 0000000000..f6354100d1
--- /dev/null
+++ b/queue-5.15/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
@@ -0,0 +1,39 @@
+From 915524df52287d1bfbd2a205b42127c9f264c854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 14:13:27 +0200
+Subject: ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c ]
+
+snd_seq_fifo_poll_wait() evaluates f->cells without locking after
+poll_wait(), and KCSAN doesn't like it as it appears to be a
+data-race.  Although this doesn't matter much in practice as the value
+is volatile, it's still better to address it for the mind piece.
+
+Wrap it with f->lock spinlock for avoiding the potential data race.
+
+Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_fifo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index f8e02e98709ab..faf288fecf26d 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -218,6 +218,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file,
+ 			   poll_table *wait)
+ {
+ 	poll_wait(file, &f->input_sleep, wait);
++	guard(spinlock_irq)(&f->lock);
+ 	return (f->cells > 0);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch b/queue-5.15/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
new file mode 100644
index 0000000000..9c3dcfdf71
--- /dev/null
+++ b/queue-5.15/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
@@ -0,0 +1,80 @@
+From 328255ee005748463eb76f242fc641b503d3189f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 17:27:30 +0200
+Subject: ALSA: usb-audio: add mono main switch to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
+
+The 1824c does not have the A/B switch that the 1810c has,
+but instead it has a mono main switch that sums the two
+main output channels to mono.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 38e56ad857243..881cc5998bf91 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
+ 
+ #define SC1810C_CTL_LINE_SW	0
+ #define SC1810C_CTL_MUTE_SW	1
++#define SC1824C_CTL_MONO_SW	2
+ #define SC1810C_CTL_AB_SW	3
+ #define SC1810C_CTL_48V_SW	4
+ 
+@@ -123,6 +124,7 @@ struct s1810c_state_packet {
+ #define SC1810C_STATE_48V_SW	58
+ #define SC1810C_STATE_LINE_SW	59
+ #define SC1810C_STATE_MUTE_SW	60
++#define SC1824C_STATE_MONO_SW	61
+ #define SC1810C_STATE_AB_SW	62
+ 
+ struct s1810_mixer_state {
+@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
+ 	.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
+ };
+ 
++static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
++	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++	.name = "Mono Main Out Switch",
++	.info = snd_ctl_boolean_mono_info,
++	.get = snd_s1810c_switch_get,
++	.put = snd_s1810c_switch_set,
++	.private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
++};
++
+ static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
+ 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ 	.name = "48V Phantom Power On Mic Inputs Switch",
+@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+-	if (ret < 0)
+-		return ret;
++	// The 1824c has a Mono Main switch instead of a
++	// A/B select switch.
++	if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
++		if (ret < 0)
++			return ret;
++	} else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-5.15/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..bd01befa7c
--- /dev/null
+++ b/queue-5.15/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From 6c6093ef1ff443cb0bbbd2fc2294dda7c522bec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-5.15/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-5.15/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..74d2feebed
--- /dev/null
+++ b/queue-5.15/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From ec858ad119f6b6ed74ede3c1a20d1d36f8799fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 8055f63603f45..8ff69111ceede 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-5.15/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..0323e424fc
--- /dev/null
+++ b/queue-5.15/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From d13cf855c32b9d8bd767917d8029afc88bfd0408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 83412efe28953..d98648bcc1a85 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -406,6 +406,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-5.15/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-5.15/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..cd13c1b5ca
--- /dev/null
+++ b/queue-5.15/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From 395ed3086a7d2746f01d617057f174e8446ef045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index 1b66c276118a3..aec5ab772a69d 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-5.15/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-5.15/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..ccb49f6d3c
--- /dev/null
+++ b/queue-5.15/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From 17223e4e6d76226915121983fff8067e984ae86f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index ca5141ed5ef34..90929fb2b56e3 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		}
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 				break;
+ 			}
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-5.15/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-5.15/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..d298a7f276
--- /dev/null
+++ b/queue-5.15/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From 6b2142fda16ecea17055b2084638c396406ae3c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 799ebbaf35be5..f01b6c4bd315f 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -546,6 +546,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -561,6 +580,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -599,6 +620,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.15/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-5.15/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..ea04d267f8
--- /dev/null
+++ b/queue-5.15/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From b773dc7d523b7c69ed53ab54c5b7461d8892fa76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index ca0ba1d462832..8b215cbca1186 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-5.15/dmaengine-sh-setup_xref-error-handling.patch b/queue-5.15/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..5874ab36c5
--- /dev/null
+++ b/queue-5.15/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From 644bd8e08ab9db4778331639e3b403bf5bd0e1d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 7f72b3f4cd1ae..e1b8808f2a984 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 5aafe548ca5f3..2b9774ae7fd32 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amd-add-more-cyan-skillfish-pci-ids.patch b/queue-5.15/drm-amd-add-more-cyan-skillfish-pci-ids.patch
new file mode 100644
index 0000000000..1f18eb6269
--- /dev/null
+++ b/queue-5.15/drm-amd-add-more-cyan-skillfish-pci-ids.patch
@@ -0,0 +1,36 @@
+From c318c4535d0a2fc50ebad608f85c2ba6336372ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:09:06 -0400
+Subject: drm/amd: add more cyan skillfish PCI ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
+
+Add additional PCI IDs to the cyan skillfish family.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index adcf3adc5ca51..7abcb5db9ae26 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1942,6 +1942,11 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
+ 
+ 	/* CYAN_SKILLFISH */
++	{0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 
+ 	/* BEIGE_GOBY */
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch b/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
new file mode 100644
index 0000000000..ea78bfe8a8
--- /dev/null
+++ b/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
@@ -0,0 +1,37 @@
+From f17d613ee75e6bd2d94f62edaddd3d9b98dd0703 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:15:45 +0530
+Subject: drm/amd/pm: Use cached metrics data on aldebaran
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
+
+Cached metrics data validity is 1ms on aldebaran. It's not reasonable
+for any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index d3389fb374c9b..94dfbdc2ea910 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1696,7 +1696,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..28684dfdd1
--- /dev/null
+++ b/queue-5.15/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From 551c3e99485d3b214e123db02179ba22945a16fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index a6df00aa5767a..da032700cb985 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2346,7 +2346,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-5.15/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..cd13a9b0e6
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From 7edd5c78fcbadd0ffd88a4dcc1493ba0a6a23128 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 9342aa23ebd26..902523af9865a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -85,10 +85,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 		fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch b/queue-5.15/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
new file mode 100644
index 0000000000..51c38de48b
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
@@ -0,0 +1,64 @@
+From bc5cf3e87c2dd8ecaf139ff36b10671cfff777b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 11:44:27 +0100
+Subject: drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
+
+Replace kmalloc_array() + copy_from_user() with memdup_array_user().
+
+This shrinks the source code and improves separation between the kernel
+and userspace slabs.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index f293d0dfec613..98c842cf03e4a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1625,30 +1625,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
+ {
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	union drm_amdgpu_wait_fences *wait = data;
+-	uint32_t fence_count = wait->in.fence_count;
+-	struct drm_amdgpu_fence *fences_user;
+ 	struct drm_amdgpu_fence *fences;
+ 	int r;
+ 
+ 	/* Get the fences from userspace */
+-	fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
+-			GFP_KERNEL);
+-	if (fences == NULL)
+-		return -ENOMEM;
+-
+-	fences_user = u64_to_user_ptr(wait->in.fences);
+-	if (copy_from_user(fences, fences_user,
+-		sizeof(struct drm_amdgpu_fence) * fence_count)) {
+-		r = -EFAULT;
+-		goto err_free_fences;
+-	}
++	fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
++				   wait->in.fence_count,
++				   sizeof(struct drm_amdgpu_fence));
++	if (IS_ERR(fences))
++		return PTR_ERR(fences);
+ 
+ 	if (wait->in.wait_all)
+ 		r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
+ 	else
+ 		r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
+ 
+-err_free_fences:
+ 	kfree(fences);
+ 
+ 	return r;
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-5.15/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..70de9e96a6
--- /dev/null
+++ b/queue-5.15/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 87b70bdd1dbfee1b1ca34b913137d54f258b9c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 7b2111be3019a..4f60ba2db1811 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1947,8 +1947,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	unsigned int usize, asize;
+ 	int retcode = -EINVAL;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -1961,8 +1963,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-5.15/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..7aa13ebf23
--- /dev/null
+++ b/queue-5.15/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 7446bc6f1fc9262e3048ec1025cb4f077cd81135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 47ec820cae72b..2cf71155a7184 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -109,7 +109,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ /*
+  * 512 = 0x200
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-5.15/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..cf0a025f68
--- /dev/null
+++ b/queue-5.15/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From a288fc2affd6d966f5bf351dbbbc91dab64224b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index d24f5b90feabf..d8510d9239119 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -351,7 +351,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch b/queue-5.15/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
new file mode 100644
index 0000000000..05ecf3f948
--- /dev/null
+++ b/queue-5.15/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
@@ -0,0 +1,44 @@
+From 5d1601fef98ac37088017ed67a6e993c8f26baae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:44 +0200
+Subject: drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
+
+According to Hardware Programming Guide for DSI PHY, the retime buffer
+resync should be done after PLL clock users (byte_clk and intf_byte_clk)
+are enabled.  Downstream also does it as part of configuring the PLL.
+
+Driver was only turning off the resync FIFO buffer, but never bringing it
+on again.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657823/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 8cc1ef8199ac9..10d5b9cf98df5 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -399,6 +399,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+ 	if (pll_7nm->slave)
+ 		dsi_pll_enable_global_clk(pll_7nm->slave);
+ 
++	writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++	if (pll_7nm->slave)
++		writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++
+ error:
+ 	return rc;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch b/queue-5.15/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
new file mode 100644
index 0000000000..4019c17e89
--- /dev/null
+++ b/queue-5.15/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
@@ -0,0 +1,54 @@
+From 7ad70d6b23fb0aa77da89985fb728bb3fe7abbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:47 +0200
+Subject: drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
+
+Driver unconditionally saves current state on first init in
+dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
+divider registers.  The state is then restored during probe/enable via
+msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
+dsi_7nm_pll_restore_state().
+
+Restoring calls dsi_pll_7nm_vco_set_rate() with
+pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
+VCO and messes with clock hierarchy, by setting frequency to 0 to clock
+tree.  This makes anyway little sense - VCO rate was not saved, so
+should not be restored.
+
+If PLL was not configured configure it to minimum rate to avoid glitches
+and configuring entire in clock hierarchy to 0 Hz.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657827/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 10d5b9cf98df5..a5f51534e6e96 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -760,6 +760,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+ 
+ 	/* TODO: Remove this when we have proper display handover support */
+ 	msm_dsi_phy_pll_save_state(phy);
++	/*
++	 * Store also proper vco_current_rate, because its value will be used in
++	 * dsi_7nm_pll_restore_state().
++	 */
++	if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
++		pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch b/queue-5.15/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
new file mode 100644
index 0000000000..c9ee9df44b
--- /dev/null
+++ b/queue-5.15/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
@@ -0,0 +1,43 @@
+From 1d39dbf0fa6fb394db45f6a316a501eaa06e3b34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:06:34 +0200
+Subject: drm/msm: make sure to not queue up recovery more than once
+
+From: Antonino Maniscalco <antomani103@gmail.com>
+
+[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
+
+If two fault IRQs arrive in short succession recovery work will be
+queued up twice.
+
+When recovery runs a second time it may end up killing an unrelated
+context.
+
+Prevent this by masking off interrupts when triggering recovery.
+
+Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670023/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 1c38c3acacbeb..95c31009bbec1 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1386,6 +1386,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+ 	/* Turn off the hangcheck timer to keep it from bothering us */
+ 	del_timer(&gpu->hangcheck_timer);
+ 
++	/* Turn off interrupts to avoid triggering recovery again */
++	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
++
+ 	kthread_queue_work(gpu->worker, &gpu->recover_work);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-5.15/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..002f996d3e
--- /dev/null
+++ b/queue-5.15/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From a0c39ac839a54eb24f6c13e80eaf273c0a6d5b33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch b/queue-5.15/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
new file mode 100644
index 0000000000..1fea518c2b
--- /dev/null
+++ b/queue-5.15/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
@@ -0,0 +1,48 @@
+From 0cc147f656acf0641c921906466f8443b8727028 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:34:02 +0530
+Subject: drm/tidss: Set crtc modesetting parameters with adjusted mode
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
+
+TIDSS uses crtc_* fields to propagate its registers and set the
+clock rates. So set the CRTC modesetting timing parameters with
+the adjusted mode when needed, to set correct values.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 3de103c673576..123060f682e68 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -94,7 +94,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 	struct dispc_device *dispc = tidss->dispc;
+ 	struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
+ 	u32 hw_videoport = tcrtc->hw_videoport;
+-	const struct drm_display_mode *mode;
++	struct drm_display_mode *mode;
+ 	enum drm_mode_status ok;
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+@@ -111,6 +111,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 		return -EINVAL;
+ 	}
+ 
++	if (drm_atomic_crtc_needs_modeset(crtc_state))
++		drm_mode_set_crtcinfo(mode, 0);
++
+ 	return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-5.15/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..c3ecbe7bc2
--- /dev/null
+++ b/queue-5.15/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From 9052cf35d89f49b06066468a5d17e820829282d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 812be02c16efc..3de103c673576 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -232,7 +232,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index ad559f5c11482..7f0f4b5abdecc 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -978,13 +978,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1026,8 +1026,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-5.15/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..954f6b0cff
--- /dev/null
+++ b/queue-5.15/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From 19b0f648a28600c4d251fce8673ee1e55f1c55e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index 93d9df55b361a..01811924c4db4 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-5.15/exfat-limit-log-print-for-io-error.patch b/queue-5.15/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..217495274d
--- /dev/null
+++ b/queue-5.15/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From 9817ceeda6cb335ff96612785de8ab0d20d3b863 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index c5f6015a947ce..4a6af08410a3d 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -88,35 +88,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-5.15/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-5.15/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..2e2fe8fa8a
--- /dev/null
+++ b/queue-5.15/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From 8ba1b6388aa68980489277412744013f1c88605d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 0317b614b6805..ea06cd4340525 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-5.15/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..55cd7333b0
--- /dev/null
+++ b/queue-5.15/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 17d7bc5b882cc3149bd7eea519f47a30b6fcfc9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 115c6ddccd7c4..b1529988e9def 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1499,7 +1499,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-5.15/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-5.15/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..841dcf28cd
--- /dev/null
+++ b/queue-5.15/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From 8bda882fa5547226e3b55a7b0bd574ca987822bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index d93e580b3dc5b..8fda16dd012f7 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&st->lock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-5.15/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-5.15/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..e3e5434ab9
--- /dev/null
+++ b/queue-5.15/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From 0071f98cff762cc1555c8c3428803573a98cbd17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 065d626d59050..9549fbffa66d0 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -696,11 +696,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -749,10 +754,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-5.15/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch b/queue-5.15/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
new file mode 100644
index 0000000000..1ed1e35b1b
--- /dev/null
+++ b/queue-5.15/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
@@ -0,0 +1,131 @@
+From 5cf46cd2650eb7e7a4641fea58dcb45dd878064d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:58 +0800
+Subject: iommu/vt-d: Replace snprintf with scnprintf in
+ dmar_latency_snapshot()
+
+From: Seyediman Seyedarab <ImanDevel@gmail.com>
+
+[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
+
+snprintf() returns the number of bytes that would have been written, not
+the number actually written. Using this for offset tracking can cause
+buffer overruns if truncation occurs.
+
+Replace snprintf() with scnprintf() to ensure the offset stays within
+bounds.
+
+Since scnprintf() never returns a negative value, and zero is not possible
+in this context because 'bytes' starts at 0 and 'size - bytes' is
+DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
+string literals used, the return value is always positive. An integer
+overflow is also completely out of reach here due to the small and fixed
+buffer size. The error check in latency_show_one() is therefore
+unnecessary. Remove it and make dmar_latency_snapshot() return void.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 10 ++--------
+ drivers/iommu/intel/perf.c    | 10 ++++------
+ drivers/iommu/intel/perf.h    |  5 ++---
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index 62e23ff3c987e..06c3376d8feb9 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -545,17 +545,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
+ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
+ 			     struct dmar_drhd_unit *drhd)
+ {
+-	int ret;
+-
+ 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
+ 		   iommu->name, drhd->reg_base_addr);
+ 
+-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+-	if (ret < 0)
+-		seq_puts(m, "Failed to get latency snapshot");
+-	else
+-		seq_puts(m, debug_buf);
+-	seq_puts(m, "\n");
++	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
++	seq_printf(m, "%s\n", debug_buf);
+ }
+ 
+ static int latency_show(struct seq_file *m, void *v)
+diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
+index 0e8e03252d921..700eeb07bda0a 100644
+--- a/drivers/iommu/intel/perf.c
++++ b/drivers/iommu/intel/perf.c
+@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
+ 	"     svm_prq"
+ };
+ 
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+ 	struct latency_statistic *lstat = iommu->perf_statistic;
+ 	unsigned long flags;
+@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 	memset(str, 0, size);
+ 
+ 	for (i = 0; i < COUNTS_NUM; i++)
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "%s", latency_counter_names[i]);
+ 
+ 	spin_lock_irqsave(&latency_lock, flags);
+@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 		if (!dmar_latency_enabled(iommu, i))
+ 			continue;
+ 
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "\n%s", latency_type_names[i]);
+ 
+ 		for (j = 0; j < COUNTS_NUM; j++) {
+@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 				break;
+ 			}
+ 
+-			bytes += snprintf(str + bytes, size - bytes,
++			bytes += scnprintf(str + bytes, size - bytes,
+ 					  "%12lld", val);
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&latency_lock, flags);
+-
+-	return bytes;
+ }
+diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
+index fd6db8049d1a7..1e481e9e4ad04 100644
+--- a/drivers/iommu/intel/perf.h
++++ b/drivers/iommu/intel/perf.h
+@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
+ bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
+ void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
+ 			 u64 latency);
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+ #else
+ static inline int
+ dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
+@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
+ {
+ }
+ 
+-static inline int
++static inline void
+ dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+-	return 0;
+ }
+ #endif /* CONFIG_DMAR_PERF */
+-- 
+2.51.0
+
diff --git a/queue-5.15/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-5.15/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..1713fe60a8
--- /dev/null
+++ b/queue-5.15/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From b3afa39fda129fc916589ea7c0b60555103327c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 43df9ad96e39d..68038aa522db0 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -7041,7 +7041,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		.procname	= "ioam6_enabled",
+-- 
+2.51.0
+
diff --git a/queue-5.15/ipv6-np-rxpmtu-race-annotation.patch b/queue-5.15/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..0653d54233
--- /dev/null
+++ b/queue-5.15/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From c3b358ea69d2142066cfa48abb2bb19b4e8e12e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 6ff25c3e9d5a4..586e972cbcd53 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, noblock, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index f05c09f7165a4..21f34a3a4e8ec 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -361,7 +361,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-5.15/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-5.15/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..5eb6bb6bc1
--- /dev/null
+++ b/queue-5.15/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From 35cb3fc5a52c113a78271716f09a6a87ce7e4115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 3a547e0b934f2..d322a22477e49 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-5.15/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-5.15/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..4064c53da0
--- /dev/null
+++ b/queue-5.15/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From 93dce81f465045f5573c7beb7ec1531af1b3bf90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index e132dafa1b6ca..6d6425cdb1185 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-adv7180-add-missing-lock-in-suspend-callback.patch b/queue-5.15/media-adv7180-add-missing-lock-in-suspend-callback.patch
new file mode 100644
index 0000000000..cb4c15099c
--- /dev/null
+++ b/queue-5.15/media-adv7180-add-missing-lock-in-suspend-callback.patch
@@ -0,0 +1,57 @@
+From 3679e26f2f5a27a35f9a46abf0cffb8ae3ca2324 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:45 +0200
+Subject: media: adv7180: Add missing lock in suspend callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
+
+The adv7180_set_power() utilizes adv7180_write() which in turn requires
+the state mutex to be held, take it before calling adv7180_set_power()
+to avoid tripping a lockdep_assert_held().
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index d9a99fcfacb17..7aefe72df9605 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -752,6 +752,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		if (state->field != format->format.field) {
++			guard(mutex)(&state->mutex);
++
+ 			state->field = format->format.field;
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+@@ -1511,6 +1513,8 @@ static int adv7180_suspend(struct device *dev)
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	guard(mutex)(&state->mutex);
++
+ 	return adv7180_set_power(state, false);
+ }
+ 
+@@ -1524,6 +1528,8 @@ static int adv7180_resume(struct device *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	guard(mutex)(&state->mutex);
++
+ 	ret = adv7180_set_power(state, state->powered);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-adv7180-do-not-write-format-to-device-in-set_f.patch b/queue-5.15/media-adv7180-do-not-write-format-to-device-in-set_f.patch
new file mode 100644
index 0000000000..0c5bdbfa0d
--- /dev/null
+++ b/queue-5.15/media-adv7180-do-not-write-format-to-device-in-set_f.patch
@@ -0,0 +1,50 @@
+From 37096e135d9b8b077326c40f6b89d9a0327547bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:52 +0200
+Subject: media: adv7180: Do not write format to device in set_fmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
+
+The .set_fmt callback should not write the new format directly do the
+device, it should only store it and have it applied by .s_stream.
+
+The .s_stream callback already calls adv7180_set_field_mode() so it's
+safe to remove programming of the device and just store the format and
+have .s_stream apply it.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 7aefe72df9605..bb36f32ac3008 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -751,14 +751,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 	ret = adv7180_mbus_fmt(sd,  &format->format);
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+-		if (state->field != format->format.field) {
+-			guard(mutex)(&state->mutex);
+-
+-			state->field = format->format.field;
+-			adv7180_set_power(state, false);
+-			adv7180_set_field_mode(state);
+-			adv7180_set_power(state, true);
+-		}
++		state->field = format->format.field;
+ 	} else {
+ 		framefmt = v4l2_subdev_get_try_format(sd, sd_state, 0);
+ 		*framefmt = format->format;
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-adv7180-only-validate-format-in-querystd.patch b/queue-5.15/media-adv7180-only-validate-format-in-querystd.patch
new file mode 100644
index 0000000000..058a0d5194
--- /dev/null
+++ b/queue-5.15/media-adv7180-only-validate-format-in-querystd.patch
@@ -0,0 +1,85 @@
+From be592bb6a2131d769207f313c59d0c44028146ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:54 +0200
+Subject: media: adv7180: Only validate format in querystd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
+
+The .querystd callback should not program the device with the detected
+standard, it should only report the standard to user-space. User-space
+may then use .s_std to set the standard, if it wants to use it.
+
+All that is required of .querystd is to setup the auto detection of
+standards and report its findings.
+
+While at it add some documentation on why this can't happen while
+streaming and improve the error handling using a scoped guard.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index bb36f32ac3008..332f83c66c4e6 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -351,32 +351,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
+ static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int err = mutex_lock_interruptible(&state->mutex);
+-	if (err)
+-		return err;
+-
+-	if (state->streaming) {
+-		err = -EBUSY;
+-		goto unlock;
+-	}
++	int ret;
+ 
+-	err = adv7180_set_video_standard(state,
+-			ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+-	if (err)
+-		goto unlock;
++	guard(mutex)(&state->mutex);
+ 
+-	msleep(100);
+-	__adv7180_status(state, NULL, std);
++	/*
++	 * We can't sample the standard if the device is streaming as that would
++	 * interfere with the capture session as the VID_SEL reg is touched.
++	 */
++	if (state->streaming)
++		return -EBUSY;
+ 
+-	err = v4l2_std_to_adv7180(state->curr_norm);
+-	if (err < 0)
+-		goto unlock;
++	/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
++	ret = adv7180_set_video_standard(state,
++					 ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
++	if (ret)
++		return ret;
+ 
+-	err = adv7180_set_video_standard(state, err);
++	/* Allow some time for the autodetection to run. */
++	msleep(100);
+ 
+-unlock:
+-	mutex_unlock(&state->mutex);
+-	return err;
++	return __adv7180_status(state, NULL, std);
+ }
+ 
+ static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-fix-uninitialized-symbol-warnings.patch b/queue-5.15/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..c983bd2505
--- /dev/null
+++ b/queue-5.15/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 4030762fbbc083247fa366ecf3843b6dd1facb8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index 56674173524fd..0c1c54b5a6f5e 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 849df4d1c573c..c8aa193e04e71 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-imon-make-send_packet-more-robust.patch b/queue-5.15/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..1f3204a93b
--- /dev/null
+++ b/queue-5.15/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From b73ed7fafdf5e814c7b3dd4b1207c27be9bc0b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 0257a4f293ecc..a70f449f35290 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1756,14 +1759,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1772,16 +1767,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1797,14 +1805,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1813,16 +1813,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-5.15/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..778c1abe2e
--- /dev/null
+++ b/queue-5.15/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From 8bad54a70ee23b44f4e905ae11238547084c1af8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index ce3a7ca51736e..df2dcef1af3f0 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -322,6 +322,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -331,7 +332,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 4202c3a47d33e..7ed0d2d85253e 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-5.15/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..d86c93269e
--- /dev/null
+++ b/queue-5.15/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From 6beddba58e40d372fe1df6988285da369572e135 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index cb22316b3f002..6d70b49b524e5 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-5.15/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-5.15/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..3f7e7a948d
--- /dev/null
+++ b/queue-5.15/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From 91b5ccedca90ab1386cb9f87d526c28e8fb9a8c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index ff6ff9568e1bc..1a5f4faa0831f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -105,6 +105,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-5.15/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-5.15/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..cdc44e9248
--- /dev/null
+++ b/queue-5.15/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From 7240d8ebc2ab9f97d8a0e6261d13a0a39cafa129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 510be63c8bdf1..ff6ff9568e1bc 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-5.15/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..ec76952346
--- /dev/null
+++ b/queue-5.15/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From 4c4709c95ed58b70ef0062775176e3f2b7643712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 084f6caba5f23..96a62b42e2971 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -463,7 +463,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-5.15/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..0c6c3a156a
--- /dev/null
+++ b/queue-5.15/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From a7f3bcec53046f46440206c5a1cb69507bbdda85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 645860eace46d..b4e605ac79c9f 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2716,23 +2716,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-5.15/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..e4e000f1a0
--- /dev/null
+++ b/queue-5.15/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From 2e37538239803416776d652dd65ddb9355afc7d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3569e1a5f1387..645860eace46d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2858,8 +2858,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 		}
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-5.15/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..a1ab19cc2d
--- /dev/null
+++ b/queue-5.15/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From c7fdebfb802b16ea61634531f910cb487f74cf0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-ethernet-microchip-sparx5-make-it-selectable-for.patch b/queue-5.15/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
new file mode 100644
index 0000000000..5e68ec2e6e
--- /dev/null
+++ b/queue-5.15/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
@@ -0,0 +1,37 @@
+From 52442ad4f2e0417ec263cfbf88beaac84aec76cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 13:00:24 +0200
+Subject: net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
+
+LAN969x switchdev support depends on the SparX-5 core,so make it selectable
+for ARCH_LAN969X.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index cc5e48e1bb4c3..a66a80e297f17 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -3,7 +3,7 @@ config SPARX5_SWITCH
+ 	depends on NET_SWITCHDEV
+ 	depends on HAS_IOMEM
+ 	depends on OF
+-	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
+ 	depends on PTP_1588_CLOCK_OPTIONAL
+ 	depends on BRIDGE || BRIDGE=n
+ 	select PHYLINK
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-5.15/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..083912b6c0
--- /dev/null
+++ b/queue-5.15/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From 1663d0862d566692bf5eed38e6111c15d9c518c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index af1b0cde36703..8fb99fa7ae600 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index dc8ccd378ec92..6a3aebd56e6c4 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-5.15/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..709085613f
--- /dev/null
+++ b/queue-5.15/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From 224dde52af819fd1d45c4331f0d198e074728347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 828e62514260a..589f008dcee9c 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-5.15/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..c3506ad044
--- /dev/null
+++ b/queue-5.15/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From d756201b7971d430cf2c717c1dff73acfcc407c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 2266a3ecc5533..d4a4d72460a42 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -280,9 +280,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	/* Clear unused address register sets */
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-5.15/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..238e2995d9
--- /dev/null
+++ b/queue-5.15/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From 2d4a82aa264eb960e5df6296bfb8f9cb8478c182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index ea8595651c384..e066bdbc807be 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-5.15/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..d84b57ff37
--- /dev/null
+++ b/queue-5.15/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From 2c28729923a3b69bb56e62bf577fb307669146b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 87975b843d276..4557bb2f68219 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1753,6 +1753,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -3134,7 +3171,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.handle_interrupt = marvell_handle_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-5.15/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..b085c4435b
--- /dev/null
+++ b/queue-5.15/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From 529bcbe8b3690bc4a1b0614145d425be240fc5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 183db093815cb..b6f11c0c3e009 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-5.15/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..9b13e1797f
--- /dev/null
+++ b/queue-5.15/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From f1d5f0ea14ce90b1ad4fb3dd2f5413f51fc1de69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 21cc8cd9e023a..973c60e013344 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7487,7 +7487,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	stmmac_set_rx_mode(ndev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-5.15/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..7787b3f6fd
--- /dev/null
+++ b/queue-5.15/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From a863e90d7bee6580007dbe39d40518acf70ef31d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index 4a8fdaae6bf21..9bd72526000c4 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -1811,6 +1811,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch b/queue-5.15/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
new file mode 100644
index 0000000000..bc837813aa
--- /dev/null
+++ b/queue-5.15/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
@@ -0,0 +1,129 @@
+From f837e50a57dfa3cf36a1fd825ee674391c0cf6ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:01:02 +0200
+Subject: netfilter: nf_reject: don't reply to icmp error messages
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
+
+tcp reject code won't reply to a tcp reset.
+
+But the icmp reject 'netdev' family versions will reply to icmp
+dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
+by the inet family implementation (and internally by the REJECT target).
+
+Check for the icmp(6) type and do not respond if its an unreachable error.
+
+Without this, something like 'ip protocol icmp reject', when used
+in a netdev chain attached to 'lo', cause a packet loop.
+
+Same for two hosts that both use such a rule: each error packet
+will be replied to.
+
+Such situation persist until the (bogus) rule is amended to ratelimit or
+checks the icmp type before the reject statement.
+
+As the inet versions don't do this make the netdev ones follow along.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
+ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index c1f5ca847c8a8..4d16d49b430e9 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+ 
++static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
++{
++	const struct iphdr *iph = ip_hdr(skb);
++	u8 *tp, _type;
++	int thoff;
++
++	if (iph->protocol != IPPROTO_ICMP)
++		return false;
++
++	thoff = skb_network_offset(skb) + sizeof(*iph);
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmphdr, type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMP_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -90,6 +111,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+ 		return NULL;
+ 
++	/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
++	if (nf_skb_is_icmp_unreach(oldskb))
++		return NULL;
++
+ 	/* RFC says return as much as we can without exceeding 576 bytes. */
+ 	len = min_t(unsigned int, 536, oldskb->len);
+ 
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index ca39b83c2a5d1..e209e8ca0c1cf 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+ 
++static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
++{
++	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
++	u8 proto = ip6h->nexthdr;
++	u8 _type, *tp;
++	int thoff;
++	__be16 fo;
++
++	thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
++
++	if (thoff < 0 || thoff >= skb->len || fo != 0)
++		return false;
++
++	if (proto != IPPROTO_ICMPV6)
++		return false;
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmp6hdr, icmp6_type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMPV6_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 	if (!nf_reject_ip6hdr_validate(oldskb))
+ 		return NULL;
+ 
++	/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
++	if (nf_skb_is_icmp6_unreach(oldskb))
++		return NULL;
++
+ 	/* Include "As much of invoking packet as possible without the ICMPv6
+ 	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-5.15/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-5.15/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..9d2b2fcd50
--- /dev/null
+++ b/queue-5.15/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From 98e50bb4e60bea17c8624c835f5b80d1fd315405 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 1c62c4314173e..5c29e2d383639 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -365,7 +365,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-5.15/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-5.15/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..a29cd6d4ce
--- /dev/null
+++ b/queue-5.15/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From 9c594578b699001fd09543385749de07569f10d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index a98b10c85b700..1c62c4314173e 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7613,10 +7613,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-5.15/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..08cc019a9f
--- /dev/null
+++ b/queue-5.15/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From a88ea9fb38699bc960b3d6a95e97bbf8df17ff40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index b1dec7a9bd723..d070378c47387 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2731,6 +2731,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-5.15/ntfs3-pretend-extend-records-as-regular-files.patch b/queue-5.15/ntfs3-pretend-extend-records-as-regular-files.patch
new file mode 100644
index 0000000000..80800e5c2e
--- /dev/null
+++ b/queue-5.15/ntfs3-pretend-extend-records-as-regular-files.patch
@@ -0,0 +1,37 @@
+From df81489bbeb7b2d6297c664a7ae4eecf1777a3ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:43:24 +0900
+Subject: ntfs3: pretend $Extend records as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index edd7c89ba1a11..019a98e300dcf 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -456,6 +456,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ 		   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
+ 		/* Records in $Extend are not a files or general directories. */
+ 		inode->i_op = &ntfs_file_inode_operations;
++		mode = S_IFREG;
+ 	} else {
+ 		err = -EINVAL;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-5.15/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-5.15/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..9bf217aff7
--- /dev/null
+++ b/queue-5.15/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From e712cbf0db52377b319aa10dc7f08a52c88ec209 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index 9a5b757fbd2f6..2d2d16caf9190 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch b/queue-5.15/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
new file mode 100644
index 0000000000..a878251530
--- /dev/null
+++ b/queue-5.15/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
@@ -0,0 +1,43 @@
+From b39a14653def0d4449f405d1a5cc9cf04a552ce1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:17:03 -0700
+Subject: page_pool: always add GFP_NOWARN for ATOMIC allocations
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
+
+Driver authors often forget to add GFP_NOWARN for page allocation
+from the datapath. This is annoying to users as OOMs are a fact
+of life, and we pretty much expect network Rx to hit page allocation
+failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
+by default.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 416be038e1cae..813d15a5593c6 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -283,6 +283,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool,
+ 	struct page *page;
+ 	int i, nr_pages;
+ 
++	/* Unconditionally set NOWARN if allocating from NAPI.
++	 * Drivers forget to set it, and OOM reports on packet Rx are useless.
++	 */
++	if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
++		gfp |= __GFP_NOWARN;
++
+ 	/* Don't support bulk alloc for high-order pages */
+ 	if (unlikely(pp_order))
+ 		return __page_pool_alloc_page_order(pool, gfp);
+-- 
+2.51.0
+
diff --git a/queue-5.15/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-5.15/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..7a75e523c8
--- /dev/null
+++ b/queue-5.15/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 9daf0742e46c3b0acdd92af298ad60f9e6aa912f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 813d15a5593c6..4ec7e6229f697 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -61,11 +61,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-5.15/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-5.15/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..28eaf528f6
--- /dev/null
+++ b/queue-5.15/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From 5373563d5bf6d1db9f0235710cafc94fe5a9f099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index c29176bdecd19..28e1497a4fc40 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -444,7 +444,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 52767f26048fd..7b4d403569ecd 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index ef649c807af4e..0ba78a23c3eaa 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -487,7 +487,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -495,13 +495,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-5.15/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-5.15/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..d97db815b9
--- /dev/null
+++ b/queue-5.15/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 08cbc65455ad7e36a635f0caa83f07bd7efe5292 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ad0060759b18f..7cc346fff87e3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2589,6 +2589,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-5.15/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-5.15/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..0f845cc517
--- /dev/null
+++ b/queue-5.15/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From c8619c0d855e9e30565a69d282bc084744d206b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 57654c82b08e8..e70993730728b 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -231,7 +231,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-5.15/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-5.15/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..1477bd2332
--- /dev/null
+++ b/queue-5.15/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 1b5dd2fab1577d69d66081577face51fbaaa8be8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index ba042e39cfaf4..9a54c2750d87c 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-5.15/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch b/queue-5.15/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
new file mode 100644
index 0000000000..2a8e30abaf
--- /dev/null
+++ b/queue-5.15/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
@@ -0,0 +1,55 @@
+From a71d2991247f0b002b218cf8b077ec6cadb567dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:04:52 +0200
+Subject: phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
+ register 0
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
+
+The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
+value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
+this offset is perfectly fine (in fact, register 0 is the only one in
+this register file).
+Introduce a boolean variable to indicate valid registers and allow writes
+to register 0.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+index ca13a604ab4ff..286b38cc6f442 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+@@ -82,10 +82,11 @@ struct dphy_reg {
+ 	u32 offset;
+ 	u32 mask;
+ 	u32 shift;
++	u8 valid;
+ };
+ 
+ #define PHY_REG(_offset, _width, _shift) \
+-	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
++	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
+ 
+ static const struct dphy_reg rk1808_grf_dphy_regs[] = {
+ 	[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
+@@ -134,7 +135,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
+ 	const struct dphy_drv_data *drv_data = priv->drv_data;
+ 	const struct dphy_reg *reg = &drv_data->grf_regs[index];
+ 
+-	if (reg->offset)
++	if (reg->valid)
+ 		regmap_write(priv->grf, reg->offset,
+ 			     HIWORD_UPDATE(value, reg->mask, reg->shift));
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.15/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-5.15/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..840b3afb4f
--- /dev/null
+++ b/queue-5.15/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From 31f7f3f7fa1066770f5412bd683354e8acc147b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index ed5be1bff60ca..2f13d906e1fcb 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -335,7 +335,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/ptp-limit-time-setting-of-ptp-clocks.patch b/queue-5.15/ptp-limit-time-setting-of-ptp-clocks.patch
new file mode 100644
index 0000000000..e058dc2efa
--- /dev/null
+++ b/queue-5.15/ptp-limit-time-setting-of-ptp-clocks.patch
@@ -0,0 +1,81 @@
+From 15d7b4074b1f489796dc5422a360de84d0b773a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:32:53 +0200
+Subject: ptp: Limit time setting of PTP clocks
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
+
+Networking drivers implementing PTP clocks and kernel socket code
+handling hardware timestamps use the 64-bit signed ktime_t type counting
+nanoseconds. When a PTP clock reaches the maximum value in year 2262,
+the timestamps returned to applications will overflow into year 1667.
+The same thing happens when injecting a large offset with
+clock_adjtime(ADJ_SETOFFSET).
+
+The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
+CLOCK_REALTIME") limited the maximum accepted value setting the system
+clock to 30 years before the maximum representable value (i.e. year
+2232) to avoid the overflow, assuming the system will not run for more
+than 30 years.
+
+Enforce the same limit for PTP clocks. Don't allow negative values and
+values closer than 30 years to the maximum value. Drivers may implement
+an even lower limit if the hardware registers cannot represent the whole
+interval between years 1970 and 2262 in the required resolution.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <jstultz@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 2e4e425288b26..d6dee90bed35f 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ 		return -EBUSY;
+ 	}
+ 
++	if (!timespec64_valid_settod(tp))
++		return -EINVAL;
++
+ 	return  ptp->info->settime64(ptp->info, tp);
+ }
+ 
+@@ -112,7 +115,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 	ops = ptp->info;
+ 
+ 	if (tx->modes & ADJ_SETOFFSET) {
+-		struct timespec64 ts;
++		struct timespec64 ts, ts2;
+ 		ktime_t kt;
+ 		s64 delta;
+ 
+@@ -125,6 +128,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 		if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
+ 			return -EINVAL;
+ 
++		/* Make sure the offset is valid */
++		err = ptp_clock_gettime(pc, &ts2);
++		if (err)
++			return err;
++		ts2 = timespec64_add(ts2, ts);
++		if (!timespec64_valid_settod(&ts2))
++			return -EINVAL;
++
+ 		kt = timespec64_to_ktime(ts);
+ 		delta = ktime_to_ns(kt);
+ 		err = ops->adjtime(ops, delta);
+-- 
+2.51.0
+
diff --git a/queue-5.15/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-5.15/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..90d12e259a
--- /dev/null
+++ b/queue-5.15/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From e5c00c54c4ecb3706dcdc6a4c1793634faeef3fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 07dc9fdeea54c..6b5bf7d492960 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3269,7 +3269,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3422,7 +3422,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3620,7 +3620,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
+-- 
+2.51.0
+
diff --git a/queue-5.15/rdma-irdma-update-kconfig.patch b/queue-5.15/rdma-irdma-update-kconfig.patch
new file mode 100644
index 0000000000..42eeb7f402
--- /dev/null
+++ b/queue-5.15/rdma-irdma-update-kconfig.patch
@@ -0,0 +1,42 @@
+From 6fbb7cd4c0d0ca34553b8ed7846e2c2ce5c427dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:25:45 -0500
+Subject: RDMA/irdma: Update Kconfig
+
+From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+
+[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
+
+Update Kconfig to add dependency on idpf module and
+add IPU E2000 to the list of supported devices.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com
+Tested-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/Kconfig b/drivers/infiniband/hw/irdma/Kconfig
+index b6f9c41bca51d..41660203e0049 100644
+--- a/drivers/infiniband/hw/irdma/Kconfig
++++ b/drivers/infiniband/hw/irdma/Kconfig
+@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA
+ 	depends on INET
+ 	depends on IPV6 || !IPV6
+ 	depends on PCI
+-	depends on ICE && I40E
++	depends on IDPF && ICE && I40E
+ 	select GENERIC_ALLOCATOR
+ 	select AUXILIARY_BUS
+ 	help
+-	  This is an Intel(R) Ethernet Protocol Driver for RDMA driver
+-	  that support E810 (iWARP/RoCE) and X722 (iWARP) network devices.
++	  This is an Intel(R) Ethernet Protocol Driver for RDMA that
++	  supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP)
++	  network devices.
+-- 
+2.51.0
+
diff --git a/queue-5.15/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-5.15/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..4e3fd00264
--- /dev/null
+++ b/queue-5.15/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 0cefca21d450b984f28772a4cfb91adc24a46df5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index d35d1fc398076..1257867e85e4e 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-5.15/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-5.15/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..433c089a09
--- /dev/null
+++ b/queue-5.15/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From a48718da2d66107db1762d275e47c30dedfee849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 515c6d68e47ce..ab011371c53e8 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -124,6 +124,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch b/queue-5.15/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
new file mode 100644
index 0000000000..c5ed1eb286
--- /dev/null
+++ b/queue-5.15/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
@@ -0,0 +1,70 @@
+From 63bd774c08a002d9a4f7358c56c375146b86acc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:37:57 -0700
+Subject: scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
+
+The fc_ct_ms_fill() helper currently formats the OS name and version
+into entry->value using "%s v%s". Since init_utsname()->sysname and
+->release are unbounded strings, snprintf() may attempt to write more
+than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
+-Wformat-truncation warning with W=1.
+
+In file included from drivers/scsi/libfc/fc_elsct.c:18:
+drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
+drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
+be truncated writing up to 64 bytes into a region of size between 62
+and 126 [-Werror=format-truncation=]
+  359 |                         "%s v%s",
+      |                              ^~
+  360 |                         init_utsname()->sysname,
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
+3 and 131 bytes into a destination of size 128
+  357 |                 snprintf((char *)&entry->value,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  358 |                         FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  359 |                         "%s v%s",
+      |                         ~~~~~~~~~
+  360 |                         init_utsname()->sysname,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by using "%.62s v%.62s", which ensures sysname and release are
+truncated to fit within the 128-byte field defined by
+FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
+
+[mkp: clarified commit description]
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_encode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
+index 74ae7fd15d8db..9107d89256055 100644
+--- a/drivers/scsi/libfc/fc_encode.h
++++ b/drivers/scsi/libfc/fc_encode.h
+@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
+ 		put_unaligned_be16(len, &entry->len);
+ 		snprintf((char *)&entry->value,
+ 			FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+-			"%s v%s",
++			"%.62s v%.62s",
+ 			init_utsname()->sysname,
+ 			init_utsname()->release);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-5.15/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..f380b0282a
--- /dev/null
+++ b/queue-5.15/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From 243f4356349d2ed0a2340e8b89a73a08cd1284f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 520491a8b56e6..d97bc6445e9e3 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -6268,7 +6268,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct scsi_cmnd *cmnd)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -6434,8 +6434,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irqrestore(&pnode->lock, flags);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -6620,7 +6626,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-5.15/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..902cfb6994
--- /dev/null
+++ b/queue-5.15/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From ed627d7065788a6e2b12513f26785440901111c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index f71e5b6311ac0..89c215bf238ce 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch b/queue-5.15/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
new file mode 100644
index 0000000000..735cb40acd
--- /dev/null
+++ b/queue-5.15/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
@@ -0,0 +1,64 @@
+From 6c2e1a77a327dad7e6ff2e157bd61ff30639a447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:01 -0700
+Subject: scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
+ lpfc_cleanup
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
+
+In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
+F_Port_Ctrl ndlp object.  In cases when an ABTS is issued, the
+outstanding kref is needed for when a second XRI_ABORTED CQE is
+received.  The final kref for the ndlp is designed to be decremented in
+lpfc_sli4_els_xri_aborted instead.  Also, add a new log message to allow
+for future diagnostics when debugging related issues.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c  | 6 +++++-
+ drivers/scsi/lpfc/lpfc_init.c | 7 -------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 134d56bd00daf..cb2ee84ccc976 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -11449,7 +11449,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 			sglq_entry->state = SGL_FREED;
+ 			spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+ 					       iflag);
+-
++			lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
++					LOG_DISCOVERY | LOG_NODE,
++					"0732 ELS XRI ABORT on Node: ndlp=x%px "
++					"xri=x%x\n",
++					ndlp, xri);
+ 			if (ndlp) {
+ 				lpfc_set_rrq_active(phba, ndlp,
+ 					sglq_entry->sli4_lxritag,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index bba51ce4276ae..e2f9b23a3fbb2 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -2912,13 +2912,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
+ 		lpfc_vmid_vport_cleanup(vport);
+ 
+ 	list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
+-		if (vport->port_type != LPFC_PHYSICAL_PORT &&
+-		    ndlp->nlp_DID == Fabric_DID) {
+-			/* Just free up ndlp with Fabric_DID for vports */
+-			lpfc_nlp_put(ndlp);
+-			continue;
+-		}
+-
+ 		if (ndlp->nlp_DID == Fabric_Cntl_DID &&
+ 		    ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
+ 			lpfc_nlp_put(ndlp);
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch b/queue-5.15/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
new file mode 100644
index 0000000000..420b37bcd1
--- /dev/null
+++ b/queue-5.15/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
@@ -0,0 +1,56 @@
+From a445d94ca7437c2c86d535ecffc8c5ce64349ba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:34 +0530
+Subject: scsi: mpi3mr: Fix controller init failure on fault during queue
+ creation
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
+
+Firmware can enter a transient fault while creating operational queues.
+The driver fails the load immediately.
+
+Add a retry loop that checks controller status and history bit after
+queue creation. If either indicates a fault, retry init up to a set
+limit before failing.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index 356e0b99a12fc..939c3509b316a 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -1770,6 +1770,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ {
+ 	int retval = 0;
+ 	u16 num_queues = 0, i = 0, msix_count_op_q = 1;
++	u32 ioc_status;
++	enum mpi3mr_iocstate ioc_state;
+ 
+ 	num_queues = min_t(int, mrioc->facts.max_op_reply_q,
+ 	    mrioc->facts.max_op_req_q);
+@@ -1820,6 +1822,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ 		retval = -1;
+ 		goto out_failed;
+ 	}
++	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
++	ioc_state = mpi3mr_get_iocstate(mrioc);
++	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
++	    ioc_state != MRIOC_STATE_READY) {
++		mpi3mr_print_fault_info(mrioc);
++		retval = -1;
++		goto out_failed;
++	}
+ 	mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
+ 	ioc_info(mrioc, "Successfully created %d Operational Q pairs\n",
+ 	    mrioc->num_op_reply_q);
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-5.15/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..a303c2b1a8
--- /dev/null
+++ b/queue-5.15/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From 73b477c4893b8c4e670414bc595eff4a2070a483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index e2ff42e16f94b..082437c84f81e 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -684,7 +684,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-5.15/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-5.15/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..f932941bb4
--- /dev/null
+++ b/queue-5.15/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From 90cd4904d20222ce13dead391210e89cc219829c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index ec05c42e8ee6c..e2ff42e16f94b 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -536,23 +536,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 0659ee9aafce7..f1a6922bed5d5 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -510,6 +510,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 75864b47921aa..afa81a362a11c 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -538,6 +538,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-5.15/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..621624ec68
--- /dev/null
+++ b/queue-5.15/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From 5e93ed063c1536feea143e4bb68cc4ac9ea8fc16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index bed85001da735..0e43b9e95f4dd 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -409,6 +409,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-5.15/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..5f4b41a5e0
--- /dev/null
+++ b/queue-5.15/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 2f8fdf19aa0dbfb1d6f4a60b21936edc807b3eaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index c16e4da988257..8b71b7958effc 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -260,7 +260,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-5.15/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..855f7fcd12
--- /dev/null
+++ b/queue-5.15/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From 409b0d8f0f80b2e5511cd0c49ae6dae4dce1245b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-5.15/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..bb30e1e809
--- /dev/null
+++ b/queue-5.15/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From 092776915f2f7a279bf0a0881f916e6461e97482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-replace-sleep-with-slowwait.patch b/queue-5.15/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..3217854ab8
--- /dev/null
+++ b/queue-5.15/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From c2b5a2183060f54ebdd7c5a3ee111dc7cdbc560b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 0e43b9e95f4dd..7bca859223a57 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -186,7 +186,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ do_run_cmd()
+-- 
+2.51.0
+
diff --git a/queue-5.15/selftests-traceroute-use-require_command.patch b/queue-5.15/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..6091fa0c35
--- /dev/null
+++ b/queue-5.15/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From eb1de714a7c3caf58cea80765fff857ed3db92f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index de9ca97abc306..9cb5e96e64333 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -209,11 +209,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -278,11 +273,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -316,6 +306,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-5.15/series b/queue-5.15/series
index 716319827e..cd9c2bb376 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -84,3 +84,106 @@ mfd-stmpe-remove-irq-domain-upon-removal.patch
 mfd-stmpe-i2c-add-missing-module_license.patch
 mfd-madera-work-around-false-positive-wininitialized.patch
 mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+media-fix-uninitialized-symbol-warnings.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+ptp-limit-time-setting-of-ptp-clocks.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
+drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+media-adv7180-add-missing-lock-in-suspend-callback.patch
+media-adv7180-do-not-write-format-to-device-in-set_f.patch
+media-adv7180-only-validate-format-in-querystd.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+drm-amd-add-more-cyan-skillfish-pci-ids.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+usb-cdns3-gadget-use-after-free-during-failed-initia.patch
+drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+ntfs3-pretend-extend-records-as-regular-files.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-traceroute-use-require_command.patch
+netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+selftests-replace-sleep-with-slowwait.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
+page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+ipv6-np-rxpmtu-race-annotation.patch
+rdma-irdma-update-kconfig.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+net-ethernet-microchip-sparx5-make-it-selectable-for.patch
+iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
+exfat-limit-log-print-for-io-error.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-5.15/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-5.15/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..e6d269d183
--- /dev/null
+++ b/queue-5.15/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From e444f4c09e5600e9f0489c101579fb49af79f136 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 8fb09eec8c3e7..694ed081cf8d9 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -58,6 +58,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index df39580f398d3..737f7a5c28359 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-5.15/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch b/queue-5.15/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
new file mode 100644
index 0000000000..b2afa1e449
--- /dev/null
+++ b/queue-5.15/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,63 @@
+From 441ce474cc0df967b443a9024c89a49481614387 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:42:29 +0200
+Subject: thunderbolt: Use is_pciehp instead of is_hotplug_bridge
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
+
+The thunderbolt driver sets up device link dependencies from hotplug ports
+to the Host Router (aka Native Host Interface, NHI).  When resuming from
+system sleep, this allows the Host Router to re-establish tunnels to
+attached Thunderbolt devices before the hotplug ports resume.
+
+To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
+flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
+
+Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
+more apt to identify them with the is_pciehp flag.
+
+Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
+support and are quirked to use legacy INTx interrupts instead.  The quirk
+identifies them with is_hotplug_bridge, even though all affected ports are
+also matched by is_pciehp.  So use is_pciehp here as well.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c     | 2 +-
+ drivers/thunderbolt/tb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7cc346fff87e3..7597aedc05c37 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3693,7 +3693,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+  */
+ static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
+ {
+-	if (pdev->is_hotplug_bridge &&
++	if (pdev->is_pciehp &&
+ 	    (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
+ 	     pdev->revision <= 1))
+ 		pdev->no_msi = 1;
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index 8bf45da1012e8..abe171769dc7e 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -1698,7 +1698,7 @@ static void tb_apple_add_links(struct tb_nhi *nhi)
+ 		if (!pci_is_pcie(pdev))
+ 			continue;
+ 		if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
+-		    !pdev->is_hotplug_bridge)
++		    !pdev->is_pciehp)
+ 			continue;
+ 
+ 		link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+-- 
+2.51.0
+
diff --git a/queue-5.15/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-5.15/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..2a7f09614c
--- /dev/null
+++ b/queue-5.15/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 320a09cb64ea94acb121f4edae86b1ea80f491ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index bc3a043a5d5c7..72b0210cdead7 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-cdns3-gadget-use-after-free-during-failed-initia.patch b/queue-5.15/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
new file mode 100644
index 0000000000..53bcae6516
--- /dev/null
+++ b/queue-5.15/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
@@ -0,0 +1,62 @@
+From d654b0d090173316d9c5799e49925c9a6d3afafe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:48:42 +0800
+Subject: usb: cdns3: gadget: Use-after-free during failed initialization and
+ exit of cdnsp gadget
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
+
+In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
+structure (pdev->gadget) was freed before its endpoints.
+The endpoints are linked via the ep_list in the gadget structure.
+Freeing the gadget first leaves dangling pointers in the endpoint list.
+When the endpoints are subsequently freed, this results in a use-after-free.
+
+Fix:
+By separating the usb_del_gadget_udc() operation into distinct "del" and
+"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
+final release of the gadget structure with usb_put_gadget().
+
+A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
+ only after freeing endpoints").
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index 1de82fb9dcb48..6bd9a2ebf687d 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1978,7 +1978,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
+ 	return 0;
+ 
+ del_gadget:
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
++	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
++	goto halt_pdev;
+ free_endpoints:
+ 	cdnsp_gadget_free_endpoints(pdev);
+ halt_pdev:
+@@ -2000,8 +2003,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
+ 	devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
+ 	pm_runtime_mark_last_busy(cdns->dev);
+ 	pm_runtime_put_autosuspend(cdns->dev);
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
+ 	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
+ 	cdnsp_mem_cleanup(pdev);
+ 	kfree(pdev);
+ 	cdns->gadget_dev = NULL;
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-5.15/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..f4d70a04e0
--- /dev/null
+++ b/queue-5.15/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From 48e0e634967d8b963faf9a4c4cff504c3ee54356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index d6dc02ec5fc6e..9fcf27e6f0e40 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2005,7 +2005,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2029,6 +2034,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-5.15/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..49fea7da06
--- /dev/null
+++ b/queue-5.15/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From aede8bdec9b71f023dd2a54db36462eb120865b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index b0efaab8678bd..1293bc9157087 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-5.15/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..ebb18121cf
--- /dev/null
+++ b/queue-5.15/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From dfee86c214f6d752af19127bedacdd8b3589255a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 4fe6a1efe0986..1ee950bf1604e 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1468,6 +1468,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us))
+@@ -1717,7 +1719,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-5.15/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..ba235b10ad
--- /dev/null
+++ b/queue-5.15/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From 1dfdb3dbaca20d4c126c8621daa3381fcbbfe597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index 35483217b1f6c..93998d328d9aa 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-5.15/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-5.15/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..1056d2a289
--- /dev/null
+++ b/queue-5.15/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From cea4e500df9869a2ee6bdae6689b6a2ea3a81556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index daf93bee7669b..c6ef7863c3e97 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -242,6 +242,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.15/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-5.15/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..a4a7997f69
--- /dev/null
+++ b/queue-5.15/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From 02aac5bd26b91f99ac65c69ea41d45421b4e22f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 2b4c694b0fbbe..d90909ffa6780 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -13,6 +13,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -286,8 +287,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-5.15/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-5.15/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..0e3754c88d
--- /dev/null
+++ b/queue-5.15/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From f6d649000bd3358a9b3d24e06fcd7d987efb87f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index eba6485a59a39..4286b0f247ea3 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -959,16 +959,6 @@ ASM_RET
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -988,6 +978,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-5.15/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-5.15/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..3c45febccf
--- /dev/null
+++ b/queue-5.15/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 299141e9f414db870285757f5253fa1286a892ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index ba3172d5b3286..99400d72c4e6c 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-5.4/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-5.4/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..443d883305
--- /dev/null
+++ b/queue-5.4/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From 4ce5f733c5d5f9d3a9fdc12fd8e7e26a85559c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index 998bed6e54066..9f52d301e977b 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/allow-finish_no_open-file-err_ptr-e.patch b/queue-5.4/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..86d0a57801
--- /dev/null
+++ b/queue-5.4/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 7dc12a928fd60e6d81535cc81f50791f5a010eca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index f1c2ec6790bb3..2da364e942741 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -886,18 +886,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-5.4/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-5.4/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..567f214440
--- /dev/null
+++ b/queue-5.4/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From 1085f3fb6a5562b182fc6bbbca773e107654f864 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 1374a4e093b3f..f2c697ff50b57 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1181,6 +1181,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-5.4/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..3223489607
--- /dev/null
+++ b/queue-5.4/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From 08a10ea8744e3b67bbaf1d221b94daec4980947b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 8055f63603f45..8ff69111ceede 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-5.4/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..d706f8036e
--- /dev/null
+++ b/queue-5.4/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From 8a28c48ede317e93086fb4e8551c1bc5fb48cd3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 4c81883ba25e3..dc99b5d985fd5 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -399,6 +399,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-5.4/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-5.4/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..e5be4ae154
--- /dev/null
+++ b/queue-5.4/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From 71e45a97ba8a6378f8e0f3ebf7432da65b1db16a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index 460d578fae4df..66dcb4734ff25 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -142,7 +142,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-5.4/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-5.4/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..c0401ea27f
--- /dev/null
+++ b/queue-5.4/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From ec6801a099a8d86593cb644b049b810426f8f2cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index f6a147427029a..cbe86a1f2244b 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		}
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 				break;
+ 			}
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-5.4/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-5.4/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..ba1ed7cd32
--- /dev/null
+++ b/queue-5.4/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From d5e37b0d08ddb0d6da98855ea4f47e50b3159662 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 25d65f64cd507..6cbb018c215ad 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -474,6 +474,25 @@ dw_edma_device_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t paddr,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -489,6 +508,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -527,6 +548,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.4/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-5.4/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..311cf6ed49
--- /dev/null
+++ b/queue-5.4/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From e52e93c264cbe4fda1db667b1982a4ca652db9c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 827a1a9907b68..0e570303d1da8 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1164,7 +1164,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-5.4/dmaengine-sh-setup_xref-error-handling.patch b/queue-5.4/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..ff2e256857
--- /dev/null
+++ b/queue-5.4/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From b4de2f525ca526736e3495754c349b779e83e18c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index c51de498b5b4b..2cbc886d22112 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 5aafe548ca5f3..2b9774ae7fd32 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-5.4/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-5.4/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..f14f4ac8f7
--- /dev/null
+++ b/queue-5.4/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 70bca99df71f22d9f865bf1ddad005f60bb11ecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index a845eda14ece3..548cd062b9cd3 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1796,8 +1796,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	unsigned int usize, asize;
+ 	int retcode = -EINVAL;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -1810,8 +1812,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#%d), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-5.4/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..2249d3797a
--- /dev/null
+++ b/queue-5.4/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 9f488b7d811270de606a21e638888c27ba5a20b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index c89326125d711..f6012c378b46c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -105,7 +105,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ /*
+  * 512 = 0x200
+-- 
+2.51.0
+
diff --git a/queue-5.4/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-5.4/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..f398184708
--- /dev/null
+++ b/queue-5.4/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From 12d88dfda7513d85b2e6b8633044a1299150f1c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-5.4/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-5.4/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..222b4b2582
--- /dev/null
+++ b/queue-5.4/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From a3305b1adbf901807fa089c5b06c4dbda0b03537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 0317b614b6805..ea06cd4340525 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-5.4/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..69f6f58b1c
--- /dev/null
+++ b/queue-5.4/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From d1629b50dbbcaadf356d23778269050f2408e6f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index 592b97c464dac..f2c4d590de0a0 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -148,8 +149,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&indio_dev->mlock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-5.4/ipv6-np-rxpmtu-race-annotation.patch b/queue-5.4/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..e14d504e2c
--- /dev/null
+++ b/queue-5.4/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From 203e5294fcf17cfe3f43d4e132e5e51a8b280689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 731485b18de31..90d828c98b736 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, noblock, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index db948e3a9bdc8..3ed835b308044 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -297,7 +297,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-5.4/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-5.4/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..c793a67f93
--- /dev/null
+++ b/queue-5.4/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From df4fc9b727495376ebe5cbac48b2b504d4218c98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 6f6a5b9203d3f..97a2eb0f0b75d 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-5.4/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-5.4/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..3fe39a1154
--- /dev/null
+++ b/queue-5.4/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From b14bc9d001914f3784567e69940fb67a7e14a470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 6d353fbe67c04..0fb502ed7273c 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-5.4/media-fix-uninitialized-symbol-warnings.patch b/queue-5.4/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..c09fc78539
--- /dev/null
+++ b/queue-5.4/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From bf985436d2b18779c9736ff143d38d5700e7b964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index 56674173524fd..0c1c54b5a6f5e 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 849df4d1c573c..c8aa193e04e71 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ea4f1ae4d686e..b756b05835e00 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-5.4/media-imon-make-send_packet-more-robust.patch b/queue-5.4/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..ccea1e4135
--- /dev/null
+++ b/queue-5.4/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 56a5182deaae376d96c244225d61ad8b254df529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 8cab6e1500b70..6e73304a1e7cf 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -652,12 +652,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1759,14 +1762,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1775,16 +1770,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1800,14 +1808,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1816,16 +1816,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-5.4/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..ab5497e61e
--- /dev/null
+++ b/queue-5.4/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From 6ad30952715c4deb6f75225873d82b5f9808b6ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 9e6019a159f4c..0b6b77aa29dd2 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -150,14 +150,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index 90f38552bd362..8a48b4533a02f 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -325,6 +325,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -334,7 +335,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 4202c3a47d33e..7ed0d2d85253e 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-5.4/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..b24fa811e0
--- /dev/null
+++ b/queue-5.4/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From 12a74c76823a19699a2fd1c843df2bceb838bb5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index c392276610478..5a9702ccd54e6 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -423,7 +423,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-5.4/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-5.4/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..f338db2c15
--- /dev/null
+++ b/queue-5.4/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From dce5fcbc86cec3fd1a6c37cdab03847642a1a98b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index ff6ff9568e1bc..1a5f4faa0831f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -105,6 +105,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-5.4/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-5.4/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..8b78f207c8
--- /dev/null
+++ b/queue-5.4/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From a1a9bda7d3434e6cae318a6138f30e48c6af0aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 510be63c8bdf1..ff6ff9568e1bc 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-5.4/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..94b0065be3
--- /dev/null
+++ b/queue-5.4/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From dd2d7c234479096572b7f3430a15354ae04ac608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 6c2d9779ac727..e52dfd4bad573 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -459,7 +459,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-5.4/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..2d5591edf0
--- /dev/null
+++ b/queue-5.4/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From 6286fde5154b9b396726981fac882a8a546c6966 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index a737cea1835f3..6660032866e7d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2456,23 +2456,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-5.4/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..3a2bc2fa16
--- /dev/null
+++ b/queue-5.4/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From 2a3df9c767ba31326e34297e7e10ccc4a5c5cecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 54f9ad391f895..a737cea1835f3 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2590,8 +2590,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 			return 1;
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-5.4/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..881c6f2157
--- /dev/null
+++ b/queue-5.4/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From 8f952872495e8af3665a0f4cf5130e6d0fccb3da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 4295de3e6a4ba..7c2ead6cdc538 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -58,7 +58,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-5.4/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..5310c1f120
--- /dev/null
+++ b/queue-5.4/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From e3ea8476ac3dfab76035b166f3e5fbfe0fadfabe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index be07bfdb0bb4a..40c5bdb3ac2c1 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index dc8ccd378ec92..6a3aebd56e6c4 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-5.4/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..5d0b790b40
--- /dev/null
+++ b/queue-5.4/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From bab05854dfbc936ae74a3792666e068cffd21a88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 1c5ecd07a43e1..240f46c7ce1e8 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb, err);
+@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-5.4/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..8f703729b1
--- /dev/null
+++ b/queue-5.4/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From 2695af4c9f2448a5977e27053ce1cc4d93675cc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index a635c9af26c3e..873b0acecd1bf 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -277,9 +277,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	/* Clear unused address register sets */
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-5.4/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..4d2b4e9e14
--- /dev/null
+++ b/queue-5.4/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From 88c64d32189b4f4661230b68d236f4a985925817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index 004e49f748419..beea7e014b157 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-5.4/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..c6dcd17460
--- /dev/null
+++ b/queue-5.4/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From f67e0ed2543c633603cb02f547b44ff32f01e69c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index f808e60b4ee4f..113774999d57b 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2397,6 +2397,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2423,6 +2424,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2438,8 +2440,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-5.4/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-5.4/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..3d046f05a4
--- /dev/null
+++ b/queue-5.4/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From be6e358afcc2c96788b0bd29c908bb3d21a50a76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index 388f5773b88d2..3a807ae69a12e 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -760,6 +760,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-5.4/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..2310d9e51f
--- /dev/null
+++ b/queue-5.4/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From dc14a8b7fefa1c10936f782f318cbf1850c3e691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 7a4d7158c55f2..4e9b63c471af7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -355,7 +355,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-5.4/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-5.4/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..e7c42ab015
--- /dev/null
+++ b/queue-5.4/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From d1cfb6203ea3f4aee5a69d5f55dc9688f3a554f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 44770bb9017d5..7a4d7158c55f2 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7315,10 +7315,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-5.4/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..1ea17e80d3
--- /dev/null
+++ b/queue-5.4/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From c7a727220d6461ee3b1aee7c30a4cf3909f9ed17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index b64a3751c3e4a..49defb02cc201 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2660,6 +2660,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-5.4/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-5.4/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..a09ea8afcf
--- /dev/null
+++ b/queue-5.4/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From c982e846d07b31ed3bf3da4d42715917bfd135b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index bdc285aea3600..5e355d9d9a819 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-5.4/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..e88cc82374
--- /dev/null
+++ b/queue-5.4/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 5e138763be43cbd7a23984eecf21966e566afbb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index dbe0489e46035..305e348e1d7b3 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -33,11 +33,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-5.4/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-5.4/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..e80c647b83
--- /dev/null
+++ b/queue-5.4/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From cc731b572d3053ebee98b875f3ecc31a4e1911d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 2733ca94434dc..e9aed73cfd5f6 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2541,6 +2541,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-5.4/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-5.4/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..05969ff021
--- /dev/null
+++ b/queue-5.4/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From 46126906c8317d2aba7498c38c27deae29e748ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 0153abdbbc8dd..fe50d147e74ef 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -215,7 +215,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-5.4/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-5.4/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..95a6b0bf82
--- /dev/null
+++ b/queue-5.4/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From e290a5b71821defc0251a650d61b4dfd5e6e9d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index 90c4e9b5aac83..04cee5a00a5b4 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-5.4/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-5.4/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..8e519e8da5
--- /dev/null
+++ b/queue-5.4/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From 76d227c761f60d6238303db5a9efbe7914fa32dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 68decc2bf42bc..7ce80ad5e9d35 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -351,7 +351,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-5.4/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..483feb5e05
--- /dev/null
+++ b/queue-5.4/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 8b121c6c6b33228f03068a2c8432b7a04cd6af20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index 2ac5b5e559012..a8ad1e4185eb7 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -94,7 +94,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-5.4/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-5.4/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..19f968352e
--- /dev/null
+++ b/queue-5.4/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From 41d817e8ab3d1b2a3977dc7367887e97efde575c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 9c9beeb3bcd74..a6ddb58330eb5 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -121,6 +121,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-5.4/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..0c344a416f
--- /dev/null
+++ b/queue-5.4/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From 23c7e6560c96836e8fc9f451bf2c2b055b236584 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 1d58895b3943b..9201c548aab4b 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -5153,7 +5153,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct scsi_cmnd *cmnd)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -5312,8 +5312,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irq(shost->host_lock);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -5457,7 +5463,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-5.4/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-5.4/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..4901a72506
--- /dev/null
+++ b/queue-5.4/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From 6309b7346cfd76a2ff11f180b7596891af3834de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 20f2537af511c..6cd5605ad00ba 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_NVMEKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-5.4/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-5.4/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..34f31e2c39
--- /dev/null
+++ b/queue-5.4/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From 7d761b876accdee033f9146054b105fcce7a8484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 6b85016b4db36..4aace2c34f062 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -596,7 +596,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-5.4/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..bedfa45e1d
--- /dev/null
+++ b/queue-5.4/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From 1c8c50929da53487743efd248ae491cab6f5bfa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index d2ac09b35dcf5..e3657454816b9 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -376,6 +376,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-5.4/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..a9ea3382e0
--- /dev/null
+++ b/queue-5.4/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 7d530dc56583ce3cc09da9245927989183b8425e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 40ee6f57af78a..9514f6dbe46b6 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -237,7 +237,7 @@ else
+ endif
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-5.4/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..564e13e3a6
--- /dev/null
+++ b/queue-5.4/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From 67513de6bdc4a9a9dd356862e22b2338faa02c5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-5.4/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..a676835c8d
--- /dev/null
+++ b/queue-5.4/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From f45384be780a5a91d4357b42cf561e015d832f53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-5.4/selftests-replace-sleep-with-slowwait.patch b/queue-5.4/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..1b7792e73a
--- /dev/null
+++ b/queue-5.4/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From 6d15192cd99b51b6814954d819757642e8438329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index e3657454816b9..354c766e7c24a 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -164,7 +164,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ do_run_cmd()
+-- 
+2.51.0
+
diff --git a/queue-5.4/series b/queue-5.4/series
index fdbd0265fc..cd9c0d5063 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -44,3 +44,63 @@ tools-power-x86_energy_perf_policy-prefer-driver-hwp.patch
 mfd-stmpe-remove-irq-domain-upon-removal.patch
 mfd-stmpe-i2c-add-missing-module_license.patch
 mfd-madera-work-around-false-positive-wininitialized.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+media-fix-uninitialized-symbol-warnings.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+selftests-replace-sleep-with-slowwait.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+ipv6-np-rxpmtu-race-annotation.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-5.4/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-5.4/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..063a025f53
--- /dev/null
+++ b/queue-5.4/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From 59b3fb581b3fe196ca18c1424504212e2fae6dad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 7e078bc73ef56..d3dda47d0bc5a 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -59,6 +59,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index df39580f398d3..737f7a5c28359 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-5.4/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-5.4/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..8c1f0cc371
--- /dev/null
+++ b/queue-5.4/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From 34c64db5edee2965e80e887a3a48950c3995d65a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 9b5f9d503ff0d..e0a35dc19e455 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2012,7 +2012,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2036,6 +2041,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-5.4/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-5.4/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..e468d2f0fd
--- /dev/null
+++ b/queue-5.4/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From bb7253455f7a8eadfd139c43d35c21c7c920b5fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 77354626252cd..cea9157ea2b42 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -496,7 +496,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -767,7 +767,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-5.4/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-5.4/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..18d6311c84
--- /dev/null
+++ b/queue-5.4/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From 5abcf64d9f0fc8ba5eec905954d297ec1305a869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index ca50257b95384..b1e5693373820 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us)) {
+@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-5.4/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-5.4/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..a8a54c80c5
--- /dev/null
+++ b/queue-5.4/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From fb2ebeaf73da21818568d866c6542aff139f51c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index 35483217b1f6c..93998d328d9aa 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-5.4/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-5.4/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..0c6586f0ae
--- /dev/null
+++ b/queue-5.4/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From dd98cd9d71688ec41b12fb5f5a7d0e0b8b8f56c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 73570b392282d..85a39a4b85ce2 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -222,6 +222,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-5.4/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-5.4/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..02592142e9
--- /dev/null
+++ b/queue-5.4/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From b91ebbf3877dcd7a6c269b9c58d0e44f63693b97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index 86e5a1c1055ff..85e80f0a8b15e 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-6.1/6pack-drop-redundant-locking-and-refcounting.patch b/queue-6.1/6pack-drop-redundant-locking-and-refcounting.patch
new file mode 100644
index 0000000000..2a8f2ac1a9
--- /dev/null
+++ b/queue-6.1/6pack-drop-redundant-locking-and-refcounting.patch
@@ -0,0 +1,173 @@
+From 63bd6f355d4a76a968252ba46e06dc2f0c2d70ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:10:59 +0800
+Subject: 6pack: drop redundant locking and refcounting
+
+From: Qingfang Deng <dqfext@gmail.com>
+
+[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
+
+The TTY layer already serializes line discipline operations with
+tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack
+are unnecessary.
+
+Removing them simplifies the code and also resolves a lockdep warning
+reported by syzbot. The warning did not indicate a real deadlock, since
+the write-side lock was only taken in process context with hardirqs
+disabled.
+
+Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/
+Signed-off-by: Qingfang Deng <dqfext@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 57 ++++--------------------------------
+ 1 file changed, 5 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 9fb5675242207..1b007dd174794 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -121,8 +121,6 @@ struct sixpack {
+ 
+ 	struct timer_list	tx_t;
+ 	struct timer_list	resync_t;
+-	refcount_t		refcnt;
+-	struct completion	dead;
+ 	spinlock_t		lock;
+ };
+ 
+@@ -359,42 +357,13 @@ static void sp_bump(struct sixpack *sp, char cmd)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+-/*
+- * We have a potential race on dereferencing tty->disc_data, because the tty
+- * layer provides no locking at all - thus one cpu could be running
+- * sixpack_receive_buf while another calls sixpack_close, which zeroes
+- * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
+- * best way to fix this is to use a rwlock in the tty struct, but for now we
+- * use a single global rwlock for all ttys in ppp line discipline.
+- */
+-static DEFINE_RWLOCK(disc_data_lock);
+-                                                                                
+-static struct sixpack *sp_get(struct tty_struct *tty)
+-{
+-	struct sixpack *sp;
+-
+-	read_lock(&disc_data_lock);
+-	sp = tty->disc_data;
+-	if (sp)
+-		refcount_inc(&sp->refcnt);
+-	read_unlock(&disc_data_lock);
+-
+-	return sp;
+-}
+-
+-static void sp_put(struct sixpack *sp)
+-{
+-	if (refcount_dec_and_test(&sp->refcnt))
+-		complete(&sp->dead);
+-}
+-
+ /*
+  * Called by the TTY driver when there's room for more data.  If we have
+  * more packets to send, we send them here.
+  */
+ static void sixpack_write_wakeup(struct tty_struct *tty)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	int actual;
+ 
+ 	if (!sp)
+@@ -406,7 +375,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ 		sp->tx_enable = 0;
+ 		netif_wake_queue(sp->dev);
+-		goto out;
++		return;
+ 	}
+ 
+ 	if (sp->tx_enable) {
+@@ -414,9 +383,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		sp->xleft -= actual;
+ 		sp->xhead += actual;
+ 	}
+-
+-out:
+-	sp_put(sp);
+ }
+ 
+ /* ----------------------------------------------------------------------- */
+@@ -436,7 +402,7 @@ static void sixpack_receive_buf(struct tty_struct *tty,
+ 	if (!count)
+ 		return;
+ 
+-	sp = sp_get(tty);
++	sp = tty->disc_data;
+ 	if (!sp)
+ 		return;
+ 
+@@ -452,7 +418,6 @@ static void sixpack_receive_buf(struct tty_struct *tty,
+ 	}
+ 	sixpack_decode(sp, cp, count1);
+ 
+-	sp_put(sp);
+ 	tty_unthrottle(tty);
+ }
+ 
+@@ -567,8 +532,6 @@ static int sixpack_open(struct tty_struct *tty)
+ 
+ 	spin_lock_init(&sp->lock);
+ 	spin_lock_init(&sp->rxlock);
+-	refcount_set(&sp->refcnt, 1);
+-	init_completion(&sp->dead);
+ 
+ 	/* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
+ 
+@@ -650,19 +613,11 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock_irq(&disc_data_lock);
+ 	sp = tty->disc_data;
+-	tty->disc_data = NULL;
+-	write_unlock_irq(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+-	/*
+-	 * We have now ensured that nobody can start using ap from now on, but
+-	 * we have to wait for all existing users to finish.
+-	 */
+-	if (!refcount_dec_and_test(&sp->refcnt))
+-		wait_for_completion(&sp->dead);
++	tty->disc_data = NULL;
+ 
+ 	/* We must stop the queue to avoid potentially scribbling
+ 	 * on the free buffers. The sp->dead completion is not sufficient
+@@ -686,7 +641,7 @@ static void sixpack_close(struct tty_struct *tty)
+ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		unsigned long arg)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	struct net_device *dev;
+ 	unsigned int tmp, err;
+ 
+@@ -738,8 +693,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		err = tty_mode_ioctl(tty, cmd, arg);
+ 	}
+ 
+-	sp_put(sp);
+-
+ 	return err;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-6.1/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..13f2e13cdf
--- /dev/null
+++ b/queue-6.1/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From a4acb8977052adedec7951ea2e88c537f311019f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index c5ad377558645..12efc4ac9ba64 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/allow-finish_no_open-file-err_ptr-e.patch b/queue-6.1/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..e849f251aa
--- /dev/null
+++ b/queue-6.1/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 8aaff12a2495d53866341f65f6a38a4978751590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 2f88454887986..85466cd40c407 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -978,18 +978,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch b/queue-6.1/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
new file mode 100644
index 0000000000..6965c0d7b5
--- /dev/null
+++ b/queue-6.1/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
@@ -0,0 +1,39 @@
+From 6935c2783dce8b8e8404bf7b933b428700c7145f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 14:13:27 +0200
+Subject: ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c ]
+
+snd_seq_fifo_poll_wait() evaluates f->cells without locking after
+poll_wait(), and KCSAN doesn't like it as it appears to be a
+data-race.  Although this doesn't matter much in practice as the value
+is volatile, it's still better to address it for the mind piece.
+
+Wrap it with f->lock spinlock for avoiding the potential data race.
+
+Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_fifo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index f8e02e98709ab..faf288fecf26d 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -218,6 +218,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file,
+ 			   poll_table *wait)
+ {
+ 	poll_wait(file, &f->input_sleep, wait);
++	guard(spinlock_irq)(&f->lock);
+ 	return (f->cells > 0);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/alsa-serial-generic-remove-shared-static-buffer.patch b/queue-6.1/alsa-serial-generic-remove-shared-static-buffer.patch
new file mode 100644
index 0000000000..8b5d7fcb91
--- /dev/null
+++ b/queue-6.1/alsa-serial-generic-remove-shared-static-buffer.patch
@@ -0,0 +1,71 @@
+From fcea9e74474dec61fdf889d9bd49cbea47d34994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:42:19 +0100
+Subject: ALSA: serial-generic: remove shared static buffer
+
+From: John Keeping <jkeeping@inmusicbrands.com>
+
+[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
+
+If multiple instances of this driver are instantiated and try to send
+concurrently then the single static buffer snd_serial_generic_tx_work()
+will cause corruption in the data output.
+
+Move the buffer into the per-instance driver data to avoid this.
+
+Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/drivers/serial-generic.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c
+index e1f864dc7939a..3843dcc1bee58 100644
+--- a/sound/drivers/serial-generic.c
++++ b/sound/drivers/serial-generic.c
+@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");
+ #define SERIAL_TX_STATE_ACTIVE	1
+ #define SERIAL_TX_STATE_WAKEUP	2
+ 
++#define INTERNAL_BUF_SIZE 256
++
+ struct snd_serial_generic {
+ 	struct serdev_device *serdev;
+ 
+@@ -51,6 +53,7 @@ struct snd_serial_generic {
+ 	struct work_struct tx_work;
+ 	unsigned long tx_state;
+ 
++	char tx_buf[INTERNAL_BUF_SIZE];
+ };
+ 
+ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+ 	schedule_work(&drvdata->tx_work);
+ }
+ 
+-#define INTERNAL_BUF_SIZE 256
+-
+ static void snd_serial_generic_tx_work(struct work_struct *work)
+ {
+-	static char buf[INTERNAL_BUF_SIZE];
+ 	int num_bytes;
+ 	struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic,
+ 						   tx_work);
+@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)
+ 		if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode))
+ 			break;
+ 
+-		num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE);
+-		num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes);
++		num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf,
++						      INTERNAL_BUF_SIZE);
++		num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf,
++						    num_bytes);
+ 
+ 		if (!num_bytes)
+ 			break;
+-- 
+2.51.0
+
diff --git a/queue-6.1/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch b/queue-6.1/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
new file mode 100644
index 0000000000..4119108ccb
--- /dev/null
+++ b/queue-6.1/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
@@ -0,0 +1,80 @@
+From 4e99bf06c3d213c8582fef132117fb6ec2c66319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 17:27:30 +0200
+Subject: ALSA: usb-audio: add mono main switch to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
+
+The 1824c does not have the A/B switch that the 1810c has,
+but instead it has a mono main switch that sums the two
+main output channels to mono.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 65bdda0841048..2413a6d96971c 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
+ 
+ #define SC1810C_CTL_LINE_SW	0
+ #define SC1810C_CTL_MUTE_SW	1
++#define SC1824C_CTL_MONO_SW	2
+ #define SC1810C_CTL_AB_SW	3
+ #define SC1810C_CTL_48V_SW	4
+ 
+@@ -123,6 +124,7 @@ struct s1810c_state_packet {
+ #define SC1810C_STATE_48V_SW	58
+ #define SC1810C_STATE_LINE_SW	59
+ #define SC1810C_STATE_MUTE_SW	60
++#define SC1824C_STATE_MONO_SW	61
+ #define SC1810C_STATE_AB_SW	62
+ 
+ struct s1810_mixer_state {
+@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
+ 	.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
+ };
+ 
++static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
++	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++	.name = "Mono Main Out Switch",
++	.info = snd_ctl_boolean_mono_info,
++	.get = snd_s1810c_switch_get,
++	.put = snd_s1810c_switch_set,
++	.private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
++};
++
+ static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
+ 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ 	.name = "48V Phantom Power On Mic Inputs Switch",
+@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+-	if (ret < 0)
+-		return ret;
++	// The 1824c has a Mono Main switch instead of a
++	// A/B select switch.
++	if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
++		if (ret < 0)
++			return ret;
++	} else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-6.1/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..907c006296
--- /dev/null
+++ b/queue-6.1/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From 942d6f139dbd643a9607b708c604d5f69aa855ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-6.1/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-6.1/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..88af85d2ed
--- /dev/null
+++ b/queue-6.1/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From 48a45c5243519f6fc5548b8bcd1803b273295be2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 4cded91d22a8d..d258c7324fcc7 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch b/queue-6.1/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
new file mode 100644
index 0000000000..91ead38ff5
--- /dev/null
+++ b/queue-6.1/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
@@ -0,0 +1,47 @@
+From 19ef509bd6687e641123f512196dacefc77f28cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 16:43:40 +0100
+Subject: ASoC: qcom: sc8280xp: explicitly set S16LE format in
+ sc8280xp_be_hw_params_fixup()
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
+
+Setting format to s16le is required for compressed playback on compatible
+soundcards.
+
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sc8280xp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
+index 14d9fea33d16a..8ae2fe917c370 100644
+--- a/sound/soc/qcom/sc8280xp.c
++++ b/sound/soc/qcom/sc8280xp.c
+@@ -7,6 +7,7 @@
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+ #include <sound/pcm.h>
++#include <sound/pcm_params.h>
+ #include <linux/soundwire/sdw.h>
+ #include <sound/jack.h>
+ #include <linux/input-event-codes.h>
+@@ -39,8 +40,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+ 					SNDRV_PCM_HW_PARAM_RATE);
+ 	struct snd_interval *channels = hw_param_interval(params,
+ 					SNDRV_PCM_HW_PARAM_CHANNELS);
++	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+ 
+ 	rate->min = rate->max = 48000;
++	snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
+ 	channels->min = 2;
+ 	channels->max = 2;
+ 	switch (cpu_dai->id) {
+-- 
+2.51.0
+
diff --git a/queue-6.1/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-6.1/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..48ec647e41
--- /dev/null
+++ b/queue-6.1/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From ba83fc681aa6118dc1f43414129d00a87c35fd39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 8055f63603f45..8ff69111ceede 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch b/queue-6.1/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
new file mode 100644
index 0000000000..4c7f6e45d2
--- /dev/null
+++ b/queue-6.1/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
@@ -0,0 +1,122 @@
+From 3a7dd8a8b9a7fdd487c11e2ed82161e2152db7cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 18:40:16 +0200
+Subject: Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI
+ frames
+
+From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+
+[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
+
+Some Barrot based USB Bluetooth dongles erroneously send one extra
+random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The
+consequence of that is that the next HCI transfer is misaligned by one
+byte causing undefined behavior. In most cases the response event for
+the next command fails with random error code.
+
+Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI
+controller initialization, the initialization fails rendering the USB
+dongle not usable.
+
+> [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd
+> [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter
+> [61.720116] Bluetooth: hci1: command 0x1005 tx timeout
+> [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
+
+This patch was tested with the 33fa:0012 device. The info from the
+/sys/kernel/debug/usb/devices is shown below:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=33fa ProdID=0012 Rev=88.91
+S:  Product=UGREEN BT6.0 Adapter
+C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Now the device is initialized properly:
+
+> [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg
+> [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter
+> [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.750141] Bluetooth: MGMT ver 1.23
+
+Link: https://github.com/bluez/bluez/issues/1326
+Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Tested-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 8bb1162031a6a..29130160066a5 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -64,6 +64,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
+ #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
++#define BTUSB_BARROT			BIT(28)
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -699,6 +700,10 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
++	/* Barrot Technology Bluetooth devices */
++	{ USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT },
++	{ USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT },
++
+ 	/* Actions Semiconductor ATS2851 based devices */
+ 	{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
+ 
+@@ -991,6 +996,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
+ 		}
+ 
+ 		if (!hci_skb_expect(skb)) {
++			/* Each chunk should correspond to at least 1 or more
++			 * events so if there are still bytes left that doesn't
++			 * constitute a new event this is likely a bug in the
++			 * controller.
++			 */
++			if (count && count < HCI_EVENT_HDR_SIZE) {
++				bt_dev_warn(data->hdev,
++					"Unexpected continuation: %d bytes",
++					count);
++				count = 0;
++			}
++
+ 			/* Complete frame */
+ 			btusb_recv_event(data, skb);
+ 			skb = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.1/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-6.1/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..0aacabe74e
--- /dev/null
+++ b/queue-6.1/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From e7026094832be378c562d8c63d69dbdac260c86c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index fe8728041ad08..cf53d483dd071 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -434,6 +434,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-6.1/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-6.1/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..d67159258f
--- /dev/null
+++ b/queue-6.1/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From b050ab2966731c6c71f448ba87f7af0a372d55aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index a32d73f381558..d3257c9bfa920 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-6.1/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-6.1/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..88c5d00686
--- /dev/null
+++ b/queue-6.1/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From 434ac43d6300c50ca649f579b46861367dc617f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index cba19bfdc44dd..b5dd944d0282d 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -114,7 +114,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		break;
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -126,10 +127,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 			new_fops = fops_get(iter->fops);
+ 			break;
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-6.1/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-6.1/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..85756f3e91
--- /dev/null
+++ b/queue-6.1/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From 10ff50d007069b577dca8db4c22793ccdc0513e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index ef4cdcf6beba0..a4d9db43e62c8 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -563,6 +563,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -578,6 +597,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -616,6 +637,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-6.1/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..9401525190
--- /dev/null
+++ b/queue-6.1/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From 7b8a2235ca8f3d43ac2cba9f009d6bdcee3a9504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index ca0ba1d462832..8b215cbca1186 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-6.1/dmaengine-sh-setup_xref-error-handling.patch b/queue-6.1/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..0799af8b3c
--- /dev/null
+++ b/queue-6.1/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From 8c9ded9904dfc0883ec7c97c6fdadc8ee55f9f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 158e5e7defaeb..f309441f847ff 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 5aafe548ca5f3..2b9774ae7fd32 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amd-add-more-cyan-skillfish-pci-ids.patch b/queue-6.1/drm-amd-add-more-cyan-skillfish-pci-ids.patch
new file mode 100644
index 0000000000..e04b789535
--- /dev/null
+++ b/queue-6.1/drm-amd-add-more-cyan-skillfish-pci-ids.patch
@@ -0,0 +1,36 @@
+From e228866d9fc6f38f97dde7d60e5f4b83a19719d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:09:06 -0400
+Subject: drm/amd: add more cyan skillfish PCI ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
+
+Add additional PCI IDs to the cyan skillfish family.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 1fbb73b2691d5..6104353e4c2f4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1997,6 +1997,11 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
+ 
+ 	/* CYAN_SKILLFISH */
++	{0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amd-avoid-evicting-resources-at-s5.patch b/queue-6.1/drm-amd-avoid-evicting-resources-at-s5.patch
new file mode 100644
index 0000000000..84246bf8ea
--- /dev/null
+++ b/queue-6.1/drm-amd-avoid-evicting-resources-at-s5.patch
@@ -0,0 +1,48 @@
+From af13fdd91fe69d1c5c1cfd02560c69308571114b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 12:00:06 -0500
+Subject: drm/amd: Avoid evicting resources at S5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
+
+Normally resources are evicted on dGPUs at suspend or hibernate and
+on APUs at hibernate.  These steps are unnecessary when using the S4
+callbacks to put the system into S5.
+
+Cc: AceLan Kao <acelan.kao@canonical.com>
+Cc: Kai-Heng Feng <kaihengf@nvidia.com>
+Cc: Mark Pearson <mpearson-lenovo@squebb.ca>
+Cc: Denis Benato <benato.denis96@gmail.com>
+Cc: Merthan Karakaş <m3rthn.k@gmail.com>
+Tested-by: Eric Naim <dnaim@cachyos.org>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 18a0802cb74dc..f18f165876043 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4187,6 +4187,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
+ 	if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU))
+ 		return 0;
+ 
++	/* No need to evict when going to S5 through S4 callbacks */
++	if (system_state == SYSTEM_POWER_OFF)
++		return 0;
++
+ 	ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM);
+ 	if (ret)
+ 		DRM_WARN("evicting device resources failed\n");
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amd-display-add-more-cyan-skillfish-devices.patch b/queue-6.1/drm-amd-display-add-more-cyan-skillfish-devices.patch
new file mode 100644
index 0000000000..d264609d5f
--- /dev/null
+++ b/queue-6.1/drm-amd-display-add-more-cyan-skillfish-devices.patch
@@ -0,0 +1,58 @@
+From c6216e6377504bd6742d221e4fdf7f99cf489103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:10:31 -0400
+Subject: drm/amd/display: add more cyan skillfish devices
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
+
+Add PCI IDs to support display probe for cyan skillfish
+family of SOCs.
+
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
+ drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index f036e9988a0d3..876b70157faa3 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -136,7 +136,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)
+ 
+ 	case FAMILY_NV:
+ 		dc_version = DCN_VERSION_2_0;
+-		if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) {
++		if (asic_id.chip_id == DEVICE_ID_NV_13FE ||
++		    asic_id.chip_id == DEVICE_ID_NV_143F ||
++		    asic_id.chip_id == DEVICE_ID_NV_13F9 ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FA ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FB ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FC ||
++		    asic_id.chip_id == DEVICE_ID_NV_13DB) {
+ 			dc_version = DCN_VERSION_2_01;
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+index c3089c673975b..e044d8589d4f3 100644
+--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+@@ -213,6 +213,11 @@ enum {
+ #endif
+ #define DEVICE_ID_NV_13FE 0x13FE  // CYAN_SKILLFISH
+ #define DEVICE_ID_NV_143F 0x143F
++#define DEVICE_ID_NV_13F9 0x13F9
++#define DEVICE_ID_NV_13FA 0x13FA
++#define DEVICE_ID_NV_13FB 0x13FB
++#define DEVICE_ID_NV_13FC 0x13FC
++#define DEVICE_ID_NV_13DB 0x13DB
+ #define FAMILY_VGH 144
+ #define DEVICE_ID_VGH_163F 0x163F
+ #define DEVICE_ID_VGH_1435 0x1435
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch b/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
new file mode 100644
index 0000000000..08b7203d19
--- /dev/null
+++ b/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
@@ -0,0 +1,37 @@
+From f9216b86d854f5f2e8c4f6119890e67e303302a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:15:45 +0530
+Subject: drm/amd/pm: Use cached metrics data on aldebaran
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
+
+Cached metrics data validity is 1ms on aldebaran. It's not reasonable
+for any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index 1ba1bb4f5bd77..749031d1f4b3c 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1744,7 +1744,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..41e21e6f58
--- /dev/null
+++ b/queue-6.1/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From 4a0cc73501cf8d9a47360dac025055abdc291d07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index ff4447702b125..ff3b2c86b0c1c 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2375,7 +2375,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch b/queue-6.1/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
new file mode 100644
index 0000000000..7dd5780c20
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
@@ -0,0 +1,44 @@
+From 8e15f69aea47234fa10d94ff98a94c966f5c6719 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:21:16 -0400
+Subject: drm/amdgpu: add support for cyan skillfish gpu_info
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
+
+Some SOCs which are part of the cyan skillfish family
+rely on an explicit firmware for IP discovery.  Add support
+for the gpu_info firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 079cf3292f632..18a0802cb74dc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -91,6 +91,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin");
++MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin");
+ 
+ #define AMDGPU_RESUME_MS		2000
+ #define AMDGPU_MAX_RETRY_LIMIT		2
+@@ -2019,6 +2020,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
+ 	case CHIP_NAVI12:
+ 		chip_name = "navi12";
+ 		break;
++	case CHIP_CYAN_SKILLFISH:
++		chip_name = "cyan_skillfish";
++		break;
+ 	}
+ 
+ 	snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_gpu_info.bin", chip_name);
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch b/queue-6.1/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
new file mode 100644
index 0000000000..d133a3d48a
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
@@ -0,0 +1,40 @@
+From 72b291efc6efc6827c748d35f52b3fd5b415d408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:01:32 -0500
+Subject: drm/amdgpu: Allow kfd CRIU with no buffer objects
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
+
+The kfd CRIU checkpoint ioctl would return an error if trying
+to checkpoint a process with no kfd buffer objects.
+
+This is a normal case and should not be an error.
+
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 890c2befe7dce..77af134842feb 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2480,8 +2480,8 @@ static int criu_restore(struct file *filep,
+ 	pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
+ 		 args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
+ 
+-	if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size ||
+-	    !args->num_devices || !args->num_bos)
++	if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
++	    !args->priv_data_size || !args->num_devices)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&p->mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch b/queue-6.1/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
new file mode 100644
index 0000000000..1f1103e113
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
@@ -0,0 +1,42 @@
+From 3aef05cb336bb033a72d269178e8b6426df52c6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:25:09 -0400
+Subject: drm/amdgpu: don't enable SMU on cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
+
+Cyan skillfish uses different SMU firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index d8441e273cb5d..9b1c4d5be61f8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -1669,13 +1669,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
+ 	case IP_VERSION(11, 0, 5):
+ 	case IP_VERSION(11, 0, 9):
+ 	case IP_VERSION(11, 0, 7):
+-	case IP_VERSION(11, 0, 8):
+ 	case IP_VERSION(11, 0, 11):
+ 	case IP_VERSION(11, 0, 12):
+ 	case IP_VERSION(11, 0, 13):
+ 	case IP_VERSION(11, 5, 0):
+ 		amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
+ 		break;
++	case IP_VERSION(11, 0, 8):
++		if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2)
++			amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
++		break;
+ 	case IP_VERSION(12, 0, 0):
+ 	case IP_VERSION(12, 0, 1):
+ 		amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block);
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-6.1/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..018268cc4a
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From 6820e6e69a2eab5777e8ec51058ef167e13a4323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 518eb0e40d32f..d5ae89876a061 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -85,10 +85,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 		fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-reject-gang-submissions-under-sriov.patch b/queue-6.1/drm-amdgpu-reject-gang-submissions-under-sriov.patch
new file mode 100644
index 0000000000..a087edd774
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-reject-gang-submissions-under-sriov.patch
@@ -0,0 +1,52 @@
+From 7cc3013c802fde9923dad743be9222556d909332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 13:14:43 +0200
+Subject: drm/amdgpu: reject gang submissions under SRIOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
+
+Gang submission means that the kernel driver guarantees that multiple
+submissions are executed on the HW at the same time on different engines.
+
+Background is that those submissions then depend on each other and each
+can't finish stand alone.
+
+SRIOV now uses world switch to preempt submissions on the engines to allow
+sharing the HW resources between multiple VFs.
+
+The problem is now that the SRIOV world switch can't know about such inter
+dependencies and will cause a timeout if it waits for a partially running
+gang submission.
+
+To conclude SRIOV and gang submissions are fundamentally incompatible at
+the moment. For now just disable them.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index e0cd6a08ffb27..9ff6a9255c1b1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -279,7 +279,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
+ 		}
+ 	}
+ 
+-	if (!p->gang_size) {
++	if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) {
+ 		ret = -EINVAL;
+ 		goto free_all_kdata;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch b/queue-6.1/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
new file mode 100644
index 0000000000..a9ed9f5919
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
@@ -0,0 +1,114 @@
+From cc3511d53cd2ca93c8d3ffbe3cbc22c8a0a80c2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:50:36 +0200
+Subject: drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
+
+Update the legacy (non-DC) display code to respect the maximum
+pixel clock for HDMI and DVI-D. Reject modes that would require
+a higher pixel clock than can be supported.
+
+Also update the maximum supported HDMI clock value depending on
+the ASIC type.
+
+For reference, see the DC code:
+check max_hdmi_pixel_clock in dce*_resource.c
+
+v2:
+Fix maximum clocks for DVI-D and DVI/HDMI adapters.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/amdgpu_connectors.c    | 57 ++++++++++++++-----
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index cfb262911bfc7..9ec5706d26219 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -1165,29 +1165,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector)
+ 		amdgpu_connector->use_digital = true;
+ }
+ 
++/**
++ * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
++ */
++static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
++{
++	if (adev->asic_type >= CHIP_POLARIS10)
++		return 600000;
++	else if (adev->asic_type >= CHIP_TONGA)
++		return 300000;
++	else
++		return 297000;
++}
++
++/**
++ * Validates the given display mode on DVI and HDMI connectors,
++ * including analog signals on DVI-I.
++ */
+ static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
+ 					    struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
++	const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev);
++	const int max_dvi_single_link_pixel_clock = 165000;
++	int max_digital_pixel_clock_khz;
+ 
+ 	/* XXX check mode bandwidth */
+ 
+-	if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
+-		if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
+-			return MODE_OK;
+-		} else if (connector->display_info.is_hdmi) {
+-			/* HDMI 1.3+ supports max clock of 340 Mhz */
+-			if (mode->clock > 340000)
+-				return MODE_CLOCK_HIGH;
+-			else
+-				return MODE_OK;
+-		} else {
+-			return MODE_CLOCK_HIGH;
++	if (amdgpu_connector->use_digital) {
++		switch (amdgpu_connector->connector_object_id) {
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_A:
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D:
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_B:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2;
++			break;
+ 		}
++
++		/* When the display EDID claims that it's an HDMI display,
++		 * we use the HDMI encoder mode of the display HW,
++		 * so we should verify against the max HDMI clock here.
++		 */
++		if (connector->display_info.is_hdmi)
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++
++		if (mode->clock > max_digital_pixel_clock_khz)
++			return MODE_CLOCK_HIGH;
+ 	}
+ 
+ 	/* check against the max pixel clock */
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch b/queue-6.1/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
new file mode 100644
index 0000000000..a78004d57e
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
@@ -0,0 +1,64 @@
+From 3cbe0240fddb30542d1fed1c21321815704b5465 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 11:44:27 +0100
+Subject: drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
+
+Replace kmalloc_array() + copy_from_user() with memdup_array_user().
+
+This shrinks the source code and improves separation between the kernel
+and userspace slabs.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 25cccd080d977..e0cd6a08ffb27 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1695,30 +1695,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
+ {
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	union drm_amdgpu_wait_fences *wait = data;
+-	uint32_t fence_count = wait->in.fence_count;
+-	struct drm_amdgpu_fence *fences_user;
+ 	struct drm_amdgpu_fence *fences;
+ 	int r;
+ 
+ 	/* Get the fences from userspace */
+-	fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
+-			GFP_KERNEL);
+-	if (fences == NULL)
+-		return -ENOMEM;
+-
+-	fences_user = u64_to_user_ptr(wait->in.fences);
+-	if (copy_from_user(fences, fences_user,
+-		sizeof(struct drm_amdgpu_fence) * fence_count)) {
+-		r = -EFAULT;
+-		goto err_free_fences;
+-	}
++	fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
++				   wait->in.fence_count,
++				   sizeof(struct drm_amdgpu_fence));
++	if (IS_ERR(fences))
++		return PTR_ERR(fences);
+ 
+ 	if (wait->in.wait_all)
+ 		r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
+ 	else
+ 		r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
+ 
+-err_free_fences:
+ 	kfree(fences);
+ 
+ 	return r;
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch b/queue-6.1/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
new file mode 100644
index 0000000000..9fd2f788a2
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
@@ -0,0 +1,43 @@
+From cf30c9db3bc99944ecc44b0a3e222bc142676dd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 14:22:53 -0400
+Subject: drm/amdkfd: fix vram allocation failure for a special case
+
+From: Eric Huang <jinhuieric.huang@amd.com>
+
+[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
+
+When it only allocates vram without va, which is 0, and a
+SVM range allocated stays in this range, the vram allocation
+returns failure. It should be skipped for this case from
+SVM usage check.
+
+Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index c1cb91a79b796..890c2befe7dce 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1067,7 +1067,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
+ 	svm_range_list_lock_and_flush_work(&p->svms, current->mm);
+ 	mutex_lock(&p->svms.lock);
+ 	mmap_write_unlock(current->mm);
+-	if (interval_tree_iter_first(&p->svms.objects,
++
++	/* Skip a special case that allocates VRAM without VA,
++	 * VA will be invalid of 0.
++	 */
++	if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
++	    interval_tree_iter_first(&p->svms.objects,
+ 				     args->va_addr >> PAGE_SHIFT,
+ 				     (args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
+ 		pr_err("Address: 0x%llx already allocated by SVM\n",
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-6.1/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..9991fa520d
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 14c86a2729e189f89762ad0c1c853b1f499e24fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 773913a7d6e90..c1cb91a79b796 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2790,8 +2790,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	int retcode = -EINVAL;
+ 	bool ptrace_attached = false;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -2804,8 +2806,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-6.1/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..eb964300eb
--- /dev/null
+++ b/queue-6.1/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From eed1d023502d9c0e472e2cdc7f04c8ca200aaeb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 3c7d267f2a07b..d1ebae9519d6c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -111,7 +111,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ /*
+  * 512 = 0x200
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-6.1/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..cb3ee1ea94
--- /dev/null
+++ b/queue-6.1/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From 3bdb4e4e20fa785bbb92491fc3c0f457b8e7699a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index 9a12449ad7b87..8eded18ad2ec2 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -364,7 +364,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch b/queue-6.1/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
new file mode 100644
index 0000000000..9296d0db6e
--- /dev/null
+++ b/queue-6.1/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
@@ -0,0 +1,44 @@
+From d6271dd83bfc6bd3f94adde760539f65ad002ef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:44 +0200
+Subject: drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
+
+According to Hardware Programming Guide for DSI PHY, the retime buffer
+resync should be done after PLL clock users (byte_clk and intf_byte_clk)
+are enabled.  Downstream also does it as part of configuring the PLL.
+
+Driver was only turning off the resync FIFO buffer, but never bringing it
+on again.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657823/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 9e7fa7d88ead2..9f2806b9e1740 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -400,6 +400,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+ 	if (pll_7nm->slave)
+ 		dsi_pll_enable_global_clk(pll_7nm->slave);
+ 
++	writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++	if (pll_7nm->slave)
++		writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++
+ error:
+ 	return rc;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch b/queue-6.1/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
new file mode 100644
index 0000000000..7ab005dc8b
--- /dev/null
+++ b/queue-6.1/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
@@ -0,0 +1,54 @@
+From 6cb16541873967f2e2a8e0110c9394533d022ff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:47 +0200
+Subject: drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
+
+Driver unconditionally saves current state on first init in
+dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
+divider registers.  The state is then restored during probe/enable via
+msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
+dsi_7nm_pll_restore_state().
+
+Restoring calls dsi_pll_7nm_vco_set_rate() with
+pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
+VCO and messes with clock hierarchy, by setting frequency to 0 to clock
+tree.  This makes anyway little sense - VCO rate was not saved, so
+should not be restored.
+
+If PLL was not configured configure it to minimum rate to avoid glitches
+and configuring entire in clock hierarchy to 0 Hz.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657827/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 9f2806b9e1740..a44cb48c6db7f 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -752,6 +752,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+ 
+ 	/* TODO: Remove this when we have proper display handover support */
+ 	msm_dsi_phy_pll_save_state(phy);
++	/*
++	 * Store also proper vco_current_rate, because its value will be used in
++	 * dsi_7nm_pll_restore_state().
++	 */
++	if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
++		pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch b/queue-6.1/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
new file mode 100644
index 0000000000..ad2231105f
--- /dev/null
+++ b/queue-6.1/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
@@ -0,0 +1,43 @@
+From b1ea06d2f80b0efe1891205c96df61f6b4d38d78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:06:34 +0200
+Subject: drm/msm: make sure to not queue up recovery more than once
+
+From: Antonino Maniscalco <antomani103@gmail.com>
+
+[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
+
+If two fault IRQs arrive in short succession recovery work will be
+queued up twice.
+
+When recovery runs a second time it may end up killing an unrelated
+context.
+
+Prevent this by masking off interrupts when triggering recovery.
+
+Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670023/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index cdb4665b953c8..e06204e00e935 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1507,6 +1507,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+ 	/* Turn off the hangcheck timer to keep it from bothering us */
+ 	del_timer(&gpu->hangcheck_timer);
+ 
++	/* Turn off interrupts to avoid triggering recovery again */
++	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
++
+ 	kthread_queue_work(gpu->worker, &gpu->recover_work);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-6.1/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..fd4cf25b37
--- /dev/null
+++ b/queue-6.1/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From 8e9a566a9666416cb4c2f12f84fed4b36a030706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch b/queue-6.1/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
new file mode 100644
index 0000000000..b2e1fe05a3
--- /dev/null
+++ b/queue-6.1/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
@@ -0,0 +1,48 @@
+From ef57606c245a6b68220d6948b106c7371bc9bee3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:34:02 +0530
+Subject: drm/tidss: Set crtc modesetting parameters with adjusted mode
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
+
+TIDSS uses crtc_* fields to propagate its registers and set the
+clock rates. So set the CRTC modesetting timing parameters with
+the adjusted mode when needed, to set correct values.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index f33d2b7fc1b7e..b56d0d78edfd2 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -92,7 +92,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 	struct dispc_device *dispc = tidss->dispc;
+ 	struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
+ 	u32 hw_videoport = tcrtc->hw_videoport;
+-	const struct drm_display_mode *mode;
++	struct drm_display_mode *mode;
+ 	enum drm_mode_status ok;
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+@@ -109,6 +109,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 		return -EINVAL;
+ 	}
+ 
++	if (drm_atomic_crtc_needs_modeset(crtc_state))
++		drm_mode_set_crtcinfo(mode, 0);
++
+ 	return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-6.1/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..16a65414ed
--- /dev/null
+++ b/queue-6.1/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From a757ca8b47c10876379d13447fb7a8e84dbf845f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 896a77853ebc5..f33d2b7fc1b7e 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -230,7 +230,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 38b2ae0d7ec1d..0fd79446eaab7 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -981,13 +981,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1029,8 +1029,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-6.1/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..f4eb892604
--- /dev/null
+++ b/queue-6.1/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From 7349d2b81a62ed2dc1c0e9e68e7aad4d0ad6d967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index 93d9df55b361a..01811924c4db4 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-6.1/ethernet-extend-device_get_mac_address-to-use-nvmem.patch b/queue-6.1/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
new file mode 100644
index 0000000000..219fa8ea40
--- /dev/null
+++ b/queue-6.1/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
@@ -0,0 +1,42 @@
+From 6ab9766b2309af5f8ae73058e5fe81dcd87a3888 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:03:32 +0200
+Subject: ethernet: Extend device_get_mac_address() to use NVMEM
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
+
+A lot of modern SoC have the ability to store MAC addresses in their
+NVMEM. So extend the generic function device_get_mac_address() to
+obtain the MAC address from an nvmem cell named 'mac-address' in
+case there is no firmware node which contains the MAC address directly.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethernet/eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 5ba7b460cbf76..1ee90b52f9e06 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -615,7 +615,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);
+  */
+ int device_get_mac_address(struct device *dev, char *addr)
+ {
+-	return fwnode_get_mac_address(dev_fwnode(dev), addr);
++	if (!fwnode_get_mac_address(dev_fwnode(dev), addr))
++		return 0;
++
++	return nvmem_get_mac_address(dev, addr);
+ }
+ EXPORT_SYMBOL(device_get_mac_address);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/exfat-limit-log-print-for-io-error.patch b/queue-6.1/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..106875df52
--- /dev/null
+++ b/queue-6.1/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From 0005e659588d9ea58afe14dea9df54727e408d18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 9fa4cffabfb67..e7e160d022566 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-6.1/ext4-increase-io-priority-of-fastcommit.patch b/queue-6.1/ext4-increase-io-priority-of-fastcommit.patch
new file mode 100644
index 0000000000..5305277084
--- /dev/null
+++ b/queue-6.1/ext4-increase-io-priority-of-fastcommit.patch
@@ -0,0 +1,50 @@
+From 7162f561343281ad12d56ebfd138db6f6d6b3bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:18:12 +0800
+Subject: ext4: increase IO priority of fastcommit
+
+From: Julian Sun <sunjunchao@bytedance.com>
+
+[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
+
+The following code paths may result in high latency or even task hangs:
+   1. fastcommit io is throttled by wbt.
+   2. jbd2_fc_wait_bufs() might wait for a long time while
+JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then
+jbd2_journal_commit_transaction() waits for the
+JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write
+lock of j_state_lock.
+   3. start_this_handle() waits for read lock of j_state_lock which
+results in high latency or task hang.
+
+Given the fact that ext4_fc_commit() already modifies the current
+process' IO priority to match that of the jbd2 thread, it should be
+reasonable to match jbd2's IO submission flags as well.
+
+Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/fast_commit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
+index e2062cd4adadf..94f90032ca561 100644
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star
+ 
+ static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail)
+ {
+-	blk_opf_t write_flags = REQ_SYNC;
++	blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS;
+ 	struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh;
+ 
+ 	/* Add REQ_FUA | REQ_PREFLUSH only its tail */
+-- 
+2.51.0
+
diff --git a/queue-6.1/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-6.1/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..3a406dd925
--- /dev/null
+++ b/queue-6.1/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From 82a6fb4327b71af53c6dc7d5736b81721f85ef20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 0317b614b6805..ea06cd4340525 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-6.1/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..6885159079
--- /dev/null
+++ b/queue-6.1/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 26e28b50f1f6fb1233d2e03d5a75945f37675689 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index e6de83037d62f..226c48aa75b57 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1499,7 +1499,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.1/ftrace-fix-softlockup-in-ftrace_module_enable.patch b/queue-6.1/ftrace-fix-softlockup-in-ftrace_module_enable.patch
new file mode 100644
index 0000000000..46a504f7e8
--- /dev/null
+++ b/queue-6.1/ftrace-fix-softlockup-in-ftrace_module_enable.patch
@@ -0,0 +1,44 @@
+From 74c5f256734cfd34adbdc93e2df486f3280f3ffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 13:28:55 +0200
+Subject: ftrace: Fix softlockup in ftrace_module_enable
+
+From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+
+[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
+
+A soft lockup was observed when loading amdgpu module.
+If a module has a lot of tracable functions, multiple calls
+to kallsyms_lookup can spend too much time in RCU critical
+section and with disabled preemption, causing kernel panic.
+This is the same issue that was fixed in
+commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY
+kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to
+ftrace_graph_set_hash()").
+
+Fix it the same way by adding cond_resched() in ftrace_module_enable.
+
+Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc
+Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index cebed90b2e16f..a46e2f32ee5fc 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7065,6 +7065,8 @@ void ftrace_module_enable(struct module *mod)
+ 		    !within_module_init(rec->ip, mod))
+ 			break;
+ 
++		cond_resched();
++
+ 		/* Weak functions should still be ignored */
+ 		if (!test_for_valid_rec(rec)) {
+ 			/* Clear all other flags. Should not be enabled anyway */
+-- 
+2.51.0
+
diff --git a/queue-6.1/ice-don-t-use-pk-through-printk-or-tracepoints.patch b/queue-6.1/ice-don-t-use-pk-through-printk-or-tracepoints.patch
new file mode 100644
index 0000000000..abcfba729c
--- /dev/null
+++ b/queue-6.1/ice-don-t-use-pk-through-printk-or-tracepoints.patch
@@ -0,0 +1,104 @@
+From 14762e215843b6a1aa3ac049038ffda302ef7046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:43:18 +0200
+Subject: ice: Don't use %pK through printk or tracepoints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c  |  2 +-
+ drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 9be88820b77c3..9a540b85756f4 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -8609,7 +8609,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)
+ 		list_add_tail(&ch->list, &vsi->ch_list);
+ 		vsi->tc_map_vsi[i] = ch->ch_vsi;
+ 		dev_dbg(ice_pf_to_dev(pf),
+-			"successfully created channel: VSI %pK\n", ch->ch_vsi);
++			"successfully created channel: VSI %p\n", ch->ch_vsi);
+ 	}
+ 	return 0;
+ 
+diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
+index ae98d5a8ff60e..ab76d4bb9aea8 100644
+--- a/drivers/net/ethernet/intel/ice/ice_trace.h
++++ b/drivers/net/ethernet/intel/ice/ice_trace.h
+@@ -129,7 +129,7 @@ DECLARE_EVENT_CLASS(ice_tx_template,
+ 				   __entry->buf = buf;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->buf)
+ );
+ 
+@@ -157,7 +157,7 @@ DECLARE_EVENT_CLASS(ice_rx_template,
+ 				   __entry->desc = desc;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc)
+ );
+ DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
+@@ -181,7 +181,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->skb)
+ );
+ 
+@@ -204,7 +204,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname),
++		    TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname),
+ 			      __entry->skb, __entry->ring)
+ );
+ 
+@@ -227,7 +227,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template,
+ 		    TP_fast_assign(__entry->skb = skb;
+ 				   __entry->idx = idx;),
+ 
+-		    TP_printk("skb %pK idx %d",
++		    TP_printk("skb %p idx %d",
+ 			      __entry->skb, __entry->idx)
+ );
+ #define DEFINE_TX_TSTAMP_OP_EVENT(name) \
+-- 
+2.51.0
+
diff --git a/queue-6.1/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-6.1/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..8e09fbb496
--- /dev/null
+++ b/queue-6.1/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From ea945cfc35ba6bd9a5a4ecd8a567438ee748061a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index d93e580b3dc5b..8fda16dd012f7 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&st->lock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-6.1/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-6.1/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..f37ef99baf
--- /dev/null
+++ b/queue-6.1/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From ba549f3d8ff9df7828d6db434cf88467969ecbf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 23804270eda19..12bc854fd177f 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -805,11 +805,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -858,10 +863,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-6.1/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch b/queue-6.1/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
new file mode 100644
index 0000000000..045e8aee53
--- /dev/null
+++ b/queue-6.1/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
@@ -0,0 +1,131 @@
+From 5e0f35669281d22c02156eeb5807433729f05ec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:58 +0800
+Subject: iommu/vt-d: Replace snprintf with scnprintf in
+ dmar_latency_snapshot()
+
+From: Seyediman Seyedarab <ImanDevel@gmail.com>
+
+[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
+
+snprintf() returns the number of bytes that would have been written, not
+the number actually written. Using this for offset tracking can cause
+buffer overruns if truncation occurs.
+
+Replace snprintf() with scnprintf() to ensure the offset stays within
+bounds.
+
+Since scnprintf() never returns a negative value, and zero is not possible
+in this context because 'bytes' starts at 0 and 'size - bytes' is
+DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
+string literals used, the return value is always positive. An integer
+overflow is also completely out of reach here due to the small and fixed
+buffer size. The error check in latency_show_one() is therefore
+unnecessary. Remove it and make dmar_latency_snapshot() return void.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 10 ++--------
+ drivers/iommu/intel/perf.c    | 10 ++++------
+ drivers/iommu/intel/perf.h    |  5 ++---
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index 1f925285104ee..aa9cfcb6039e2 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -562,17 +562,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
+ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
+ 			     struct dmar_drhd_unit *drhd)
+ {
+-	int ret;
+-
+ 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
+ 		   iommu->name, drhd->reg_base_addr);
+ 
+-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+-	if (ret < 0)
+-		seq_puts(m, "Failed to get latency snapshot");
+-	else
+-		seq_puts(m, debug_buf);
+-	seq_puts(m, "\n");
++	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
++	seq_printf(m, "%s\n", debug_buf);
+ }
+ 
+ static int latency_show(struct seq_file *m, void *v)
+diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
+index 94ee70ac38e30..ae64e1123f257 100644
+--- a/drivers/iommu/intel/perf.c
++++ b/drivers/iommu/intel/perf.c
+@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
+ 	"     svm_prq"
+ };
+ 
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+ 	struct latency_statistic *lstat = iommu->perf_statistic;
+ 	unsigned long flags;
+@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 	memset(str, 0, size);
+ 
+ 	for (i = 0; i < COUNTS_NUM; i++)
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "%s", latency_counter_names[i]);
+ 
+ 	spin_lock_irqsave(&latency_lock, flags);
+@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 		if (!dmar_latency_enabled(iommu, i))
+ 			continue;
+ 
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "\n%s", latency_type_names[i]);
+ 
+ 		for (j = 0; j < COUNTS_NUM; j++) {
+@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 				break;
+ 			}
+ 
+-			bytes += snprintf(str + bytes, size - bytes,
++			bytes += scnprintf(str + bytes, size - bytes,
+ 					  "%12lld", val);
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&latency_lock, flags);
+-
+-	return bytes;
+ }
+diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
+index fd6db8049d1a7..1e481e9e4ad04 100644
+--- a/drivers/iommu/intel/perf.h
++++ b/drivers/iommu/intel/perf.h
+@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
+ bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
+ void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
+ 			 u64 latency);
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+ #else
+ static inline int
+ dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
+@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
+ {
+ }
+ 
+-static inline int
++static inline void
+ dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+-	return 0;
+ }
+ #endif /* CONFIG_DMAR_PERF */
+-- 
+2.51.0
+
diff --git a/queue-6.1/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-6.1/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..0b3b2ad3e8
--- /dev/null
+++ b/queue-6.1/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From fdf38c6486ddc2de9ebe09f6669b0ad6da314792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index cbdb510b40ea2..03961f8080757 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -7070,7 +7070,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		.procname	= "ioam6_enabled",
+-- 
+2.51.0
+
diff --git a/queue-6.1/ipv6-np-rxpmtu-race-annotation.patch b/queue-6.1/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..b4b52b434b
--- /dev/null
+++ b/queue-6.1/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From aea9bd10cd655668f35e1301501812931de15ce9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index dc31752a7edcc..c644300680ba6 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -437,7 +437,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 4b063aa37e389..184fc7a5e4d17 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -364,7 +364,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-6.1/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-6.1/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..95fa27a490
--- /dev/null
+++ b/queue-6.1/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From 573d0729ed36a1b9979f44993848a99c1e868a89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index dccc8b3f10459..42fb833ef2834 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-6.1/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-6.1/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..7068a545c3
--- /dev/null
+++ b/queue-6.1/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From b16e15506ad99ff6002cc5b41c3df27777d1e377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index d41891bb617a6..1262b3602cdaf 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-6.1/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch b/queue-6.1/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
new file mode 100644
index 0000000000..001c939662
--- /dev/null
+++ b/queue-6.1/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
@@ -0,0 +1,42 @@
+From 72175fe9bdf43962526156d93c5247e8a3edab1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:12:05 +0900
+Subject: ksmbd: use sock_create_kern interface to create kernel socket
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
+
+we should use sock_create_kern() if the socket resides in kernel space.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_tcp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
+index f07b9e147fe2d..e0719b70c96f8 100644
+--- a/fs/smb/server/transport_tcp.c
++++ b/fs/smb/server/transport_tcp.c
+@@ -469,12 +469,13 @@ static int create_socket(struct interface *iface)
+ 	struct socket *ksmbd_socket;
+ 	bool ipv4 = false;
+ 
+-	ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
++	ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM,
++			IPPROTO_TCP, &ksmbd_socket);
+ 	if (ret) {
+ 		if (ret != -EAFNOSUPPORT)
+ 			pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret);
+-		ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
+-				  &ksmbd_socket);
++		ret = sock_create_kern(current->nsproxy->net_ns, PF_INET,
++				SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+ 		if (ret) {
+ 			pr_err("Can't create socket for ipv4: %d\n", ret);
+ 			goto out_clear;
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-adv7180-add-missing-lock-in-suspend-callback.patch b/queue-6.1/media-adv7180-add-missing-lock-in-suspend-callback.patch
new file mode 100644
index 0000000000..01bd9c3a92
--- /dev/null
+++ b/queue-6.1/media-adv7180-add-missing-lock-in-suspend-callback.patch
@@ -0,0 +1,57 @@
+From 93b6fe38f28123a4111dd942973fe2ad75be09af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:45 +0200
+Subject: media: adv7180: Add missing lock in suspend callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
+
+The adv7180_set_power() utilizes adv7180_write() which in turn requires
+the state mutex to be held, take it before calling adv7180_set_power()
+to avoid tripping a lockdep_assert_held().
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 46912a7b671a8..a7977f9c64c88 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -804,6 +804,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		if (state->field != format->format.field) {
++			guard(mutex)(&state->mutex);
++
+ 			state->field = format->format.field;
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+@@ -1568,6 +1570,8 @@ static int adv7180_suspend(struct device *dev)
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	guard(mutex)(&state->mutex);
++
+ 	return adv7180_set_power(state, false);
+ }
+ 
+@@ -1581,6 +1585,8 @@ static int adv7180_resume(struct device *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	guard(mutex)(&state->mutex);
++
+ 	ret = adv7180_set_power(state, state->powered);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-adv7180-do-not-write-format-to-device-in-set_f.patch b/queue-6.1/media-adv7180-do-not-write-format-to-device-in-set_f.patch
new file mode 100644
index 0000000000..958be4717c
--- /dev/null
+++ b/queue-6.1/media-adv7180-do-not-write-format-to-device-in-set_f.patch
@@ -0,0 +1,50 @@
+From f7890c690d27dab3dad9a7888609538ea5573026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:52 +0200
+Subject: media: adv7180: Do not write format to device in set_fmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
+
+The .set_fmt callback should not write the new format directly do the
+device, it should only store it and have it applied by .s_stream.
+
+The .s_stream callback already calls adv7180_set_field_mode() so it's
+safe to remove programming of the device and just store the format and
+have .s_stream apply it.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index a7977f9c64c88..74356ea06deee 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -803,14 +803,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 	ret = adv7180_mbus_fmt(sd,  &format->format);
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+-		if (state->field != format->format.field) {
+-			guard(mutex)(&state->mutex);
+-
+-			state->field = format->format.field;
+-			adv7180_set_power(state, false);
+-			adv7180_set_field_mode(state);
+-			adv7180_set_power(state, true);
+-		}
++		state->field = format->format.field;
+ 	} else {
+ 		framefmt = v4l2_subdev_get_try_format(sd, sd_state, 0);
+ 		*framefmt = format->format;
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-adv7180-only-validate-format-in-querystd.patch b/queue-6.1/media-adv7180-only-validate-format-in-querystd.patch
new file mode 100644
index 0000000000..c5bdd35229
--- /dev/null
+++ b/queue-6.1/media-adv7180-only-validate-format-in-querystd.patch
@@ -0,0 +1,85 @@
+From 0c9df6fbeff3e505537a2725e7a812ce7ad845c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:54 +0200
+Subject: media: adv7180: Only validate format in querystd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
+
+The .querystd callback should not program the device with the detected
+standard, it should only report the standard to user-space. User-space
+may then use .s_std to set the standard, if it wants to use it.
+
+All that is required of .querystd is to setup the auto detection of
+standards and report its findings.
+
+While at it add some documentation on why this can't happen while
+streaming and improve the error handling using a scoped guard.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 74356ea06deee..5d10edcfcc3b5 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -356,32 +356,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
+ static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int err = mutex_lock_interruptible(&state->mutex);
+-	if (err)
+-		return err;
+-
+-	if (state->streaming) {
+-		err = -EBUSY;
+-		goto unlock;
+-	}
++	int ret;
+ 
+-	err = adv7180_set_video_standard(state,
+-			ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+-	if (err)
+-		goto unlock;
++	guard(mutex)(&state->mutex);
+ 
+-	msleep(100);
+-	__adv7180_status(state, NULL, std);
++	/*
++	 * We can't sample the standard if the device is streaming as that would
++	 * interfere with the capture session as the VID_SEL reg is touched.
++	 */
++	if (state->streaming)
++		return -EBUSY;
+ 
+-	err = v4l2_std_to_adv7180(state->curr_norm);
+-	if (err < 0)
+-		goto unlock;
++	/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
++	ret = adv7180_set_video_standard(state,
++					 ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
++	if (ret)
++		return ret;
+ 
+-	err = adv7180_set_video_standard(state, err);
++	/* Allow some time for the autodetection to run. */
++	msleep(100);
+ 
+-unlock:
+-	mutex_unlock(&state->mutex);
+-	return err;
++	return __adv7180_status(state, NULL, std);
+ }
+ 
+ static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch b/queue-6.1/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
new file mode 100644
index 0000000000..c20c06f2d8
--- /dev/null
+++ b/queue-6.1/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
@@ -0,0 +1,91 @@
+From c4119bdbbd4d815156df91f403d31cc5682d8eea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:56 +0300
+Subject: media: amphion: Delete v4l2_fh synchronously in .release()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
+
+The v4l2_fh initialized and added in vpu_v4l2_open() is delete and
+cleaned up when the last reference to the vpu_inst is released. This may
+happen later than at vpu_v4l2_close() time.
+
+Not deleting and cleaning up the v4l2_fh when closing the file handle to
+the video device is not ideal, as the v4l2_fh will still be present in
+the video device's fh_list, and will store a copy of events queued to
+the video device. There may also be other side effects of keeping alive
+an object that represents an open file handle after the file handle is
+closed.
+
+The v4l2_fh instance is embedded in the vpu_inst structure, and is
+accessed in two different ways:
+
+- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2
+  events to the file handle ; and
+
+- through the driver to access the v4l2_fh.m2m_ctx pointer.
+
+The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and
+v4l2_fh_exit(). It is set to NULL by the driver when closing the file
+handle, in vpu_v4l2_close().
+
+The vpu_notify_eos() and vpu_notify_source_change() functions are called
+in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change()
+respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is
+therefore a guarantee that no new event will be queued to the v4l2_fh
+after vpu_v4l2_close() destroys the m2m_ctx.
+
+The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(),
+which is guaranteed to be called for all queued buffers when
+vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called
+later.
+
+It is therefore safe to assume that the driver will not touch the
+v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close()
+destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh
+synchronously in vpu_v4l2_close().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index 19189d7449dc8..30aebefddc9c9 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -608,8 +608,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)
+ 
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ 	mutex_destroy(&inst->lock);
+-	v4l2_fh_del(&inst->fh);
+-	v4l2_fh_exit(&inst->fh);
+ 
+ 	call_void_vop(inst, cleanup);
+ 
+@@ -678,6 +676,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
+ 
+ 	return 0;
+ error:
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
+ 	vpu_inst_put(inst);
+ 	return ret;
+ }
+@@ -697,6 +697,9 @@ int vpu_v4l2_close(struct file *file)
+ 	call_void_vop(inst, release);
+ 	vpu_inst_unlock(inst);
+ 
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
++
+ 	vpu_inst_unregister(inst);
+ 	vpu_inst_put(inst);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-fix-uninitialized-symbol-warnings.patch b/queue-6.1/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..f91294a511
--- /dev/null
+++ b/queue-6.1/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 04a020d35f6ddc415035674ddcda8d57afa2009f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index 25bf1132dbff8..fce54c8dad3e4 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 29bc63021c5aa..6fb3550811a28 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch b/queue-6.1/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
new file mode 100644
index 0000000000..0e457de6fb
--- /dev/null
+++ b/queue-6.1/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
@@ -0,0 +1,42 @@
+From c346bb3202335e7971d836c6edcc852e58a50a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 15:23:56 +0200
+Subject: media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for
+ VIDEO_CAMERA_SENSOR
+
+From: Mehdi Djait <mehdi.djait@linux.intel.com>
+
+[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
+
+Both ACPI and DT-based systems are required to obtain the external
+camera sensor clock using the new devm_v4l2_sensor_clk_get() helper
+function.
+
+Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is
+enabled.
+
+Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index a34afb5217ebc..5c7ca13210871 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -27,7 +27,7 @@ config VIDEO_IR_I2C
+ 
+ menuconfig VIDEO_CAMERA_SENSOR
+ 	bool "Camera sensor devices"
+-	depends on MEDIA_CAMERA_SUPPORT && I2C
++	depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK
+ 	select MEDIA_CONTROLLER
+ 	select V4L2_FWNODE
+ 	select VIDEO_V4L2_SUBDEV_API
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch b/queue-6.1/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
new file mode 100644
index 0000000000..cebc31d969
--- /dev/null
+++ b/queue-6.1/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
@@ -0,0 +1,59 @@
+From f3eb2a6ce84fd7f0f816905fe5c1e966b7fe2d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 16:22:06 +0300
+Subject: media: i2c: og01a1b: Specify monochrome media bus format instead of
+ Bayer
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
+
+The OmniVision OG01A1B image sensor is a monochrome sensor, it supports
+8-bit and 10-bit RAW output formats only.
+
+That said the planar greyscale Y8/Y10 media formats are more appropriate
+for the sensor instead of the originally and arbitrary selected SGRBG one,
+since there is no red, green or blue color components.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/og01a1b.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
+index 35663c10fcd9f..0ceb46d947a16 100644
+--- a/drivers/media/i2c/og01a1b.c
++++ b/drivers/media/i2c/og01a1b.c
+@@ -676,7 +676,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode,
+ {
+ 	fmt->width = mode->width;
+ 	fmt->height = mode->height;
+-	fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->code = MEDIA_BUS_FMT_Y10_1X10;
+ 	fmt->field = V4L2_FIELD_NONE;
+ }
+ 
+@@ -867,7 +867,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = MEDIA_BUS_FMT_Y10_1X10;
+ 
+ 	return 0;
+ }
+@@ -879,7 +879,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,
+ 	if (fse->index >= ARRAY_SIZE(supported_modes))
+ 		return -EINVAL;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = supported_modes[fse->index].width;
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-imon-make-send_packet-more-robust.patch b/queue-6.1/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..27f527bdd2
--- /dev/null
+++ b/queue-6.1/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 0101efc85f600b8e4c0d74d4df5f4531b4efec03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index f4deca8894e0f..bb4aabb08c06e 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-6.1/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..b00fc834ab
--- /dev/null
+++ b/queue-6.1/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From 8de833a32afd526f7b5f9c4fcb34b6b5dd2b1104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index ce3a7ca51736e..df2dcef1af3f0 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -322,6 +322,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -331,7 +332,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 4202c3a47d33e..7ed0d2d85253e 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-6.1/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..6dd7e940cb
--- /dev/null
+++ b/queue-6.1/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From 76a0c20d1df6c6feecdb832591a7503a5f546239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index 9f2947af33aa7..880981e1c507e 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-6.1/media-verisilicon-explicitly-disable-selection-api-i.patch b/queue-6.1/media-verisilicon-explicitly-disable-selection-api-i.patch
new file mode 100644
index 0000000000..b1551ffe0e
--- /dev/null
+++ b/queue-6.1/media-verisilicon-explicitly-disable-selection-api-i.patch
@@ -0,0 +1,64 @@
+From 4c947c3005e456cdf22d8a3d9166516082f634a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:49:18 +0200
+Subject: media: verisilicon: Explicitly disable selection api ioctls for
+ decoders
+
+From: Paul Kocialkowski <paulk@sys-base.io>
+
+[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
+
+Call the dedicated v4l2_disable_ioctl helper instead of manually
+checking whether the current context is an encoder for the selection
+api ioctls.
+
+Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index 69a2442f31223..a35b6ae62d585 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -819,6 +819,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+ 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION);
+ 	}
+ 
+ 	video_set_drvdata(vfd, vpu);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index b2da48936e3f1..31ae6750321c4 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -629,8 +629,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
+ 	struct hantro_ctx *ctx = fh_to_ctx(priv);
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	switch (sel->target) {
+@@ -662,8 +661,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
+ 	struct vb2_queue *vq;
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	/* Change not allowed if the queue is streaming. */
+-- 
+2.51.0
+
diff --git a/queue-6.1/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-6.1/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..6d72b725a2
--- /dev/null
+++ b/queue-6.1/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From dcceddde840a925a116300c4098b1a38a3096d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index ff6ff9568e1bc..1a5f4faa0831f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -105,6 +105,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.1/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-6.1/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..dc18263b27
--- /dev/null
+++ b/queue-6.1/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From f88edaed1e6ff3eee572baf5b6204f59f11c4260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 510be63c8bdf1..ff6ff9568e1bc 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/mips-lantiq-danube-add-model-to-easy50712-dts.patch b/queue-6.1/mips-lantiq-danube-add-model-to-easy50712-dts.patch
new file mode 100644
index 0000000000..905ecaf538
--- /dev/null
+++ b/queue-6.1/mips-lantiq-danube-add-model-to-easy50712-dts.patch
@@ -0,0 +1,36 @@
+From fa185ee6cb332016c387f3f170c0d618c5aebd9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:06:04 +0200
+Subject: mips: lantiq: danube: add model to EASY50712 dts
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
+	from schema $id: http://devicetree.org/schemas/root-node.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index c4d7aa5753b04..ab70028dbefcf 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -4,6 +4,8 @@
+ /include/ "danube.dtsi"
+ 
+ / {
++	model = "Intel EASY50712";
++
+ 	chosen {
+ 		bootargs = "console=ttyLTQ0,115200 init=/etc/preinit";
+ 	};
+-- 
+2.51.0
+
diff --git a/queue-6.1/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch b/queue-6.1/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
new file mode 100644
index 0000000000..53a08593fb
--- /dev/null
+++ b/queue-6.1/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
@@ -0,0 +1,36 @@
+From a443be23e1bb5cfb798549f4012caf01c3255b04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:24 +0200
+Subject: mips: lantiq: danube: rename stp node on EASY50712 reference board
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
+	from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index ab70028dbefcf..c9f7886f57b8c 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -96,7 +96,7 @@
+ 			lantiq,tx-burst-length = <4>;
+ 		};
+ 
+-		stp0: stp@e100bb0 {
++		stp0: gpio@e100bb0 {
+ 			#gpio-cells = <2>;
+ 			compatible = "lantiq,gpio-stp-xway";
+ 			gpio-controller;
+-- 
+2.51.0
+
diff --git a/queue-6.1/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-6.1/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..e291848d6d
--- /dev/null
+++ b/queue-6.1/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From 8e102d96a5d7a39f4167d8ea7776d43df9607555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index edf914393ad96..bcda4fa9fc87c 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -467,7 +467,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch b/queue-6.1/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
new file mode 100644
index 0000000000..9e662348a3
--- /dev/null
+++ b/queue-6.1/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
@@ -0,0 +1,82 @@
+From 671a2b4e55cf9fc90cca1ea5d5a172580471ea91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:14:48 +0200
+Subject: net: bridge: Install FDB for bridge MAC on VLAN 0
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
+
+Currently, after the bridge is created, the FDB does not hold an FDB entry
+for the bridge MAC on VLAN 0:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb show | grep 92:19:8c:4e:01:ed
+ 92:19:8c:4e:01:ed dev br vlan 1 master br permanent
+
+Later when the bridge MAC is changed, or in fact when the address is given
+during netdevice creation, the entry appears:
+
+ # ip link add name br up address 00:11:22:33:44:55 type bridge
+ # bridge fdb show | grep 00:11:22:33:44:55
+ 00:11:22:33:44:55 dev br vlan 1 master br permanent
+ 00:11:22:33:44:55 dev br master br permanent
+
+However when the bridge address is set by the user to the current bridge
+address before the first port is enslaved, none of the address handlers
+gets invoked, because the address is not actually changed. The address is
+however marked as NET_ADDR_SET. Then when a port is enslaved, the address
+is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not
+added, and it has not been added previously either:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # ip link set dev br addr 7e:f0:a8:1a:be:c2
+ # ip link add name v up type veth
+ # ip link set dev v master br
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb | grep 7e:f0:a8:1a:be:c2
+ 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
+
+Then when the bridge MAC is used as DMAC, and br_handle_frame_finish()
+looks up an FDB entry with VLAN=0, it doesn't find any, and floods the
+traffic instead of passing it up.
+
+Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always
+on netdevice creation. This also makes the behavior consistent with how
+ports are treated: ports always have an FDB entry for each member VLAN as
+well as VLAN 0.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index 96e91d69a9a88..9341b5f51f0dd 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
+ 	int err;
+ 
+ 	if (netif_is_bridge_master(dev)) {
++		struct net_bridge *br = netdev_priv(dev);
++
++		if (event == NETDEV_REGISTER)
++			br_fdb_change_mac_address(br, dev->dev_addr);
++
+ 		err = br_vlan_bridge_event(dev, event, ptr);
+ 		if (err)
+ 			return notifier_from_errno(err);
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-6.1/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..300a45fe0d
--- /dev/null
+++ b/queue-6.1/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From 147a027ec83be6fbabc5ce7f666e94745f4dc219 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1c4d225e93290..7702033680e7b 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2930,23 +2930,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-6.1/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..e1ce1ba693
--- /dev/null
+++ b/queue-6.1/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From bb09e0b8c5d716d93f655f1cbf9d0e2f0d00df02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index d4de3c01bdb67..1c4d225e93290 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3075,8 +3075,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 		}
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-6.1/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..917e431ba6
--- /dev/null
+++ b/queue-6.1/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From 0727f7a1f7d3a59acfa71d9a3ae21b61f5f5390f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-ethernet-microchip-sparx5-make-it-selectable-for.patch b/queue-6.1/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
new file mode 100644
index 0000000000..2e7fbf0526
--- /dev/null
+++ b/queue-6.1/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
@@ -0,0 +1,37 @@
+From 12cd76dae09ac91214da08f72cd4d9dd34f09814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 13:00:24 +0200
+Subject: net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
+
+LAN969x switchdev support depends on the SparX-5 core,so make it selectable
+for ARCH_LAN969X.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index cc5e48e1bb4c3..a66a80e297f17 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -3,7 +3,7 @@ config SPARX5_SWITCH
+ 	depends on NET_SWITCHDEV
+ 	depends on HAS_IOMEM
+ 	depends on OF
+-	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
+ 	depends on PTP_1588_CLOCK_OPTIONAL
+ 	depends on BRIDGE || BRIDGE=n
+ 	select PHYLINK
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-6.1/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..7c5ce17abd
--- /dev/null
+++ b/queue-6.1/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From 44d96ab8865c1bc2f9eb221353655874e978aa80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index af1b0cde36703..8fb99fa7ae600 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index dc8ccd378ec92..6a3aebd56e6c4 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-6.1/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..7403dd17b9
--- /dev/null
+++ b/queue-6.1/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From f8131642e4c5c7fdbba8e0be0855278889b75fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 5228d27162893..151d8d98d0463 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -304,13 +332,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -381,12 +403,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -437,13 +455,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-6.1/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..b8fb4aed22
--- /dev/null
+++ b/queue-6.1/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From 9ce8a458fcde5314f68409f905a40e87bd0fb3c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index 1ea7c86f75013..a143f8214c088 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -283,9 +283,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	if (gem_has_ptp(bp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch b/queue-6.1/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
new file mode 100644
index 0000000000..fe52a981e3
--- /dev/null
+++ b/queue-6.1/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
@@ -0,0 +1,66 @@
+From eaa2effaeb09f41d21e0dc8b9cf6a8553ae4451c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 12:40:34 +0000
+Subject: net/mlx5e: Don't query FEC statistics when FEC is disabled
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
+
+Update mlx5e_stats_fec_get() to check the active FEC mode and skip
+statistics collection when FEC is disabled.
+
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Yael Chemla <ychemla@nvidia.com>
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index f7f54550a8bbc..5db4fd40fe8b8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -1301,16 +1301,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt)
+ }
+ 
+ static void fec_set_block_stats(struct mlx5e_priv *priv,
++				int mode,
+ 				struct ethtool_fec_stats *fec_stats)
+ {
+ 	struct mlx5_core_dev *mdev = priv->mdev;
+ 	u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+-	int mode = fec_active_mode(mdev);
+-
+-	if (mode == MLX5E_FEC_NOFEC)
+-		return;
+ 
+ 	MLX5_SET(ppcnt_reg, in, local_port, 1);
+ 	MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP);
+@@ -1351,11 +1348,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,
+ void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
+ 			 struct ethtool_fec_stats *fec_stats)
+ {
+-	if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
++	int mode = fec_active_mode(priv->mdev);
++
++	if (mode == MLX5E_FEC_NOFEC ||
++	    !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
+ 		return;
+ 
+ 	fec_set_corrected_bits_total(priv, fec_stats);
+-	fec_set_block_stats(priv, fec_stats);
++	fec_set_block_stats(priv, mode, fec_stats);
+ }
+ 
+ #define PPORT_ETH_EXT_OFF(c) \
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-6.1/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..fe5aa962e5
--- /dev/null
+++ b/queue-6.1/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From 5646a758f39981ebaa22f1ddf5cd8abf497b67d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index ea8595651c384..e066bdbc807be 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch b/queue-6.1/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
new file mode 100644
index 0000000000..ff61426378
--- /dev/null
+++ b/queue-6.1/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
@@ -0,0 +1,74 @@
+From 975bc8ce665535cb795389a0297474ac15090399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 23:25:05 +0200
+Subject: net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
+
+fixed_phy_register() creates and registers the phy_device. To be
+symmetric, we should not only unregister, but also free the phy_device
+in fixed_phy_unregister(). This allows to simplify code in users.
+
+Note wrt of_phy_deregister_fixed_link():
+put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/dsa_loop.c  | 9 +++------
+ drivers/net/mdio/of_mdio.c  | 1 -
+ drivers/net/phy/fixed_phy.c | 1 +
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index 5b139f2206b6e..48cf9d300bbf5 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -378,13 +378,10 @@ static struct mdio_driver dsa_loop_drv = {
+ 
+ static void dsa_loop_phydevs_unregister(void)
+ {
+-	unsigned int i;
+-
+-	for (i = 0; i < NUM_FIXED_PHYS; i++)
+-		if (!IS_ERR(phydevs[i])) {
++	for (int i = 0; i < NUM_FIXED_PHYS; i++) {
++		if (!IS_ERR(phydevs[i]))
+ 			fixed_phy_unregister(phydevs[i]);
+-			phy_device_free(phydevs[i]);
+-		}
++	}
+ }
+ 
+ static int __init dsa_loop_init(void)
+diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
+index 1e46e39f5f46a..6444f77931708 100644
+--- a/drivers/net/mdio/of_mdio.c
++++ b/drivers/net/mdio/of_mdio.c
+@@ -440,6 +440,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)
+ 	fixed_phy_unregister(phydev);
+ 
+ 	put_device(&phydev->mdio.dev);	/* of_phy_find_device() */
+-	phy_device_free(phydev);	/* fixed_phy_register() */
+ }
+ EXPORT_SYMBOL(of_phy_deregister_fixed_link);
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index aef739c20ac4d..4694fb3eaa2ff 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy)
+ 	phy_device_remove(phy);
+ 	of_node_put(phy->mdio.dev.of_node);
+ 	fixed_phy_del(phy->mdio.addr);
++	phy_device_free(phy);
+ }
+ EXPORT_SYMBOL_GPL(fixed_phy_unregister);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-6.1/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..4fd54ef51a
--- /dev/null
+++ b/queue-6.1/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From cf2a98813a86a2d722f435df77f67048d231a973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 0d706ee266afd..339285690dd4c 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1798,6 +1798,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -3174,7 +3211,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.handle_interrupt = marvell_handle_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-6.1/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..b2c5306152
--- /dev/null
+++ b/queue-6.1/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From d9824298526973a0e87bd179ccd3b0a9e17d5c24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 5f4297e83aafe..6d66ce207fb44 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-6.1/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..4ec61ce42e
--- /dev/null
+++ b/queue-6.1/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From 9eeba04c58f890c5e07ffcc6d3435ec0592d45f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index be84aed471603..03fbb611b2a67 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7589,7 +7589,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv, &priv->dma_conf);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	stmmac_set_rx_mode(ndev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-6.1/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..f6cb29f08e
--- /dev/null
+++ b/queue-6.1/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From 2e35b703058d32f756be78d690ad49f05efff915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index c0f9d125f401c..10cb365639aaa 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -1812,6 +1812,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch b/queue-6.1/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
new file mode 100644
index 0000000000..e79da5d219
--- /dev/null
+++ b/queue-6.1/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
@@ -0,0 +1,129 @@
+From 49abfe6feb2a1a35f6655e9ff3d4287e1f67abd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:01:02 +0200
+Subject: netfilter: nf_reject: don't reply to icmp error messages
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
+
+tcp reject code won't reply to a tcp reset.
+
+But the icmp reject 'netdev' family versions will reply to icmp
+dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
+by the inet family implementation (and internally by the REJECT target).
+
+Check for the icmp(6) type and do not respond if its an unreachable error.
+
+Without this, something like 'ip protocol icmp reject', when used
+in a netdev chain attached to 'lo', cause a packet loop.
+
+Same for two hosts that both use such a rule: each error packet
+will be replied to.
+
+Such situation persist until the (bogus) rule is amended to ratelimit or
+checks the icmp type before the reject statement.
+
+As the inet versions don't do this make the netdev ones follow along.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
+ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index 2d663fe50f876..2064b40130412 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+ 
++static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
++{
++	const struct iphdr *iph = ip_hdr(skb);
++	u8 *tp, _type;
++	int thoff;
++
++	if (iph->protocol != IPPROTO_ICMP)
++		return false;
++
++	thoff = skb_network_offset(skb) + sizeof(*iph);
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmphdr, type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMP_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+ 		return NULL;
+ 
++	/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
++	if (nf_skb_is_icmp_unreach(oldskb))
++		return NULL;
++
+ 	/* RFC says return as much as we can without exceeding 576 bytes. */
+ 	len = min_t(unsigned int, 536, oldskb->len);
+ 
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index f3579bccf0a51..a19ca1907de36 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+ 
++static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
++{
++	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
++	u8 proto = ip6h->nexthdr;
++	u8 _type, *tp;
++	int thoff;
++	__be16 fo;
++
++	thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
++
++	if (thoff < 0 || thoff >= skb->len || fo != 0)
++		return false;
++
++	if (proto != IPPROTO_ICMPV6)
++		return false;
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmp6hdr, icmp6_type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMPV6_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 	if (!nf_reject_ip6hdr_validate(oldskb))
+ 		return NULL;
+ 
++	/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
++	if (nf_skb_is_icmp6_unreach(oldskb))
++		return NULL;
++
+ 	/* Include "As much of invoking packet as possible without the ICMPv6
+ 	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.1/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-6.1/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..132e93b204
--- /dev/null
+++ b/queue-6.1/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From b9cd6dcd2e5e8489ca35ad48dd85fe5bafc4c609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 935ca3845ce53..f387a3862ca09 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -362,7 +362,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-6.1/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-6.1/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..65da399a4a
--- /dev/null
+++ b/queue-6.1/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From f7bc8e60b13776ac1d67ecd39dd700dc56816f00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index cbcff4603232b..935ca3845ce53 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7663,10 +7663,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-6.1/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..4513f612d6
--- /dev/null
+++ b/queue-6.1/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From 5b58424aafea17cdb73f1594677506790707f842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 80a7c5bd7a476..c30c6dbbf9254 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2742,6 +2742,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.1/ntfs3-pretend-extend-records-as-regular-files.patch b/queue-6.1/ntfs3-pretend-extend-records-as-regular-files.patch
new file mode 100644
index 0000000000..6d83240a72
--- /dev/null
+++ b/queue-6.1/ntfs3-pretend-extend-records-as-regular-files.patch
@@ -0,0 +1,37 @@
+From 11a34c7b9421c6d35374b92e3e45e072529dadf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:43:24 +0900
+Subject: ntfs3: pretend $Extend records as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 844113c3175c9..accff95baa847 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -456,6 +456,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ 		   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
+ 		/* Records in $Extend are not a files or general directories. */
+ 		inode->i_op = &ntfs_file_inode_operations;
++		mode = S_IFREG;
+ 	} else {
+ 		err = -EINVAL;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-6.1/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-6.1/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..096fdd4ef4
--- /dev/null
+++ b/queue-6.1/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From 11d3ef23ec28c854f5e4488d38677fff6958bc5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index 9a5b757fbd2f6..2d2d16caf9190 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch b/queue-6.1/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
new file mode 100644
index 0000000000..048f69806b
--- /dev/null
+++ b/queue-6.1/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
@@ -0,0 +1,43 @@
+From 4bdb4de0030587fb01a82ad0418c6142420cc327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:17:03 -0700
+Subject: page_pool: always add GFP_NOWARN for ATOMIC allocations
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
+
+Driver authors often forget to add GFP_NOWARN for page allocation
+from the datapath. This is annoying to users as OOMs are a fact
+of life, and we pretty much expect network Rx to hit page allocation
+failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
+by default.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index acc1d0d055cdd..8ce34d1c2e076 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -405,6 +405,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool,
+ 	struct page *page;
+ 	int i, nr_pages;
+ 
++	/* Unconditionally set NOWARN if allocating from NAPI.
++	 * Drivers forget to set it, and OOM reports on packet Rx are useless.
++	 */
++	if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
++		gfp |= __GFP_NOWARN;
++
+ 	/* Don't support bulk alloc for high-order pages */
+ 	if (unlikely(pp_order))
+ 		return __page_pool_alloc_page_order(pool, gfp);
+-- 
+2.51.0
+
diff --git a/queue-6.1/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-6.1/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..b7c4a82736
--- /dev/null
+++ b/queue-6.1/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 38a13c869341761c53e196060be65c472dbeb164 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 8ce34d1c2e076..5c66092f95801 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -168,11 +168,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-6.1/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-6.1/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..0c8575283d
--- /dev/null
+++ b/queue-6.1/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From 2861954cc72513c85c4b9f770712d99847028c80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 0a1b11d41a38a..d2c8d5e0882a5 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 13c4032ca379a..ddf893fb8e164 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 2891e8c16a592..ff5ee5c787fbc 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -494,7 +494,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -502,13 +502,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.1/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-6.1/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..0542e6b0d0
--- /dev/null
+++ b/queue-6.1/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 34aec2bc58dc52f7042b6f18a656ae97ed592157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f4932d2f9f973..0772ce28cba41 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2604,6 +2604,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-6.1/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-6.1/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..376a32f5ff
--- /dev/null
+++ b/queue-6.1/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From b6b7b0ca3de6fe72890a85688d9ff044192b6145 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 88dc66ee1c467..d5e38c6a812f0 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -225,7 +225,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-6.1/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch b/queue-6.1/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
new file mode 100644
index 0000000000..7c0ba02524
--- /dev/null
+++ b/queue-6.1/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
@@ -0,0 +1,60 @@
+From 12377ed9ceb3fc7bdb965dddff05f39a6febdbd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 22:19:15 -0500
+Subject: PCI/PM: Skip resuming to D0 if device is disconnected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
+
+When a device is surprise-removed (e.g., due to a dock unplug), the PCI
+core unconfigures all downstream devices and sets their error state to
+pci_channel_io_perm_failure. This marks them as disconnected via
+pci_dev_is_disconnected().
+
+During device removal, the runtime PM framework may attempt to resume the
+device to D0 via pm_runtime_get_sync(), which calls into pci_power_up().
+Since the device is already disconnected, this resume attempt is
+unnecessary and results in a predictable errors like this, typically when
+undocking from a TBT3 or USB4 dock with PCIe tunneling:
+
+  pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
+
+Avoid powering up disconnected devices by checking their status early in
+pci_power_up() and returning -EIO.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+[bhelgaas: add typical message]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index d0e587ab23c6b..b4692c3f98d3b 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1227,6 +1227,11 @@ int pci_power_up(struct pci_dev *dev)
+ 		return -EIO;
+ 	}
+ 
++	if (pci_dev_is_disconnected(dev)) {
++		dev->current_state = PCI_D3cold;
++		return -EIO;
++	}
++
+ 	pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+ 	if (PCI_POSSIBLE_ERROR(pmcsr)) {
+ 		pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
+-- 
+2.51.0
+
diff --git a/queue-6.1/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-6.1/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..4db82b8188
--- /dev/null
+++ b/queue-6.1/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 40e27aa830d06f35315676b56307b3cc0b31864f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index d65a7aeefe792..565f281b36eaf 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -146,7 +146,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -156,6 +156,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-6.1/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch b/queue-6.1/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
new file mode 100644
index 0000000000..7d253c4276
--- /dev/null
+++ b/queue-6.1/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
@@ -0,0 +1,55 @@
+From 2960f284b93a4a2c560967596da4434bc37c3afc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:04:52 +0200
+Subject: phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
+ register 0
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
+
+The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
+value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
+this offset is perfectly fine (in fact, register 0 is the only one in
+this register file).
+Introduce a boolean variable to indicate valid registers and allow writes
+to register 0.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+index 75f948bdea6a1..20737a0400f5c 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+@@ -87,10 +87,11 @@ struct dphy_reg {
+ 	u32 offset;
+ 	u32 mask;
+ 	u32 shift;
++	u8 valid;
+ };
+ 
+ #define PHY_REG(_offset, _width, _shift) \
+-	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
++	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
+ 
+ static const struct dphy_reg rk1808_grf_dphy_regs[] = {
+ 	[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
+@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
+ 	const struct dphy_drv_data *drv_data = priv->drv_data;
+ 	const struct dphy_reg *reg = &drv_data->grf_regs[index];
+ 
+-	if (reg->offset)
++	if (reg->valid)
+ 		regmap_write(priv->grf, reg->offset,
+ 			     HIWORD_UPDATE(value, reg->mask, reg->shift));
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-6.1/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..32bab5b64a
--- /dev/null
+++ b/queue-6.1/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From fd3cd7cac131af55f4f8084d4a1a0e776160444a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 429abaecad416..9a761f46c7b23 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/ptp-limit-time-setting-of-ptp-clocks.patch b/queue-6.1/ptp-limit-time-setting-of-ptp-clocks.patch
new file mode 100644
index 0000000000..4994a4cbdc
--- /dev/null
+++ b/queue-6.1/ptp-limit-time-setting-of-ptp-clocks.patch
@@ -0,0 +1,81 @@
+From 1fe59f0a50f87add0e32ba398f8bb0d372bec4cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:32:53 +0200
+Subject: ptp: Limit time setting of PTP clocks
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
+
+Networking drivers implementing PTP clocks and kernel socket code
+handling hardware timestamps use the 64-bit signed ktime_t type counting
+nanoseconds. When a PTP clock reaches the maximum value in year 2262,
+the timestamps returned to applications will overflow into year 1667.
+The same thing happens when injecting a large offset with
+clock_adjtime(ADJ_SETOFFSET).
+
+The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
+CLOCK_REALTIME") limited the maximum accepted value setting the system
+clock to 30 years before the maximum representable value (i.e. year
+2232) to avoid the overflow, assuming the system will not run for more
+than 30 years.
+
+Enforce the same limit for PTP clocks. Don't allow negative values and
+values closer than 30 years to the maximum value. Drivers may implement
+an even lower limit if the hardware registers cannot represent the whole
+interval between years 1970 and 2262 in the required resolution.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <jstultz@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index e6bcccf87cd6a..850ae55596850 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ 		return -EBUSY;
+ 	}
+ 
++	if (!timespec64_valid_settod(tp))
++		return -EINVAL;
++
+ 	return  ptp->info->settime64(ptp->info, tp);
+ }
+ 
+@@ -113,7 +116,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 	ops = ptp->info;
+ 
+ 	if (tx->modes & ADJ_SETOFFSET) {
+-		struct timespec64 ts;
++		struct timespec64 ts, ts2;
+ 		ktime_t kt;
+ 		s64 delta;
+ 
+@@ -126,6 +129,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 		if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
+ 			return -EINVAL;
+ 
++		/* Make sure the offset is valid */
++		err = ptp_clock_gettime(pc, &ts2);
++		if (err)
++			return err;
++		ts2 = timespec64_add(ts2, ts);
++		if (!timespec64_valid_settod(&ts2))
++			return -EINVAL;
++
+ 		kt = timespec64_to_ktime(ts);
+ 		delta = ktime_to_ns(kt);
+ 		err = ops->adjtime(ops, delta);
+-- 
+2.51.0
+
diff --git a/queue-6.1/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-6.1/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..938a2b62e3
--- /dev/null
+++ b/queue-6.1/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From 0c83c038df6d0431b04fe32e6c4cd52a3b1204ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 6879660e44fad..29f4695606ca1 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3354,7 +3354,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3468,7 +3468,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3666,7 +3666,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
+-- 
+2.51.0
+
diff --git a/queue-6.1/rdma-irdma-update-kconfig.patch b/queue-6.1/rdma-irdma-update-kconfig.patch
new file mode 100644
index 0000000000..03f080f7fb
--- /dev/null
+++ b/queue-6.1/rdma-irdma-update-kconfig.patch
@@ -0,0 +1,42 @@
+From 9f66727edfb0d5a09a72a12e60969ed662f9e4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:25:45 -0500
+Subject: RDMA/irdma: Update Kconfig
+
+From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+
+[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
+
+Update Kconfig to add dependency on idpf module and
+add IPU E2000 to the list of supported devices.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com
+Tested-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/Kconfig b/drivers/infiniband/hw/irdma/Kconfig
+index b6f9c41bca51d..41660203e0049 100644
+--- a/drivers/infiniband/hw/irdma/Kconfig
++++ b/drivers/infiniband/hw/irdma/Kconfig
+@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA
+ 	depends on INET
+ 	depends on IPV6 || !IPV6
+ 	depends on PCI
+-	depends on ICE && I40E
++	depends on IDPF && ICE && I40E
+ 	select GENERIC_ALLOCATOR
+ 	select AUXILIARY_BUS
+ 	help
+-	  This is an Intel(R) Ethernet Protocol Driver for RDMA driver
+-	  that support E810 (iWARP/RoCE) and X722 (iWARP) network devices.
++	  This is an Intel(R) Ethernet Protocol Driver for RDMA that
++	  supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP)
++	  network devices.
+-- 
+2.51.0
+
diff --git a/queue-6.1/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-6.1/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..f868899c52
--- /dev/null
+++ b/queue-6.1/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 9d89c486a5f9db02e4b966dacf84ad3b04744f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index d35d1fc398076..1257867e85e4e 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-6.1/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-6.1/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..df0e081614
--- /dev/null
+++ b/queue-6.1/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From d52ec87c0196b831451dd5b16c596251d845007d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 6cce6dd9fd232..76bc553da5d62 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -170,6 +170,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch b/queue-6.1/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
new file mode 100644
index 0000000000..dea67f50dd
--- /dev/null
+++ b/queue-6.1/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
@@ -0,0 +1,80 @@
+From 77b530ef5ced3e12fd5330367b635919999734ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:39 +0200
+Subject: s390/pci: Use pci_uevent_ers() in PCI recovery
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
+
+Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by
+EEH and AER PCIe recovery routines.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_event.c | 3 +++
+ drivers/pci/pci-driver.c  | 2 +-
+ include/linux/pci.h       | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
+index d969f36bf186f..f7f2853de49be 100644
+--- a/arch/s390/pci/pci_event.c
++++ b/arch/s390/pci/pci_event.c
+@@ -83,6 +83,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev,
+ 	pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT;
+ 
+ 	ers_res = driver->err_handler->error_detected(pdev,  pdev->error_state);
++	pci_uevent_ers(pdev, ers_res);
+ 	if (ers_result_indicates_abort(ers_res))
+ 		pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev));
+ 	else if (ers_res == PCI_ERS_RESULT_NEED_RESET)
+@@ -212,6 +213,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 		ers_res = zpci_event_do_reset(pdev, driver);
+ 
+ 	if (ers_res != PCI_ERS_RESULT_RECOVERED) {
++		pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT);
+ 		pr_err("%s: Automatic recovery failed; operator intervention is required\n",
+ 		       pci_name(pdev));
+ 		goto out_unlock;
+@@ -220,6 +222,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 	pr_info("%s: The device is ready to resume operations\n", pci_name(pdev));
+ 	if (driver->err_handler->resume)
+ 		driver->err_handler->resume(pdev);
++	pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
+ out_unlock:
+ 	pci_dev_unlock(pdev);
+ 
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index c3410241633f4..51db5063949bf 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1597,7 +1597,7 @@ static int pci_uevent(struct device *dev, struct kobj_uevent_env *env)
+ 	return 0;
+ }
+ 
+-#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ /**
+  * pci_uevent_ers - emit a uevent during recovery path of PCI device
+  * @pdev: PCI device undergoing error recovery
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index ea50d050d0214..e10b54642b7f2 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2561,7 +2561,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ 	return false;
+ }
+ 
+-#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch b/queue-6.1/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
new file mode 100644
index 0000000000..a8f3f49c00
--- /dev/null
+++ b/queue-6.1/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
@@ -0,0 +1,70 @@
+From 641eeda79da54e2706132de0fd5a5333161e63ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:37:57 -0700
+Subject: scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
+
+The fc_ct_ms_fill() helper currently formats the OS name and version
+into entry->value using "%s v%s". Since init_utsname()->sysname and
+->release are unbounded strings, snprintf() may attempt to write more
+than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
+-Wformat-truncation warning with W=1.
+
+In file included from drivers/scsi/libfc/fc_elsct.c:18:
+drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
+drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
+be truncated writing up to 64 bytes into a region of size between 62
+and 126 [-Werror=format-truncation=]
+  359 |                         "%s v%s",
+      |                              ^~
+  360 |                         init_utsname()->sysname,
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
+3 and 131 bytes into a destination of size 128
+  357 |                 snprintf((char *)&entry->value,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  358 |                         FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  359 |                         "%s v%s",
+      |                         ~~~~~~~~~
+  360 |                         init_utsname()->sysname,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by using "%.62s v%.62s", which ensures sysname and release are
+truncated to fit within the 128-byte field defined by
+FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
+
+[mkp: clarified commit description]
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_encode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
+index 7dcac3b6baa7e..992250ca8b9fd 100644
+--- a/drivers/scsi/libfc/fc_encode.h
++++ b/drivers/scsi/libfc/fc_encode.h
+@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
+ 		put_unaligned_be16(len, &entry->len);
+ 		snprintf((char *)&entry->value,
+ 			FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+-			"%s v%s",
++			"%.62s v%.62s",
+ 			init_utsname()->sysname,
+ 			init_utsname()->release);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-6.1/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..10984e1065
--- /dev/null
+++ b/queue-6.1/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From c962653d19a296b0a70b8f3d53a8e88fc7cddced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 6d4777a5f3d42..d09a8d583ba3c 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -5928,7 +5928,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -6102,8 +6102,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irqrestore(&pnode->lock, flags);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -6199,7 +6205,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-6.1/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..ae5f80bdb8
--- /dev/null
+++ b/queue-6.1/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From 17aad65b9601f9098853d657fa31159ef1ff9412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 8d2e8d05bbc05..52b14671eaa94 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch b/queue-6.1/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
new file mode 100644
index 0000000000..a26d5ee7c2
--- /dev/null
+++ b/queue-6.1/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
@@ -0,0 +1,64 @@
+From 04c36552da7b893c6cca4e3e8b3998e5d338495f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:01 -0700
+Subject: scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
+ lpfc_cleanup
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
+
+In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
+F_Port_Ctrl ndlp object.  In cases when an ABTS is issued, the
+outstanding kref is needed for when a second XRI_ABORTED CQE is
+received.  The final kref for the ndlp is designed to be decremented in
+lpfc_sli4_els_xri_aborted instead.  Also, add a new log message to allow
+for future diagnostics when debugging related issues.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c  | 6 +++++-
+ drivers/scsi/lpfc/lpfc_init.c | 7 -------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index b4afaed5e4879..3b7e17ef9c2ec 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -11892,7 +11892,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 			sglq_entry->state = SGL_FREED;
+ 			spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+ 					       iflag);
+-
++			lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
++					LOG_DISCOVERY | LOG_NODE,
++					"0732 ELS XRI ABORT on Node: ndlp=x%px "
++					"xri=x%x\n",
++					ndlp, xri);
+ 			if (ndlp) {
+ 				lpfc_set_rrq_active(phba, ndlp,
+ 					sglq_entry->sli4_lxritag,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 97f3c5240d572..6535474fe8a7f 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -3045,13 +3045,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
+ 		lpfc_vmid_vport_cleanup(vport);
+ 
+ 	list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
+-		if (vport->port_type != LPFC_PHYSICAL_PORT &&
+-		    ndlp->nlp_DID == Fabric_DID) {
+-			/* Just free up ndlp with Fabric_DID for vports */
+-			lpfc_nlp_put(ndlp);
+-			continue;
+-		}
+-
+ 		if (ndlp->nlp_DID == Fabric_Cntl_DID &&
+ 		    ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
+ 			lpfc_nlp_put(ndlp);
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch b/queue-6.1/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
new file mode 100644
index 0000000000..8e3574e900
--- /dev/null
+++ b/queue-6.1/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
@@ -0,0 +1,56 @@
+From bb7abab08b4610ebc791d627da87fa6ff507afa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:34 +0530
+Subject: scsi: mpi3mr: Fix controller init failure on fault during queue
+ creation
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
+
+Firmware can enter a transient fault while creating operational queues.
+The driver fails the load immediately.
+
+Add a retry loop that checks controller status and history bit after
+queue creation. If either indicates a fault, retry init up to a set
+limit before failing.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index d50bc67061563..9d8f5a4794666 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -2111,6 +2111,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ {
+ 	int retval = 0;
+ 	u16 num_queues = 0, i = 0, msix_count_op_q = 1;
++	u32 ioc_status;
++	enum mpi3mr_iocstate ioc_state;
+ 
+ 	num_queues = min_t(int, mrioc->facts.max_op_reply_q,
+ 	    mrioc->facts.max_op_req_q);
+@@ -2166,6 +2168,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ 		retval = -1;
+ 		goto out_failed;
+ 	}
++	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
++	ioc_state = mpi3mr_get_iocstate(mrioc);
++	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
++	    ioc_state != MRIOC_STATE_READY) {
++		mpi3mr_print_fault_info(mrioc);
++		retval = -1;
++		goto out_failed;
++	}
+ 	mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
+ 	ioc_info(mrioc,
+ 	    "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch b/queue-6.1/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
new file mode 100644
index 0000000000..c16d0d241f
--- /dev/null
+++ b/queue-6.1/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
@@ -0,0 +1,39 @@
+From 19755fd14abf5c8fe99a841754f57a8d6db116c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:12 +0530
+Subject: scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
+
+Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in
+_transport_convert_phy_link_rate(). This maps the new 22.5 Gbps
+negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link
+speeds.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index 7d6e4fe31ceed..02c970575464c 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)
+ 	case MPI25_SAS_NEG_LINK_RATE_12_0:
+ 		rc = SAS_LINK_RATE_12_0_GBPS;
+ 		break;
++	case MPI26_SAS_NEG_LINK_RATE_22_5:
++		rc = SAS_LINK_RATE_22_5_GBPS;
++		break;
+ 	case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED:
+ 		rc = SAS_PHY_DISABLED;
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-6.1/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..1a162bf10f
--- /dev/null
+++ b/queue-6.1/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From e6f99962320496a329ff8524bddfc9f891b11bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 2f67f51785e64..3ac6b564a664a 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -686,7 +686,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-6.1/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..e2f698fbcc
--- /dev/null
+++ b/queue-6.1/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From 53c2cd8c4dada9cde9906e7f2716cb86b5633480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 73f036bed1281..2f67f51785e64 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -538,23 +538,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 18b150f27c868..60b477e65a66a 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -532,6 +532,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index b08f52673889c..9306f05674d18 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -544,6 +544,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch b/queue-6.1/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
new file mode 100644
index 0000000000..c2aeabddee
--- /dev/null
+++ b/queue-6.1/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
@@ -0,0 +1,61 @@
+From 328cef17e64971a93123a96f27199764543dee4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:22 +0800
+Subject: scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO
+ mode change
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
+
+Assign power mode userdata settings before transitioning to FASTAUTO
+power mode. This ensures that default timeout values are set for various
+parameters, enhancing the reliability and performance of the power mode
+change process.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 7309f3f87eacf..023ded88acef8 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -991,6 +991,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
+ 			       PA_NO_ADAPT);
+ 
++		if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) {
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2),
++					DL_AFC0ReqTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3),
++					DL_FC1ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4),
++					DL_TC1ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5),
++					DL_AFC1ReqTimeOutVal_Default);
++
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal),
++					DL_AFC0ReqTimeOutVal_Default);
++		}
++
+ 		ret = ufshcd_uic_change_pwr_mode(hba,
+ 					FASTAUTO_MODE << 4 | FASTAUTO_MODE);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch b/queue-6.1/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
new file mode 100644
index 0000000000..2f396db689
--- /dev/null
+++ b/queue-6.1/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
@@ -0,0 +1,44 @@
+From f8900eaf7d9e8f34b949ed006e21c260eb1bbe26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:25 +0800
+Subject: scsi: ufs: host: mediatek: Change reset sequence for improved
+ stability
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
+
+Modify the reset sequence to ensure that the device reset pin is set low
+before the host is disabled. This change enhances the stability of the
+reset process by ensuring the correct order of operations.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 023ded88acef8..df17e6d606ded 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1158,11 +1158,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba)
+ {
+ 	struct arm_smccc_res res;
+ 
+-	/* disable hba before device reset */
+-	ufshcd_hba_stop(hba);
+-
+ 	ufs_mtk_device_reset_ctrl(0, res);
+ 
++	/* disable hba in middle of device reset */
++	ufshcd_hba_stop(hba);
++
+ 	/*
+ 	 * The reset signal is active low. UFS devices shall detect
+ 	 * more than or equal to 1us of positive or negative RST_n
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch b/queue-6.1/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
new file mode 100644
index 0000000000..304e46b8b3
--- /dev/null
+++ b/queue-6.1/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
@@ -0,0 +1,50 @@
+From ee128e98916ceb87148a3ca1da067af83d20ffe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:38 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on resume failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
+
+Improve the recovery process for failed resume operations. Log the
+device's power status and return 0 if both resume and recovery fail to
+prevent I/O hang.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 1c6348ee58092..3dbcb30e610fc 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1359,8 +1359,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ 	}
+ 
+ 	return 0;
++
+ fail:
+-	return ufshcd_link_recovery(hba);
++	/*
++	 * Check if the platform (parent) device has resumed, and ensure that
++	 * power, clock, and MTCMOS are all turned on.
++	 */
++	err = ufshcd_link_recovery(hba);
++	if (err) {
++		dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n",
++			hba->dev->power.request,
++			hba->dev->power.runtime_status,
++			hba->dev->power.runtime_error);
++	}
++
++	return 0; /* Cannot return a failure, otherwise, the I/O will hang. */
+ }
+ 
+ static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba)
+-- 
+2.51.0
+
diff --git a/queue-6.1/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch b/queue-6.1/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
new file mode 100644
index 0000000000..0679ac5a5e
--- /dev/null
+++ b/queue-6.1/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
@@ -0,0 +1,41 @@
+From 49048f79fbfe6be56a32574c754b914f752df597 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:26 +0800
+Subject: scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
+
+Add a NULL check before accessing the 'vccqx' pointer to prevent invalid
+memory access. This ensures that the function safely handles cases where
+'vccq' and 'vccq2' are not initialized, improving the robustness of the
+power management code.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index df17e6d606ded..1c6348ee58092 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1230,6 +1230,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm)
+ {
+ 	struct ufs_vreg *vccqx = NULL;
+ 
++	if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2)
++		return;
++
+ 	if (hba->vreg_info.vccq)
+ 		vccqx = hba->vreg_info.vccq;
+ 	else
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-6.1/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..ac2f24631f
--- /dev/null
+++ b/queue-6.1/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From 27109524e788e9d24751bb813cfe5b36595fae60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 1c0dcddbe2bd1..135e19db39eb0 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -423,6 +423,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-6.1/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..7e6cd1495e
--- /dev/null
+++ b/queue-6.1/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 8e69f6d886bd7bf73adbcc9ec0c9fcf35c07052d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index aae64eb2ae737..bf34fa443b233 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -250,7 +250,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-6.1/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..e7e5a36561
--- /dev/null
+++ b/queue-6.1/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From f2f10bd0f51f6c2bc84101cab9362f11048e6257 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-6.1/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..9983af1bb1
--- /dev/null
+++ b/queue-6.1/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From 962b231a002ff5f97f00095e9776d3a0fc075f1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch b/queue-6.1/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
new file mode 100644
index 0000000000..e225b42c07
--- /dev/null
+++ b/queue-6.1/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
@@ -0,0 +1,1849 @@
+From 3d59fd0d9908f29b06553317c3224fb1e466bf84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:38:37 -0700
+Subject: selftests: net: replace sleeps in fcnal-test with waits
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
+
+fcnal-test.sh already includes lib.sh, use relevant helpers
+instead of sleeping. Replace sleep after starting nettest
+as a server with wait_local_port_listen.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++-----------
+ 1 file changed, 214 insertions(+), 214 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index ee6880ac3e5ed..1c0dcddbe2bd1 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -851,7 +851,7 @@ ipv4_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -859,7 +859,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -867,7 +867,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -875,7 +875,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -886,7 +886,7 @@ ipv4_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -894,7 +894,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -902,7 +902,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -919,7 +919,7 @@ ipv4_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -927,7 +927,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -935,7 +935,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -943,7 +943,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -954,7 +954,7 @@ ipv4_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -962,7 +962,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -970,7 +970,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -981,14 +981,14 @@ ipv4_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -996,7 +996,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1004,21 +1004,21 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1026,7 +1026,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1034,7 +1034,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -1058,14 +1058,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
+ 	log_start
+ 	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
+ 
+ 	log_start
+ 	show_hint "Binding both the socket and the key is not required but it works"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
+ }
+@@ -1079,25 +1079,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0()
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
+ 	log_start
+ 
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
+ 
+@@ -1116,7 +1116,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -1124,7 +1124,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1144,13 +1144,13 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1172,7 +1172,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1180,7 +1180,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1189,7 +1189,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1197,7 +1197,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -1206,7 +1206,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -1214,7 +1214,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 
+@@ -1243,19 +1243,19 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1272,7 +1272,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -1294,14 +1294,14 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -1316,7 +1316,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "client socket should be bound to device"
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1326,7 +1326,7 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since client is not bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -1338,13 +1338,13 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1363,7 +1363,7 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -1371,26 +1371,26 @@ ipv4_tcp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+ 	log_start
+ 	show_hint "Should fail 'No route to host' since client is out of VRF scope"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ }
+@@ -1429,7 +1429,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -1442,7 +1442,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1453,31 +1453,31 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
+ 
+@@ -1500,7 +1500,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1508,7 +1508,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1517,7 +1517,7 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1525,25 +1525,25 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1556,28 +1556,28 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 2 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1587,7 +1587,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -1612,19 +1612,19 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Fails because ingress is in a VRF and global server is disabled"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1636,7 +1636,7 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is out of scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
+ 	done
+@@ -1644,26 +1644,26 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
+ 
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1678,19 +1678,19 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1705,13 +1705,13 @@ ipv4_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "VRF client"
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -1732,31 +1732,31 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1764,7 +1764,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 	done
+@@ -1773,7 +1773,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -1996,7 +1996,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2010,7 +2010,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2023,7 +2023,7 @@ ipv4_rt()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest ${varg} -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest ${varg} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2037,7 +2037,7 @@ ipv4_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2048,7 +2048,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2064,7 +2064,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2078,7 +2078,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2092,7 +2092,7 @@ ipv4_rt()
+ 	log_start
+ 
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2103,7 +2103,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2114,7 +2114,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2464,7 +2464,7 @@ ipv6_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -2472,7 +2472,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -2480,7 +2480,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -2488,7 +2488,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -2499,7 +2499,7 @@ ipv6_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -2507,7 +2507,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -2515,7 +2515,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -2532,7 +2532,7 @@ ipv6_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -2540,7 +2540,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -2548,7 +2548,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -2556,7 +2556,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -2567,7 +2567,7 @@ ipv6_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -2575,7 +2575,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -2583,7 +2583,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -2594,14 +2594,14 @@ ipv6_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2609,7 +2609,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2617,21 +2617,21 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2639,7 +2639,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2647,7 +2647,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -2675,7 +2675,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2696,7 +2696,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Client"
+ 	done
+@@ -2705,7 +2705,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -2725,7 +2725,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -2733,7 +2733,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -2742,7 +2742,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -2750,7 +2750,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -2759,7 +2759,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -2768,7 +2768,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 	done
+@@ -2801,7 +2801,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -2810,7 +2810,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2819,7 +2819,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2827,7 +2827,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -2846,7 +2846,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -2867,7 +2867,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2876,7 +2876,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2885,13 +2885,13 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2899,7 +2899,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -2919,7 +2919,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Fails 'Connection refused' since client is not in VRF"
+ 		run_cmd nettest -6 -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -2932,7 +2932,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 	done
+@@ -2941,7 +2941,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Fails since VRF device does not allow linklocal addresses"
+ 	run_cmd_nsb nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF}
+ 	log_test_addr ${a} $? 1 "Client, VRF bind"
+ 
+@@ -2949,7 +2949,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -2974,7 +2974,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -2982,7 +2982,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+@@ -2990,13 +2990,13 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail since unbound client is out of VRF scope"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+@@ -3004,7 +3004,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 	done
+@@ -3044,13 +3044,13 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3058,7 +3058,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_LO_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -3068,7 +3068,7 @@ ipv6_udp_novrf()
+ 	#log_start
+ 	#show_hint "Should fail since loopback address is out of scope"
+ 	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	#sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	#run_cmd_nsb nettest -6 -D -r ${a}
+ 	#log_test_addr ${a} $? 1 "Device server"
+ 
+@@ -3088,25 +3088,25 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
+ 
+@@ -3128,7 +3128,7 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -3136,7 +3136,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -3145,7 +3145,7 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -6 -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, local connection"
+ 	done
+@@ -3153,19 +3153,19 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
+ 
+@@ -3174,28 +3174,28 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 	done
+@@ -3203,7 +3203,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3217,7 +3217,7 @@ ipv6_udp_novrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3241,7 +3241,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -3250,7 +3250,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3259,7 +3259,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3281,7 +3281,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
+ 	done
+@@ -3290,7 +3290,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -3299,25 +3299,25 @@ ipv6_udp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server is disabled"
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 1 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -3332,7 +3332,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -3341,7 +3341,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3350,7 +3350,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3368,7 +3368,7 @@ ipv6_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
+ 	log_test $? 0 "VRF client"
+ 
+@@ -3379,7 +3379,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -3394,13 +3394,13 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	#log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3408,13 +3408,13 @@ ipv6_udp_vrf()
+ 	a=${VRF_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3430,25 +3430,25 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3460,7 +3460,7 @@ ipv6_udp_vrf()
+ 	# link local addresses
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Global server, linklocal IP"
+ 
+@@ -3471,7 +3471,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, linklocal IP"
+ 
+@@ -3482,7 +3482,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, local conn - linklocal IP"
+ 
+@@ -3495,7 +3495,7 @@ ipv6_udp_vrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3674,7 +3674,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3688,7 +3688,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3702,7 +3702,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3717,7 +3717,7 @@ ipv6_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3728,7 +3728,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3745,7 +3745,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3759,7 +3759,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3772,7 +3772,7 @@ ipv6_rt()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3783,7 +3783,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3794,7 +3794,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3853,7 +3853,7 @@ netfilter_tcp_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -3871,7 +3871,7 @@ netfilter_icmp()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${arg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -3910,7 +3910,7 @@ netfilter_tcp6_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -3928,7 +3928,7 @@ netfilter_icmp6()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s ${arg} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4124,12 +4124,12 @@ use_case_snat_on_vrf()
+ 	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
+ 
+ 	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
+ 	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
+ 
+ 	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
+ 	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-replace-sleep-with-slowwait.patch b/queue-6.1/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..829dd8b420
--- /dev/null
+++ b/queue-6.1/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From 18bd761ec5b842830e313b85b122fbac9089c042 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 135e19db39eb0..bb20dac178698 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -194,7 +194,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ do_run_cmd()
+-- 
+2.51.0
+
diff --git a/queue-6.1/selftests-traceroute-use-require_command.patch b/queue-6.1/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..4e395c5932
--- /dev/null
+++ b/queue-6.1/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From e285c90568475a0517175c2fc22b8f4b655fdc6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index de9ca97abc306..9cb5e96e64333 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -209,11 +209,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -278,11 +273,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -316,6 +306,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-6.1/series b/queue-6.1/series
index ad7859a959..5017dc13a9 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -126,3 +126,148 @@ mfd-stmpe-remove-irq-domain-upon-removal.patch
 mfd-stmpe-i2c-add-missing-module_license.patch
 mfd-madera-work-around-false-positive-wininitialized.patch
 mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+drm-amd-display-add-more-cyan-skillfish-devices.patch
+drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
+media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+ice-don-t-use-pk-through-printk-or-tracepoints.patch
+thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
+scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
+scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
+drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+media-fix-uninitialized-symbol-warnings.patch
+drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-model-to-easy50712-dts.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+ptp-limit-time-setting-of-ptp-clocks.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
+drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
+drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+media-adv7180-add-missing-lock-in-suspend-callback.patch
+media-adv7180-do-not-write-format-to-device-in-set_f.patch
+media-adv7180-only-validate-format-in-querystd.patch
+media-verisilicon-explicitly-disable-selection-api-i.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+drm-amd-add-more-cyan-skillfish-pci-ids.patch
+drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+usb-cdns3-gadget-use-after-free-during-failed-initia.patch
+drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
+media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+ntfs3-pretend-extend-records-as-regular-files.patch
+wifi-mac80211-fix-he-capabilities-element-check.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-traceroute-use-require_command.patch
+netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+selftests-replace-sleep-with-slowwait.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
+alsa-serial-generic-remove-shared-static-buffer.patch
+drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
+drm-amd-avoid-evicting-resources-at-s5.patch
+page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
+ethernet-extend-device_get_mac_address-to-use-nvmem.patch
+drm-amdgpu-reject-gang-submissions-under-sriov.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+ipv6-np-rxpmtu-race-annotation.patch
+rdma-irdma-update-kconfig.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
+net-ethernet-microchip-sparx5-make-it-selectable-for.patch
+iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+sparc64-fix-prototypes-of-reads-bwl.patch
+vfio-return-enotty-for-unsupported-device-feature.patch
+pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
+scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
+scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+ext4-increase-io-priority-of-fastcommit.patch
+net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
+exfat-limit-log-print-for-io-error.patch
+6pack-drop-redundant-locking-and-refcounting.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+ftrace-fix-softlockup-in-ftrace_module_enable.patch
+ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
+smb-client-transport-avoid-reconnects-triggered-by-p.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-6.1/smb-client-transport-avoid-reconnects-triggered-by-p.patch b/queue-6.1/smb-client-transport-avoid-reconnects-triggered-by-p.patch
new file mode 100644
index 0000000000..e74bad401f
--- /dev/null
+++ b/queue-6.1/smb-client-transport-avoid-reconnects-triggered-by-p.patch
@@ -0,0 +1,70 @@
+From a3552b83def637733ad2a840e7c4e21c69fba3c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:39 +0200
+Subject: smb: client: transport: avoid reconnects triggered by pending task
+ work
+
+From: Fiona Ebner <f.ebner@proxmox.com>
+
+[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
+
+When io_uring is used in the same task as CIFS, there might be
+unnecessary reconnects, causing issues in user-space applications
+like QEMU with a log like:
+
+> CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
+
+Certain io_uring completions might be added to task_work with
+notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for
+the task.
+
+In __smb_send_rqst(), signals are masked before calling
+smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
+
+If sk_stream_wait_memory() is reached via sock_sendmsg() while
+TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to
+true there, and -EINTR will be propagated all the way from
+sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec().
+Afterwards, __smb_send_rqst() will see that not everything was written
+and reconnect.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/transport.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
+index d2867bd263c55..8a0342bb3ebe7 100644
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -22,6 +22,7 @@
+ #include <linux/mempool.h>
+ #include <linux/sched/signal.h>
+ #include <linux/task_io_accounting_ops.h>
++#include <linux/task_work.h>
+ #include "cifspdu.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+@@ -211,9 +212,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+ 		 * send a packet.  In most cases if we fail to send
+ 		 * after the retries we will kill the socket and
+ 		 * reconnect which may clear the network problem.
++		 *
++		 * Even if regular signals are masked, EINTR might be
++		 * propagated from sk_stream_wait_memory() to here when
++		 * TIF_NOTIFY_SIGNAL is used for task work. For example,
++		 * certain io_uring completions will use that. Treat
++		 * having EINTR with pending task work the same as EAGAIN
++		 * to avoid unnecessary reconnects.
+ 		 */
+ 		rc = sock_sendmsg(ssocket, smb_msg);
+-		if (rc == -EAGAIN) {
++		if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
+ 			retries++;
+ 			if (retries >= 14 ||
+ 			    (!server->noblocksnd && (retries > 2))) {
+-- 
+2.51.0
+
diff --git a/queue-6.1/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch b/queue-6.1/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
new file mode 100644
index 0000000000..fc0a38bcd3
--- /dev/null
+++ b/queue-6.1/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
@@ -0,0 +1,55 @@
+From fbfbec49e11d0129f83a479546e5ebec71d837a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:26:10 -0500
+Subject: smsc911x: add second read of EEPROM mac when possible corruption seen
+
+From: Colin Foster <colin.foster@in-advantage.com>
+
+[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
+
+When the EEPROM MAC is read by way of ADDRH, it can return all 0s the
+first time. Subsequent reads succeed.
+
+This is fully reproduceable on the Phytec PCM049 SOM.
+
+Re-read the ADDRH when this behaviour is observed, in an attempt to
+correctly apply the EEPROM MAC address.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index a690d139e1770..a1bb16ba36595 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2165,10 +2165,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {
+ static void smsc911x_read_mac_address(struct net_device *dev)
+ {
+ 	struct smsc911x_data *pdata = netdev_priv(dev);
+-	u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+-	u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++	u32 mac_high16, mac_low32;
+ 	u8 addr[ETH_ALEN];
+ 
++	mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++
++	/* The first mac_read in some setups can incorrectly read 0. Re-read it
++	 * to get the full MAC if this is observed.
++	 */
++	if (mac_high16 == 0) {
++		SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n");
++		mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	}
++
+ 	addr[0] = (u8)(mac_low32);
+ 	addr[1] = (u8)(mac_low32 >> 8);
+ 	addr[2] = (u8)(mac_low32 >> 16);
+-- 
+2.51.0
+
diff --git a/queue-6.1/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-6.1/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..a744c7cf08
--- /dev/null
+++ b/queue-6.1/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From 20e4e4bae4325147fed83e0d2072d65e669a191b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 8fb09eec8c3e7..694ed081cf8d9 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -58,6 +58,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index 66c45a2764bc8..a7780907fc2f9 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-6.1/sparc64-fix-prototypes-of-reads-bwl.patch b/queue-6.1/sparc64-fix-prototypes-of-reads-bwl.patch
new file mode 100644
index 0000000000..11125145a0
--- /dev/null
+++ b/queue-6.1/sparc64-fix-prototypes-of-reads-bwl.patch
@@ -0,0 +1,51 @@
+From 84fa70f1dbd129510cb387c17d03fcb8dd656ce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:42:08 +0100
+Subject: sparc64: fix prototypes of reads[bwl]()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
+
+Conventions for readsl() are the same as for readl() - any __iomem
+pointer is acceptable, both const and volatile ones being OK.  Same
+for readsb() and readsw().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com> # Making sparc64 subject prefix
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/io_64.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
+index 9303270b22f3c..f9d370324729e 100644
+--- a/arch/sparc/include/asm/io_64.h
++++ b/arch/sparc/include/asm/io_64.h
+@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);
+ #define insw insw
+ #define insl insl
+ 
+-static inline void readsb(void __iomem *port, void *buf, unsigned long count)
++static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insb((unsigned long __force)port, buf, count);
+ }
+ #define readsb readsb
+ 
+-static inline void readsw(void __iomem *port, void *buf, unsigned long count)
++static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insw((unsigned long __force)port, buf, count);
+ }
+ #define readsw readsw
+ 
+-static inline void readsl(void __iomem *port, void *buf, unsigned long count)
++static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insl((unsigned long __force)port, buf, count);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.1/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch b/queue-6.1/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
new file mode 100644
index 0000000000..53c88843a7
--- /dev/null
+++ b/queue-6.1/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,63 @@
+From 57841b56816dc331be419d5ab28958d0b98aef0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:42:29 +0200
+Subject: thunderbolt: Use is_pciehp instead of is_hotplug_bridge
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
+
+The thunderbolt driver sets up device link dependencies from hotplug ports
+to the Host Router (aka Native Host Interface, NHI).  When resuming from
+system sleep, this allows the Host Router to re-establish tunnels to
+attached Thunderbolt devices before the hotplug ports resume.
+
+To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
+flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
+
+Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
+more apt to identify them with the is_pciehp flag.
+
+Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
+support and are quirked to use legacy INTx interrupts instead.  The quirk
+identifies them with is_hotplug_bridge, even though all affected ports are
+also matched by is_pciehp.  So use is_pciehp here as well.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c     | 2 +-
+ drivers/thunderbolt/tb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 0772ce28cba41..e8cfae79a47a9 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3717,7 +3717,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+  */
+ static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
+ {
+-	if (pdev->is_hotplug_bridge &&
++	if (pdev->is_pciehp &&
+ 	    (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
+ 	     pdev->revision <= 1))
+ 		pdev->no_msi = 1;
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index 0668e1645bc50..f417ce477d4a0 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -1888,7 +1888,7 @@ static void tb_apple_add_links(struct tb_nhi *nhi)
+ 		if (!pci_is_pcie(pdev))
+ 			continue;
+ 		if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
+-		    !pdev->is_hotplug_bridge)
++		    !pdev->is_pciehp)
+ 			continue;
+ 
+ 		link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+-- 
+2.51.0
+
diff --git a/queue-6.1/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-6.1/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..389c720f8b
--- /dev/null
+++ b/queue-6.1/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 6c873f00a5186f2936c33acf39440aeee1e0ce25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index bc3a043a5d5c7..72b0210cdead7 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-cdns3-gadget-use-after-free-during-failed-initia.patch b/queue-6.1/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
new file mode 100644
index 0000000000..82d5dbc025
--- /dev/null
+++ b/queue-6.1/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
@@ -0,0 +1,62 @@
+From 23d27d8f731984471e573f823f4cba415877922b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:48:42 +0800
+Subject: usb: cdns3: gadget: Use-after-free during failed initialization and
+ exit of cdnsp gadget
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
+
+In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
+structure (pdev->gadget) was freed before its endpoints.
+The endpoints are linked via the ep_list in the gadget structure.
+Freeing the gadget first leaves dangling pointers in the endpoint list.
+When the endpoints are subsequently freed, this results in a use-after-free.
+
+Fix:
+By separating the usb_del_gadget_udc() operation into distinct "del" and
+"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
+final release of the gadget structure with usb_put_gadget().
+
+A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
+ only after freeing endpoints").
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index ccd02f6be78ae..51dac7db52841 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
+ 	return 0;
+ 
+ del_gadget:
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
++	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
++	goto halt_pdev;
+ free_endpoints:
+ 	cdnsp_gadget_free_endpoints(pdev);
+ halt_pdev:
+@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
+ 	devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
+ 	pm_runtime_mark_last_busy(cdns->dev);
+ 	pm_runtime_put_autosuspend(cdns->dev);
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
+ 	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
+ 	cdnsp_mem_cleanup(pdev);
+ 	kfree(pdev);
+ 	cdns->gadget_dev = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..c2e7a6b102
--- /dev/null
+++ b/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From 1bdcdde38375c9733dea42a1c4980164afd0c2e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index e68425db9a6af..9c0857f72eb79 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2005,7 +2005,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2029,6 +2034,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-6.1/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..5d69389e0a
--- /dev/null
+++ b/queue-6.1/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From 8d1035a65504cd6eb9dd4c2117140b4c883f51f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 4cc8750e2a6fd..c20d3426571ec 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-6.1/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..3b9c141fd6
--- /dev/null
+++ b/queue-6.1/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From 6fd5ab61d01056816ef0cf6b5f3cb9f440670274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index ba99f2bce646f..0b12bf0942124 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1464,6 +1464,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us))
+@@ -1713,7 +1715,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-6.1/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..1bdf4fa3c3
--- /dev/null
+++ b/queue-6.1/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From a70ecbb942b5f488958bda1cbd016882d997f8ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index 35483217b1f6c..93998d328d9aa 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-6.1/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-6.1/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..54e7321b27
--- /dev/null
+++ b/queue-6.1/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From 947b976ec2876e9a0c7922f4fe263fb734de440d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 7ec4c38c3ceec..fe799abf252b3 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -224,6 +224,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.1/vfio-return-enotty-for-unsupported-device-feature.patch b/queue-6.1/vfio-return-enotty-for-unsupported-device-feature.patch
new file mode 100644
index 0000000000..ae6c0aaef8
--- /dev/null
+++ b/queue-6.1/vfio-return-enotty-for-unsupported-device-feature.patch
@@ -0,0 +1,40 @@
+From 3bda3f69468db56d0a1cfa7f550a47a0215ff845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 08:58:40 -0700
+Subject: vfio: return -ENOTTY for unsupported device feature
+
+From: Alex Mastro <amastro@fb.com>
+
+[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
+
+The two implementers of vfio_device_ops.device_feature,
+vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return
+-ENOTTY in the fallthrough case when the feature is unsupported. For
+consistency, the base case, vfio_ioctl_device_feature, should do the
+same when device_feature == NULL, indicating an implementation has no
+feature extensions.
+
+Signed-off-by: Alex Mastro <amastro@fb.com>
+Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
+index 6e8804fe00953..e191422e99c4c 100644
+--- a/drivers/vfio/vfio_main.c
++++ b/drivers/vfio/vfio_main.c
+@@ -1501,7 +1501,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device,
+ 			feature.argsz - minsz);
+ 	default:
+ 		if (unlikely(!device->ops->device_feature))
+-			return -EINVAL;
++			return -ENOTTY;
+ 		return device->ops->device_feature(device, feature.flags,
+ 						   arg->data,
+ 						   feature.argsz - minsz);
+-- 
+2.51.0
+
diff --git a/queue-6.1/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch b/queue-6.1/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
new file mode 100644
index 0000000000..5086b6de96
--- /dev/null
+++ b/queue-6.1/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
@@ -0,0 +1,59 @@
+From 4b5434faf787d5e50be9ad296e51aa296cf995a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:18:23 +0900
+Subject: watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
+
+From: Sangwook Shin <sw617.shin@samsung.com>
+
+[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
+
+Fix the issue of max_timeout being calculated larger than actual value.
+The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) /
+S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder
+is discarded during the calculation process. This leads to a larger
+calculated value for max_timeout compared to the actual settable value.
+To resolve this issue, the order of calculations in the computation process
+has been adjusted.
+
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Signed-off-by: Sangwook Shin <sw617.shin@samsung.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/s3c2410_wdt.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
+index d3fc8ed886fff..3853be982cd3c 100644
+--- a/drivers/watchdog/s3c2410_wdt.c
++++ b/drivers/watchdog/s3c2410_wdt.c
+@@ -27,6 +27,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
+ #include <linux/delay.h>
++#include <linux/math64.h>
+ 
+ #define S3C2410_WTCON		0x00
+ #define S3C2410_WTDAT		0x04
+@@ -303,9 +304,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)
+ static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt)
+ {
+ 	const unsigned long freq = s3c2410wdt_get_freq(wdt);
++	const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) *
++			S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT;
++	u64 t_max = div64_ul(n_max, freq);
+ 
+-	return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1)
+-				       / S3C2410_WTCON_MAXDIV);
++	if (t_max > UINT_MAX)
++		t_max = UINT_MAX;
++
++	return t_max;
+ }
+ 
+ static inline struct s3c2410_wdt *freq_to_wdt(struct notifier_block *nb)
+-- 
+2.51.0
+
diff --git a/queue-6.1/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-6.1/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..a07a93d216
--- /dev/null
+++ b/queue-6.1/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From 75c3daf18f5498d6040e74bf69f2db8c54e76f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 184c722255c65..0c37b18e2ecfc 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -13,6 +13,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -286,8 +287,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-6.1/wifi-mac80211-fix-he-capabilities-element-check.patch b/queue-6.1/wifi-mac80211-fix-he-capabilities-element-check.patch
new file mode 100644
index 0000000000..15fab41b07
--- /dev/null
+++ b/queue-6.1/wifi-mac80211-fix-he-capabilities-element-check.patch
@@ -0,0 +1,37 @@
+From 0302a5340bef4ce0c2c7f4007199af51c36867e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 11:51:17 +0300
+Subject: wifi: mac80211: Fix HE capabilities element check
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
+
+The element data length check did not account for the extra
+octet used for the extension ID. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index cc47d6b88f04d..15826bbde70c2 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4386,7 +4386,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
+ 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+ 					     ies->data, ies->len);
+ 
+-	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
++	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1)
+ 		return chains;
+ 
+ 	/* skip one byte ext_tag_id */
+-- 
+2.51.0
+
diff --git a/queue-6.1/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch b/queue-6.1/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
new file mode 100644
index 0000000000..dad9325b55
--- /dev/null
+++ b/queue-6.1/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
@@ -0,0 +1,43 @@
+From 523fb1b43775941d441a183d87289daff1a00fe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 20:39:42 +0800
+Subject: wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922
+ device
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
+
+Enable 160MHz beamformee support on mt7922 by updating HE capability
+element configuration. Previously, only 160MHz channel width was set,
+but beamformee for 160MHz was not properly advertised. This patch
+adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices
+to utilize 160MHz BW for beamforming.
+
+Tested by connecting to 160MHz-bandwidth beamforming AP and verified
+HE capability.
+
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 7adda1718d6ac..fd91d2c537603 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -156,6 +156,8 @@ mt7921_init_he_caps(struct mt7921_phy *phy, enum nl80211_band band,
+ 			if (is_mt7922(phy->mt76->dev)) {
+ 				he_cap_elem->phy_cap_info[0] |=
+ 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++				he_cap_elem->phy_cap_info[4] |=
++					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
+ 				he_cap_elem->phy_cap_info[8] |=
+ 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+ 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
+-- 
+2.51.0
+
diff --git a/queue-6.1/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-6.1/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..d93c119d81
--- /dev/null
+++ b/queue-6.1/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From 401f0a285f31eb623fe9ec209aa34fc644ec45cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 796e2f9e87619..99e0768ccaae7 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -1072,16 +1072,6 @@ static void kvm_wait(u8 *ptr, u8 val)
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -1101,6 +1091,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-6.1/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-6.1/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..cf8533cb56
--- /dev/null
+++ b/queue-6.1/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 2eae0d54a2e38e816b4acacbd64065906354b8e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index 5d4ca8b942939..9404f9f416660 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-6.12/6pack-drop-redundant-locking-and-refcounting.patch b/queue-6.12/6pack-drop-redundant-locking-and-refcounting.patch
new file mode 100644
index 0000000000..02451b47f1
--- /dev/null
+++ b/queue-6.12/6pack-drop-redundant-locking-and-refcounting.patch
@@ -0,0 +1,173 @@
+From dedd73ddbb133ab847048e7b0fd0aa2451b0e639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:10:59 +0800
+Subject: 6pack: drop redundant locking and refcounting
+
+From: Qingfang Deng <dqfext@gmail.com>
+
+[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
+
+The TTY layer already serializes line discipline operations with
+tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack
+are unnecessary.
+
+Removing them simplifies the code and also resolves a lockdep warning
+reported by syzbot. The warning did not indicate a real deadlock, since
+the write-side lock was only taken in process context with hardirqs
+disabled.
+
+Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/
+Signed-off-by: Qingfang Deng <dqfext@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 57 ++++--------------------------------
+ 1 file changed, 5 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 3bf6785f90573..0c766c9c31955 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -115,8 +115,6 @@ struct sixpack {
+ 
+ 	struct timer_list	tx_t;
+ 	struct timer_list	resync_t;
+-	refcount_t		refcnt;
+-	struct completion	dead;
+ 	spinlock_t		lock;
+ };
+ 
+@@ -353,42 +351,13 @@ static void sp_bump(struct sixpack *sp, char cmd)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+-/*
+- * We have a potential race on dereferencing tty->disc_data, because the tty
+- * layer provides no locking at all - thus one cpu could be running
+- * sixpack_receive_buf while another calls sixpack_close, which zeroes
+- * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
+- * best way to fix this is to use a rwlock in the tty struct, but for now we
+- * use a single global rwlock for all ttys in ppp line discipline.
+- */
+-static DEFINE_RWLOCK(disc_data_lock);
+-                                                                                
+-static struct sixpack *sp_get(struct tty_struct *tty)
+-{
+-	struct sixpack *sp;
+-
+-	read_lock(&disc_data_lock);
+-	sp = tty->disc_data;
+-	if (sp)
+-		refcount_inc(&sp->refcnt);
+-	read_unlock(&disc_data_lock);
+-
+-	return sp;
+-}
+-
+-static void sp_put(struct sixpack *sp)
+-{
+-	if (refcount_dec_and_test(&sp->refcnt))
+-		complete(&sp->dead);
+-}
+-
+ /*
+  * Called by the TTY driver when there's room for more data.  If we have
+  * more packets to send, we send them here.
+  */
+ static void sixpack_write_wakeup(struct tty_struct *tty)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	int actual;
+ 
+ 	if (!sp)
+@@ -400,7 +369,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ 		sp->tx_enable = 0;
+ 		netif_wake_queue(sp->dev);
+-		goto out;
++		return;
+ 	}
+ 
+ 	if (sp->tx_enable) {
+@@ -408,9 +377,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		sp->xleft -= actual;
+ 		sp->xhead += actual;
+ 	}
+-
+-out:
+-	sp_put(sp);
+ }
+ 
+ /* ----------------------------------------------------------------------- */
+@@ -430,7 +396,7 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	if (!count)
+ 		return;
+ 
+-	sp = sp_get(tty);
++	sp = tty->disc_data;
+ 	if (!sp)
+ 		return;
+ 
+@@ -446,7 +412,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	}
+ 	sixpack_decode(sp, cp, count1);
+ 
+-	sp_put(sp);
+ 	tty_unthrottle(tty);
+ }
+ 
+@@ -561,8 +526,6 @@ static int sixpack_open(struct tty_struct *tty)
+ 
+ 	spin_lock_init(&sp->lock);
+ 	spin_lock_init(&sp->rxlock);
+-	refcount_set(&sp->refcnt, 1);
+-	init_completion(&sp->dead);
+ 
+ 	/* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
+ 
+@@ -638,19 +601,11 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock_irq(&disc_data_lock);
+ 	sp = tty->disc_data;
+-	tty->disc_data = NULL;
+-	write_unlock_irq(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+-	/*
+-	 * We have now ensured that nobody can start using ap from now on, but
+-	 * we have to wait for all existing users to finish.
+-	 */
+-	if (!refcount_dec_and_test(&sp->refcnt))
+-		wait_for_completion(&sp->dead);
++	tty->disc_data = NULL;
+ 
+ 	/* We must stop the queue to avoid potentially scribbling
+ 	 * on the free buffers. The sp->dead completion is not sufficient
+@@ -673,7 +628,7 @@ static void sixpack_close(struct tty_struct *tty)
+ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		unsigned long arg)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	struct net_device *dev;
+ 	unsigned int tmp, err;
+ 
+@@ -725,8 +680,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		err = tty_mode_ioctl(tty, cmd, arg);
+ 	}
+ 
+-	sp_put(sp);
+-
+ 	return err;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch b/queue-6.12/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
new file mode 100644
index 0000000000..dce226297a
--- /dev/null
+++ b/queue-6.12/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
@@ -0,0 +1,37 @@
+From cdda8414039f8142c139f376b78a9595c75936d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2024 19:58:30 +0300
+Subject: accel/habanalabs/gaudi2: fix BMON disable configuration
+
+From: Vered Yavniely <vered.yavniely@intel.com>
+
+[ Upstream commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd ]
+
+Change the BMON_CR register value back to its original state before
+enabling, so that BMON does not continue to collect information
+after being disabled.
+
+Signed-off-by: Vered Yavniely <vered.yavniely@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+index 2423620ff358f..bc3c57bda5cda 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+@@ -2426,7 +2426,7 @@ static int gaudi2_config_bmon(struct hl_device *hdev, struct hl_debug_params *pa
+ 		WREG32(base_reg + mmBMON_ADDRH_E3_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_REDUCTION_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_STM_TRC_OFFSET, 0x7 | (0xA << 8));
+-		WREG32(base_reg + mmBMON_CR_OFFSET, 0x77 | 0xf << 24);
++		WREG32(base_reg + mmBMON_CR_OFFSET, 0x41);
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch b/queue-6.12/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
new file mode 100644
index 0000000000..0894e08bca
--- /dev/null
+++ b/queue-6.12/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
@@ -0,0 +1,53 @@
+From 803283680991f2bbabe655de33fbf14ce2185835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 15:52:27 +0300
+Subject: accel/habanalabs/gaudi2: read preboot status after recovering from
+ dirty state
+
+From: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+
+[ Upstream commit a0d866bab184161ba155b352650083bf6695e50e ]
+
+Dirty state can occur when the host VM undergoes a reset while the
+device does not. In such a case, the driver must reset the device before
+it can be used again. As part of this reset, the device capabilities
+are zeroed. Therefore, the driver must read the Preboot status again to
+learn the Preboot state, capabilities, and security configuration.
+
+Signed-off-by: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 5722e4128d3ce..3df72a5d024a6 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -3150,7 +3150,6 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 	rc = hl_fw_read_preboot_status(hdev);
+ 	if (rc) {
+ 		if (hdev->reset_on_preboot_fail)
+-			/* we are already on failure flow, so don't check if hw_fini fails. */
+ 			hdev->asic_funcs->hw_fini(hdev, true, false);
+ 		goto pci_fini;
+ 	}
+@@ -3162,6 +3161,13 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 			dev_err(hdev->dev, "failed to reset HW in dirty state (%d)\n", rc);
+ 			goto pci_fini;
+ 		}
++
++		rc = hl_fw_read_preboot_status(hdev);
++		if (rc) {
++			if (hdev->reset_on_preboot_fail)
++				hdev->asic_funcs->hw_fini(hdev, true, false);
++			goto pci_fini;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/accel-habanalabs-return-enomem-if-less-than-requeste.patch b/queue-6.12/accel-habanalabs-return-enomem-if-less-than-requeste.patch
new file mode 100644
index 0000000000..9a90f21f00
--- /dev/null
+++ b/queue-6.12/accel-habanalabs-return-enomem-if-less-than-requeste.patch
@@ -0,0 +1,42 @@
+From 198f4a24124c1bdf196bd1cfb1cf91c90cb98c2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2024 16:32:32 +0300
+Subject: accel/habanalabs: return ENOMEM if less than requested pages were
+ pinned
+
+From: Tomer Tayar <tomer.tayar@intel.com>
+
+[ Upstream commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 ]
+
+EFAULT is currently returned if less than requested user pages are
+pinned. This value means a "bad address" which might be confusing to
+the user, as the address of the given user memory is not necessarily
+"bad".
+
+Modify the return value to ENOMEM, as "out of memory" is more suitable
+in this case.
+
+Signed-off-by: Tomer Tayar <tomer.tayar@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/common/memory.c b/drivers/accel/habanalabs/common/memory.c
+index 11c55fd76db58..0f27fd841f3ab 100644
+--- a/drivers/accel/habanalabs/common/memory.c
++++ b/drivers/accel/habanalabs/common/memory.c
+@@ -2332,7 +2332,7 @@ static int get_user_memory(struct hl_device *hdev, u64 addr, u64 size,
+ 		if (rc < 0)
+ 			goto destroy_pages;
+ 		npages = rc;
+-		rc = -EFAULT;
++		rc = -ENOMEM;
+ 		goto put_pages;
+ 	}
+ 	userptr->npages = npages;
+-- 
+2.51.0
+
diff --git a/queue-6.12/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch b/queue-6.12/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
new file mode 100644
index 0000000000..af9bd6d34a
--- /dev/null
+++ b/queue-6.12/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
@@ -0,0 +1,84 @@
+From b219e40356faca8dc7fc55b6d8983e0983f0add3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2024 15:01:26 +0300
+Subject: accel/habanalabs: support mapping cb with vmalloc-backed coherent
+ memory
+
+From: Moti Haimovski <moti.haimovski@intel.com>
+
+[ Upstream commit 513024d5a0e34fd34247043f1876b6138ca52847 ]
+
+When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return
+addresses from the vmalloc range. If such an address is mapped without
+VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the
+VM_PFNMAP restriction.
+
+Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP
+in the VMA before mapping. This ensures safe mapping and avoids kernel
+crashes. The memory is still driver-allocated and cannot be accessed
+directly by userspace.
+
+Signed-off-by: Moti Haimovski  <moti.haimovski@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi/gaudi.c   | 19 +++++++++++++++++++
+ drivers/accel/habanalabs/gaudi2/gaudi2.c |  7 +++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/accel/habanalabs/gaudi/gaudi.c b/drivers/accel/habanalabs/gaudi/gaudi.c
+index fa893a9b826ec..34771d75da9d7 100644
+--- a/drivers/accel/habanalabs/gaudi/gaudi.c
++++ b/drivers/accel/habanalabs/gaudi/gaudi.c
+@@ -4168,10 +4168,29 @@ static int gaudi_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 	vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP |
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
++#ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
++
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr,
+ 				(dma_addr - HOST_PHYS_BASE), size);
+ 	if (rc)
+ 		dev_err(hdev->dev, "dma_mmap_coherent error %d", rc);
++#else
++
++	rc = remap_pfn_range(vma, vma->vm_start,
++				virt_to_phys(cpu_addr) >> PAGE_SHIFT,
++				size, vma->vm_page_prot);
++	if (rc)
++		dev_err(hdev->dev, "remap_pfn_range error %d", rc);
++
++ #endif
++
+ 
+ 	return rc;
+ }
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 3df72a5d024a6..b957957df3d3a 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -6490,6 +6490,13 @@ static int gaudi2_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
+ #ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
+ 
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr, dma_addr, size);
+ 	if (rc)
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpi-scan-update-honor-list-for-rpmi-system-msi.patch b/queue-6.12/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
new file mode 100644
index 0000000000..f7cece679f
--- /dev/null
+++ b/queue-6.12/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
@@ -0,0 +1,45 @@
+From 1c9f64a98eb7fa2496b161da0027ad30565218a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:39:12 +0530
+Subject: ACPI: scan: Update honor list for RPMI System MSI
+
+From: Sunil V L <sunilvl@ventanamicro.com>
+
+[ Upstream commit 4215d1cf59e4b272755f4277a05cd5967935a704 ]
+
+The RPMI System MSI interrupt controller (just like PLIC and APLIC)
+needs to probed prior to devices like GED which use interrupts provided
+by it. Also, it has dependency on the SBI MPXY mailbox device.
+
+Add HIDs of RPMI System MSI and SBI MPXY mailbox devices to the honor
+list so that those dependencies are handled.
+
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
+Link: https://lore.kernel.org/r/20250818040920.272664-17-apatel@ventanamicro.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 4ef94d06365fc..ba98763ced7d4 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -862,6 +862,8 @@ static const char * const acpi_honor_dep_ids[] = {
+ 	"INTC10CF", /* IVSC (MTL) driver must be loaded to allow i2c access to camera sensors */
+ 	"RSCV0001", /* RISC-V PLIC */
+ 	"RSCV0002", /* RISC-V APLIC */
++	"RSCV0005", /* RISC-V SBI MPXY MBOX */
++	"RSCV0006", /* RISC-V RPMI SYSMSI */
+ 	"PNP0C0F",  /* PCI Link Device */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-6.12/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..335401a5c6
--- /dev/null
+++ b/queue-6.12/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From 44dca151891f3857f2b1f302293a1d19b1fe4d3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index dc53a5d700671..6168597a96e6f 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/allow-finish_no_open-file-err_ptr-e.patch b/queue-6.12/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..3ca847630c
--- /dev/null
+++ b/queue-6.12/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 5157bf60fa3c2678527f4168776cdddfa085b578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 5da4df2f9b18a..de1ea1b2f6ef5 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -1052,18 +1052,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch b/queue-6.12/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
new file mode 100644
index 0000000000..6442bd371d
--- /dev/null
+++ b/queue-6.12/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
@@ -0,0 +1,39 @@
+From add3ea940ae495d8e001f761ec5f9adc753f1fec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 14:13:27 +0200
+Subject: ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c ]
+
+snd_seq_fifo_poll_wait() evaluates f->cells without locking after
+poll_wait(), and KCSAN doesn't like it as it appears to be a
+data-race.  Although this doesn't matter much in practice as the value
+is volatile, it's still better to address it for the mind piece.
+
+Wrap it with f->lock spinlock for avoiding the potential data race.
+
+Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_fifo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 3a10b081f129c..7dc2bd94cefc3 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -213,6 +213,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file,
+ 			   poll_table *wait)
+ {
+ 	poll_wait(file, &f->input_sleep, wait);
++	guard(spinlock_irq)(&f->lock);
+ 	return (f->cells > 0);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/alsa-serial-generic-remove-shared-static-buffer.patch b/queue-6.12/alsa-serial-generic-remove-shared-static-buffer.patch
new file mode 100644
index 0000000000..695980dda2
--- /dev/null
+++ b/queue-6.12/alsa-serial-generic-remove-shared-static-buffer.patch
@@ -0,0 +1,71 @@
+From 01c961b9730b780c9689a480cf995b8b5238a88d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:42:19 +0100
+Subject: ALSA: serial-generic: remove shared static buffer
+
+From: John Keeping <jkeeping@inmusicbrands.com>
+
+[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
+
+If multiple instances of this driver are instantiated and try to send
+concurrently then the single static buffer snd_serial_generic_tx_work()
+will cause corruption in the data output.
+
+Move the buffer into the per-instance driver data to avoid this.
+
+Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/drivers/serial-generic.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c
+index 36409a56c675e..d0e2e656c31c1 100644
+--- a/sound/drivers/serial-generic.c
++++ b/sound/drivers/serial-generic.c
+@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");
+ #define SERIAL_TX_STATE_ACTIVE	1
+ #define SERIAL_TX_STATE_WAKEUP	2
+ 
++#define INTERNAL_BUF_SIZE 256
++
+ struct snd_serial_generic {
+ 	struct serdev_device *serdev;
+ 
+@@ -51,6 +53,7 @@ struct snd_serial_generic {
+ 	struct work_struct tx_work;
+ 	unsigned long tx_state;
+ 
++	char tx_buf[INTERNAL_BUF_SIZE];
+ };
+ 
+ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+ 	schedule_work(&drvdata->tx_work);
+ }
+ 
+-#define INTERNAL_BUF_SIZE 256
+-
+ static void snd_serial_generic_tx_work(struct work_struct *work)
+ {
+-	static char buf[INTERNAL_BUF_SIZE];
+ 	int num_bytes;
+ 	struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic,
+ 						   tx_work);
+@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)
+ 		if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode))
+ 			break;
+ 
+-		num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE);
+-		num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes);
++		num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf,
++						      INTERNAL_BUF_SIZE);
++		num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf,
++						    num_bytes);
+ 
+ 		if (!num_bytes)
+ 			break;
+-- 
+2.51.0
+
diff --git a/queue-6.12/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch b/queue-6.12/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
new file mode 100644
index 0000000000..8a9a964d69
--- /dev/null
+++ b/queue-6.12/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
@@ -0,0 +1,80 @@
+From 30dd7c112aa4ad2b3892b1677783ef9d7e15d4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 17:27:30 +0200
+Subject: ALSA: usb-audio: add mono main switch to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
+
+The 1824c does not have the A/B switch that the 1810c has,
+but instead it has a mono main switch that sums the two
+main output channels to mono.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 65bdda0841048..2413a6d96971c 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
+ 
+ #define SC1810C_CTL_LINE_SW	0
+ #define SC1810C_CTL_MUTE_SW	1
++#define SC1824C_CTL_MONO_SW	2
+ #define SC1810C_CTL_AB_SW	3
+ #define SC1810C_CTL_48V_SW	4
+ 
+@@ -123,6 +124,7 @@ struct s1810c_state_packet {
+ #define SC1810C_STATE_48V_SW	58
+ #define SC1810C_STATE_LINE_SW	59
+ #define SC1810C_STATE_MUTE_SW	60
++#define SC1824C_STATE_MONO_SW	61
+ #define SC1810C_STATE_AB_SW	62
+ 
+ struct s1810_mixer_state {
+@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
+ 	.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
+ };
+ 
++static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
++	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++	.name = "Mono Main Out Switch",
++	.info = snd_ctl_boolean_mono_info,
++	.get = snd_s1810c_switch_get,
++	.put = snd_s1810c_switch_set,
++	.private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
++};
++
+ static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
+ 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ 	.name = "48V Phantom Power On Mic Inputs Switch",
+@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+-	if (ret < 0)
+-		return ret;
++	// The 1824c has a Mono Main switch instead of a
++	// A/B select switch.
++	if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
++		if (ret < 0)
++			return ret;
++	} else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-6.12/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..d2e57e9942
--- /dev/null
+++ b/queue-6.12/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From dd37e76929b78f86ee3ac671a57c2ddc59df8831 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-6.12/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-6.12/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..b39800ca57
--- /dev/null
+++ b/queue-6.12/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From ae0ce4ba0c7be4acc33830d59f3c41124daf2184 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 0591da2839269..ba9c6874915a2 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch b/queue-6.12/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
new file mode 100644
index 0000000000..13c4f4ee53
--- /dev/null
+++ b/queue-6.12/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
@@ -0,0 +1,121 @@
+From 5487779ae2f2b20ef5a00d9a575d8faed6600626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:21:15 +0800
+Subject: amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 ]
+
+There is race in amdgpu_amdkfd_device_fini_sw and interrupt.
+if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and
+  kfree(kfd), and KGD interrupt generated.
+
+kernel panic log:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000098
+amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP
+
+PGD d78c68067 P4D d78c68067
+
+kfd kfd: amdgpu: Allocated 3969056 bytes on gart
+
+PUD 1465b8067 PMD @
+
+Oops: @002 [#1] SMP NOPTI
+
+kfd kfd: amdgpu: Total number of KFD nodes to be created: 4
+CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K
+
+RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40
+
+Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 <fO> OF b1 17 75 Ba 4c 89 e@ 41 Sc
+
+89 c6 e8 07 38 5d
+
+RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046
+
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018
+0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098
+ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020
+0000000000000000 R11: 0000000000000000 R12: 0900000000000002
+ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00
+
+CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033
+
+CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0
+0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400
+
+PKRU: 55555554
+
+Call Trace:
+
+<IRQ>
+
+kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu]
+
+? amdgpu_fence_process+0xa4/0x150 [amdgpu]
+
+kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace
+
+amdgpu_irq_dispatch+0x165/0x210 [amdgpu]
+
+amdgpu_ih_process+0x80/0x100 [amdgpu]
+
+amdgpu: Virtual CRAT table created for GPU
+
+amdgpu_irq_handler+0x1f/@x60 [amdgpu]
+
+__handle_irq_event_percpu+0x3d/0x170
+
+amdgpu: Topology: Add dGPU node [0x74a2:0x1002]
+
+handle_irq_event+0x5a/@xcO
+
+handle_edge_irq+0x93/0x240
+
+kfd kfd: amdgpu: KFD node 1 partition @ size 49148M
+
+asm_call_irq_on_stack+0xf/@x20
+
+</IRQ>
+
+common_interrupt+0xb3/0x130
+
+asm_common_interrupt+0x1le/0x40
+
+5.10.134-010.a1i5000.a18.x86_64 #1
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: Philip Yang<Philip.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 07eadab4c1c4d..b536ec72cffb7 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -1084,7 +1084,15 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ 	}
+ 
+ 	for (i = 0; i < kfd->num_nodes; i++) {
+-		node = kfd->nodes[i];
++		/* Race if another thread in b/w
++		 * kfd_cleanup_nodes and kfree(kfd),
++		 * when kfd->nodes[i] = NULL
++		 */
++		if (kfd->nodes[i])
++			node = kfd->nodes[i];
++		else
++			return;
++
+ 		spin_lock_irqsave(&node->interrupt_lock, flags);
+ 
+ 		if (node->interrupts_active
+-- 
+2.51.0
+
diff --git a/queue-6.12/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch b/queue-6.12/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
new file mode 100644
index 0000000000..f11d4034e6
--- /dev/null
+++ b/queue-6.12/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
@@ -0,0 +1,157 @@
+From 69956848f49980c7f6303580d2980ab7a196d212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 17:20:11 +0800
+Subject: ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
+
+From: Terry Cheong <htcheong@chromium.org>
+
+[ Upstream commit 8ed2dca4df2297177e0edcb7e0c72ef87f3fd81a ]
+
+The SND_JACK_AVOUT is a more specific jack type for HDMI and DisplayPort.
+Updatae the MediaTek drivers to use such jack type, allowing system to
+determine the device type based on jack event.
+
+Signed-off-by: Terry Cheong <htcheong@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250723-mtk-hdmi-v1-1-4ff945eb6136@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8173/mt8173-rt5650.c                 | 2 +-
+ sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c        | 2 +-
+ .../soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c  | 2 +-
+ sound/soc/mediatek/mt8186/mt8186-mt6366.c                 | 2 +-
+ sound/soc/mediatek/mt8188/mt8188-mt6359.c                 | 8 ++++----
+ sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c   | 2 +-
+ sound/soc/mediatek/mt8195/mt8195-mt6359.c                 | 4 ++--
+ 7 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+index 466f176f8e948..09ddc7a186c6e 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+@@ -159,7 +159,7 @@ static int mt8173_rt5650_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ {
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &mt8173_rt5650_hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+index f848e14b091a1..2435535a6b622 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+@@ -378,7 +378,7 @@ static int mt8183_da7219_max98357_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_card_get_drvdata(rtd->card);
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &priv->hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+index bb6df056a8789..e3232e10a5fb7 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+@@ -383,7 +383,7 @@ mt8183_mt6358_ts3a227_max98357_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_card_get_drvdata(rtd->card);
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &priv->hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8186/mt8186-mt6366.c b/sound/soc/mediatek/mt8186/mt8186-mt6366.c
+index 771d53611c2a4..4c7674917a897 100644
+--- a/sound/soc/mediatek/mt8186/mt8186-mt6366.c
++++ b/sound/soc/mediatek/mt8186/mt8186-mt6366.c
+@@ -362,7 +362,7 @@ static int mt8186_mt6366_rt1019_rt5682s_hdmi_init(struct snd_soc_pcm_runtime *rt
+ 		return ret;
+ 	}
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret) {
+ 		dev_err(rtd->dev, "HDMI Jack creation failed: %d\n", ret);
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8188/mt8188-mt6359.c b/sound/soc/mediatek/mt8188/mt8188-mt6359.c
+index 62429e8e57b55..bd61e3baab9d0 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-mt6359.c
++++ b/sound/soc/mediatek/mt8188/mt8188-mt6359.c
+@@ -244,14 +244,14 @@ enum mt8188_jacks {
+ static struct snd_soc_jack_pin mt8188_hdmi_jack_pins[] = {
+ 	{
+ 		.pin = "HDMI",
+-		.mask = SND_JACK_LINEOUT,
++		.mask = SND_JACK_AVOUT,
+ 	},
+ };
+ 
+ static struct snd_soc_jack_pin mt8188_dp_jack_pins[] = {
+ 	{
+ 		.pin = "DP",
+-		.mask = SND_JACK_LINEOUT,
++		.mask = SND_JACK_AVOUT,
+ 	},
+ };
+ 
+@@ -588,7 +588,7 @@ static int mt8188_hdmi_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 	int ret = 0;
+ 
+ 	ret = snd_soc_card_jack_new_pins(rtd->card, "HDMI Jack",
+-					 SND_JACK_LINEOUT, jack,
++					 SND_JACK_AVOUT, jack,
+ 					 mt8188_hdmi_jack_pins,
+ 					 ARRAY_SIZE(mt8188_hdmi_jack_pins));
+ 	if (ret) {
+@@ -613,7 +613,7 @@ static int mt8188_dptx_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret = 0;
+ 
+-	ret = snd_soc_card_jack_new_pins(rtd->card, "DP Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new_pins(rtd->card, "DP Jack", SND_JACK_AVOUT,
+ 					 jack, mt8188_dp_jack_pins,
+ 					 ARRAY_SIZE(mt8188_dp_jack_pins));
+ 	if (ret) {
+diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+index 943f811684037..dd1d43ce2af62 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
++++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+@@ -368,7 +368,7 @@ static int mt8192_mt6359_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret) {
+ 		dev_err(rtd->dev, "HDMI Jack creation failed: %d\n", ret);
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8195/mt8195-mt6359.c b/sound/soc/mediatek/mt8195/mt8195-mt6359.c
+index 400cec09c3a3c..00627e678d60b 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-mt6359.c
++++ b/sound/soc/mediatek/mt8195/mt8195-mt6359.c
+@@ -357,7 +357,7 @@ static int mt8195_dptx_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "DP Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "DP Jack", SND_JACK_AVOUT, jack);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -372,7 +372,7 @@ static int mt8195_hdmi_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch b/queue-6.12/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
new file mode 100644
index 0000000000..552a985001
--- /dev/null
+++ b/queue-6.12/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
@@ -0,0 +1,47 @@
+From 97d67a43f30820f37b2ad3c3178b25e50d18ba63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 16:43:40 +0100
+Subject: ASoC: qcom: sc8280xp: explicitly set S16LE format in
+ sc8280xp_be_hw_params_fixup()
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
+
+Setting format to s16le is required for compressed playback on compatible
+soundcards.
+
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sc8280xp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
+index 922ecada1cd8d..916a156f991fa 100644
+--- a/sound/soc/qcom/sc8280xp.c
++++ b/sound/soc/qcom/sc8280xp.c
+@@ -7,6 +7,7 @@
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+ #include <sound/pcm.h>
++#include <sound/pcm_params.h>
+ #include <linux/soundwire/sdw.h>
+ #include <sound/jack.h>
+ #include <linux/input-event-codes.h>
+@@ -82,8 +83,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+ 					SNDRV_PCM_HW_PARAM_RATE);
+ 	struct snd_interval *channels = hw_param_interval(params,
+ 					SNDRV_PCM_HW_PARAM_CHANNELS);
++	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+ 
+ 	rate->min = rate->max = 48000;
++	snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
+ 	channels->min = 2;
+ 	channels->max = 2;
+ 	switch (cpu_dai->id) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch b/queue-6.12/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
new file mode 100644
index 0000000000..aabb395b01
--- /dev/null
+++ b/queue-6.12/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
@@ -0,0 +1,101 @@
+From 26f85bf96af63962a7175ddc90070b6faa090591 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 13:53:03 +0300
+Subject: ASoC: SOF: ipc4-pcm: Add fixup for channels
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 6ad299a9b968e1c63988e2a327295e522cf6bbf5 ]
+
+We can have modules in path which can change the number of channels and in
+this case the BE params needs to be adjusted to configure the DAI according
+to the copier configuration.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Message-ID: <20250829105305.31818-2-peter.ujfalusi@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-pcm.c | 56 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 56 insertions(+)
+
+diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
+index b11279f9d3c97..5e877dc921b1e 100644
+--- a/sound/soc/sof/ipc4-pcm.c
++++ b/sound/soc/sof/ipc4-pcm.c
+@@ -675,6 +675,58 @@ static int sof_ipc4_pcm_dai_link_fixup_rate(struct snd_sof_dev *sdev,
+ 	return 0;
+ }
+ 
++static int sof_ipc4_pcm_dai_link_fixup_channels(struct snd_sof_dev *sdev,
++						struct snd_pcm_hw_params *params,
++						struct sof_ipc4_copier *ipc4_copier)
++{
++	struct sof_ipc4_pin_format *pin_fmts = ipc4_copier->available_fmt.input_pin_fmts;
++	struct snd_interval *channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
++	int num_input_formats = ipc4_copier->available_fmt.num_input_formats;
++	unsigned int fe_channels = params_channels(params);
++	bool fe_be_match = false;
++	bool single_be_channels = true;
++	unsigned int be_channels, val;
++	int i;
++
++	if (WARN_ON_ONCE(!num_input_formats))
++		return -EINVAL;
++
++	/*
++	 * Copier does not change channels, so we
++	 * need to only consider the input pin information.
++	 */
++	be_channels = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(pin_fmts[0].audio_fmt.fmt_cfg);
++	for (i = 0; i < num_input_formats; i++) {
++		val = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(pin_fmts[i].audio_fmt.fmt_cfg);
++
++		if (val != be_channels)
++			single_be_channels = false;
++
++		if (val == fe_channels) {
++			fe_be_match = true;
++			break;
++		}
++	}
++
++	/*
++	 * If channels is different than FE channels, topology must contain a
++	 * module which can change the number of channels. But we do require
++	 * topology to define a single channels in the DAI copier config in
++	 * this case (FE channels may be variable).
++	 */
++	if (!fe_be_match) {
++		if (!single_be_channels) {
++			dev_err(sdev->dev, "Unable to select channels for DAI link\n");
++			return -EINVAL;
++		}
++
++		channels->min = be_channels;
++		channels->max = be_channels;
++	}
++
++	return 0;
++}
++
+ static int sof_ipc4_pcm_dai_link_fixup(struct snd_soc_pcm_runtime *rtd,
+ 				       struct snd_pcm_hw_params *params)
+ {
+@@ -738,6 +790,10 @@ static int sof_ipc4_pcm_dai_link_fixup(struct snd_soc_pcm_runtime *rtd,
+ 	if (ret)
+ 		return ret;
+ 
++	ret = sof_ipc4_pcm_dai_link_fixup_channels(sdev, params, ipc4_copier);
++	if (ret)
++		return ret;
++
+ 	if (single_bitdepth) {
+ 		snd_mask_none(fmt);
+ 		valid_bits = SOF_IPC4_AUDIO_FORMAT_CFG_V_BIT_DEPTH(ipc4_fmt->fmt_cfg);
+-- 
+2.51.0
+
diff --git a/queue-6.12/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch b/queue-6.12/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
new file mode 100644
index 0000000000..6136c8899a
--- /dev/null
+++ b/queue-6.12/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
@@ -0,0 +1,49 @@
+From c338e671f4e2626e10e6783d7396bd5dbb5da889 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:31:18 +0200
+Subject: ASoC: stm32: sai: manage context in set_sysclk callback
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 ]
+
+The mclk direction now needs to be specified in endpoint node with
+"system-clock-direction-out" property. However some calls to the
+set_sysclk callback, related to CPU DAI clock, result in unbalanced
+calls to clock API.
+The set_sysclk callback in STM32 SAI driver is intended only for mclk
+management. So it is relevant to ensure that calls to set_sysclk are
+related to mclk only.
+Since the master clock is handled only at runtime, skip the calls to
+set_sysclk in the initialization phase.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Link: https://patch.msgid.link/20250916123118.84175-1-olivier.moysan@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 5828f9dd866e4..5938d6361e1ec 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -551,6 +551,14 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
+ 	struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+ 	int ret;
+ 
++	/*
++	 * The mclk rate is determined at runtime from the audio stream rate.
++	 * Skip calls to the set_sysclk callback that are not relevant during the
++	 * initialization phase.
++	 */
++	if (!snd_soc_card_is_instantiated(cpu_dai->component->card))
++		return 0;
++
+ 	if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) {
+ 		ret = stm32_sai_sub_reg_up(sai, STM_SAI_CR1_REGX,
+ 					   SAI_XCR1_NODIV,
+-- 
+2.51.0
+
diff --git a/queue-6.12/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch b/queue-6.12/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
new file mode 100644
index 0000000000..2d2774fb5f
--- /dev/null
+++ b/queue-6.12/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
@@ -0,0 +1,99 @@
+From e9ab598b40328283a362b1d0612777f5b40f6982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:59:29 +0200
+Subject: ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
+
+From: Primoz Fiser <primoz.fiser@norik.com>
+
+[ Upstream commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e ]
+
+The problem of having class-D initialization sequence in probe using
+regmap_register_patch() is that it will do hardware register writes
+immediately after being called as it bypasses regcache. Afterwards, in
+aic3x_init() we also perform codec soft reset, rendering class-D init
+sequence pointless. This issue is even more apparent when using reset
+GPIO line, since in that case class-D amplifier initialization fails
+with "Failed to init class D: -5" message as codec is already held in
+reset state after requesting the reset GPIO and hence hardware I/O
+fails with -EIO errno.
+
+Thus move class-D amplifier initialization sequence from probe function
+to aic3x_set_power() just before the usual regcache sync. Use bypassed
+regmap_multi_reg_write_bypassed() function to make sure, class-D init
+sequence is performed in proper order as described in the datasheet.
+
+Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250925085929.2581749-1-primoz.fiser@norik.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic3x.c | 32 ++++++++++++++------------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index 56e795a00e22f..591f6c9f9d3a6 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -121,6 +121,16 @@ static const struct reg_default aic3x_reg[] = {
+ 	{ 108, 0x00 }, { 109, 0x00 },
+ };
+ 
++static const struct reg_sequence aic3007_class_d[] = {
++	/* Class-D speaker driver init; datasheet p. 46 */
++	{ AIC3X_PAGE_SELECT, 0x0D },
++	{ 0xD, 0x0D },
++	{ 0x8, 0x5C },
++	{ 0x8, 0x5D },
++	{ 0x8, 0x5C },
++	{ AIC3X_PAGE_SELECT, 0x00 },
++};
++
+ static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
+ {
+ 	switch (reg) {
+@@ -1393,6 +1403,10 @@ static int aic3x_set_power(struct snd_soc_component *component, int power)
+ 			gpiod_set_value(aic3x->gpio_reset, 0);
+ 		}
+ 
++		if (aic3x->model == AIC3X_MODEL_3007)
++			regmap_multi_reg_write_bypassed(aic3x->regmap, aic3007_class_d,
++							ARRAY_SIZE(aic3007_class_d));
++
+ 		/* Sync reg_cache with the hardware */
+ 		regcache_cache_only(aic3x->regmap, false);
+ 		regcache_sync(aic3x->regmap);
+@@ -1723,17 +1737,6 @@ static void aic3x_configure_ocmv(struct device *dev, struct aic3x_priv *aic3x)
+ 	}
+ }
+ 
+-
+-static const struct reg_sequence aic3007_class_d[] = {
+-	/* Class-D speaker driver init; datasheet p. 46 */
+-	{ AIC3X_PAGE_SELECT, 0x0D },
+-	{ 0xD, 0x0D },
+-	{ 0x8, 0x5C },
+-	{ 0x8, 0x5D },
+-	{ 0x8, 0x5C },
+-	{ AIC3X_PAGE_SELECT, 0x00 },
+-};
+-
+ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver_data)
+ {
+ 	struct aic3x_priv *aic3x;
+@@ -1825,13 +1828,6 @@ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver
+ 
+ 	aic3x_configure_ocmv(dev, aic3x);
+ 
+-	if (aic3x->model == AIC3X_MODEL_3007) {
+-		ret = regmap_register_patch(aic3x->regmap, aic3007_class_d,
+-					    ARRAY_SIZE(aic3007_class_d));
+-		if (ret != 0)
+-			dev_err(dev, "Failed to init class D: %d\n", ret);
+-	}
+-
+ 	ret = devm_snd_soc_register_component(dev, &soc_component_dev_aic3x, &aic3x_dai, 1);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.12/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-6.12/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..d081ef8ab8
--- /dev/null
+++ b/queue-6.12/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From 9595a4f66bd4a9e5afaaa410716f83892201c8a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 76878119d910c..6cb904b7b643c 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch b/queue-6.12/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
new file mode 100644
index 0000000000..1b901fb9d5
--- /dev/null
+++ b/queue-6.12/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
@@ -0,0 +1,77 @@
+From 1e12aac93ebd63ab2db75941c723382ce24faee5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 19:46:11 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
+
+From: Chris Lu <chris.lu@mediatek.com>
+
+[ Upstream commit 70cd38d22d4659ca8133c7124528c90678215dda ]
+
+Add VID 13d3 & PID 3633 for MediaTek MT7922 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T:  Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=13d3 ProdID=3633 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Chris Lu <chris.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index cf5b2a617c771..a734c5135a8be 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -689,6 +689,8 @@ static const struct usb_device_id quirks_table[] = {
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3615), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
++	{ USB_DEVICE(0x13d3, 0x3633), .driver_info = BTUSB_MEDIATEK |
++						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x35f5, 0x7922), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch b/queue-6.12/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
new file mode 100644
index 0000000000..d9694e4de0
--- /dev/null
+++ b/queue-6.12/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
@@ -0,0 +1,122 @@
+From 860fa06ef5e64cddf925c497d53ccb75576581de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 18:40:16 +0200
+Subject: Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI
+ frames
+
+From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+
+[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
+
+Some Barrot based USB Bluetooth dongles erroneously send one extra
+random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The
+consequence of that is that the next HCI transfer is misaligned by one
+byte causing undefined behavior. In most cases the response event for
+the next command fails with random error code.
+
+Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI
+controller initialization, the initialization fails rendering the USB
+dongle not usable.
+
+> [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd
+> [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter
+> [61.720116] Bluetooth: hci1: command 0x1005 tx timeout
+> [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
+
+This patch was tested with the 33fa:0012 device. The info from the
+/sys/kernel/debug/usb/devices is shown below:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=33fa ProdID=0012 Rev=88.91
+S:  Product=UGREEN BT6.0 Adapter
+C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Now the device is initialized properly:
+
+> [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg
+> [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter
+> [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.750141] Bluetooth: MGMT ver 1.23
+
+Link: https://github.com/bluez/bluez/issues/1326
+Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Tested-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c07d57eaca3bf..cf5b2a617c771 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -65,6 +65,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
+ #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
++#define BTUSB_BARROT			BIT(28)
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -796,6 +797,10 @@ static const struct usb_device_id quirks_table[] = {
+ 	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
++	/* Barrot Technology Bluetooth devices */
++	{ USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT },
++	{ USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT },
++
+ 	/* Actions Semiconductor ATS2851 based devices */
+ 	{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
+ 
+@@ -1193,6 +1198,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
+ 		}
+ 
+ 		if (!hci_skb_expect(skb)) {
++			/* Each chunk should correspond to at least 1 or more
++			 * events so if there are still bytes left that doesn't
++			 * constitute a new event this is likely a bug in the
++			 * controller.
++			 */
++			if (count && count < HCI_EVENT_HDR_SIZE) {
++				bt_dev_warn(data->hdev,
++					"Unexpected continuation: %d bytes",
++					count);
++				count = 0;
++			}
++
+ 			/* Complete frame */
+ 			btusb_recv_event(data, skb);
+ 			skb = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.12/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-6.12/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..b12d5427ce
--- /dev/null
+++ b/queue-6.12/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From ed14d15009a92aa23ed9bc3b3f5f2ada61becdd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index b872a2ca3ff38..202d75ad0dc39 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -434,6 +434,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-6.12/bnxt_en-add-hyper-v-vf-id.patch b/queue-6.12/bnxt_en-add-hyper-v-vf-id.patch
new file mode 100644
index 0000000000..f5eaa2a31c
--- /dev/null
+++ b/queue-6.12/bnxt_en-add-hyper-v-vf-id.patch
@@ -0,0 +1,69 @@
+From 507b2a44340bd87d0ee6aa521beb7ad330357371 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:39:19 -0700
+Subject: bnxt_en: Add Hyper-V VF ID
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+[ Upstream commit 5be7cb805bd9a6680b863a1477dbc6e7986cc223 ]
+
+VFs of the P7 chip family created by Hyper-V will have the device ID of
+0x181b.
+
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250819163919.104075-6-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++-
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 8a6f3e230fce6..30d8e8b34dfb9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -139,6 +139,7 @@ static const struct {
+ 	[NETXTREME_E_P5_VF] = { "Broadcom BCM5750X NetXtreme-E Ethernet Virtual Function" },
+ 	[NETXTREME_E_P5_VF_HV] = { "Broadcom BCM5750X NetXtreme-E Virtual Function for Hyper-V" },
+ 	[NETXTREME_E_P7_VF] = { "Broadcom BCM5760X Virtual Function" },
++	[NETXTREME_E_P7_VF_HV] = { "Broadcom BCM5760X Virtual Function for Hyper-V" },
+ };
+ 
+ static const struct pci_device_id bnxt_pci_tbl[] = {
+@@ -214,6 +215,7 @@ static const struct pci_device_id bnxt_pci_tbl[] = {
+ 	{ PCI_VDEVICE(BROADCOM, 0x1808), .driver_data = NETXTREME_E_P5_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0x1809), .driver_data = NETXTREME_E_P5_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0x1819), .driver_data = NETXTREME_E_P7_VF },
++	{ PCI_VDEVICE(BROADCOM, 0x181b), .driver_data = NETXTREME_E_P7_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0xd800), .driver_data = NETXTREME_S_VF },
+ #endif
+ 	{ 0 }
+@@ -297,7 +299,8 @@ static bool bnxt_vf_pciid(enum board_idx idx)
+ 	return (idx == NETXTREME_C_VF || idx == NETXTREME_E_VF ||
+ 		idx == NETXTREME_S_VF || idx == NETXTREME_C_VF_HV ||
+ 		idx == NETXTREME_E_VF_HV || idx == NETXTREME_E_P5_VF ||
+-		idx == NETXTREME_E_P5_VF_HV || idx == NETXTREME_E_P7_VF);
++		idx == NETXTREME_E_P5_VF_HV || idx == NETXTREME_E_P7_VF ||
++		idx == NETXTREME_E_P7_VF_HV);
+ }
+ 
+ #define DB_CP_REARM_FLAGS	(DB_KEY_CP | DB_IDX_VALID)
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 1758edcd1db42..cb934f175a3e4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -2096,6 +2096,7 @@ enum board_idx {
+ 	NETXTREME_E_P5_VF,
+ 	NETXTREME_E_P5_VF_HV,
+ 	NETXTREME_E_P7_VF,
++	NETXTREME_E_P7_VF_HV,
+ };
+ 
+ struct bnxt {
+-- 
+2.51.0
+
diff --git a/queue-6.12/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-6.12/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..7621fad7c0
--- /dev/null
+++ b/queue-6.12/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From aa63ff499ec06ac40d43c53ee1f743ff6cae61f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index e19b583ff2c6d..49dd8cd526f46 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-6.12/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch b/queue-6.12/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
new file mode 100644
index 0000000000..b4e7ee8b04
--- /dev/null
+++ b/queue-6.12/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
@@ -0,0 +1,56 @@
+From a6881c3ca18ce77001a2c12b41244a91cb432855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 18:18:09 +0530
+Subject: bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
+
+From: Vivek Pernamitta <quic_vpernami@quicinc.com>
+
+[ Upstream commit aa1a0e93ed21a06acb7ca9d4a4a9fce75ea53d0c ]
+
+Allow mhi_sync_power_up to handle SYS_ERR during power-up, reboot,
+or recovery. This is to avoid premature exit when MHI_PM_IN_ERROR_STATE is
+observed during above mentioned system states.
+
+To achieve this, treat SYS_ERR as a valid state and let its handler process
+the error and queue the next transition to Mission Mode instead of aborting
+early.
+
+Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-5-fa2f6ccd301b@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/host/internal.h | 2 ++
+ drivers/bus/mhi/host/pm.c       | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/mhi/host/internal.h b/drivers/bus/mhi/host/internal.h
+index 762df4bb7f646..e8b68c0fec7b0 100644
+--- a/drivers/bus/mhi/host/internal.h
++++ b/drivers/bus/mhi/host/internal.h
+@@ -163,6 +163,8 @@ enum mhi_pm_state {
+ 							MHI_PM_IN_ERROR_STATE(pm_state))
+ #define MHI_PM_IN_SUSPEND_STATE(pm_state)		(pm_state & \
+ 							(MHI_PM_M3_ENTER | MHI_PM_M3))
++#define MHI_PM_FATAL_ERROR(pm_state)			((pm_state == MHI_PM_FW_DL_ERR) || \
++							(pm_state >= MHI_PM_SYS_ERR_FAIL))
+ 
+ #define NR_OF_CMD_RINGS					1
+ #define CMD_EL_PER_RING					128
+diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c
+index 0ccbcb717955a..8f32dd0a2f218 100644
+--- a/drivers/bus/mhi/host/pm.c
++++ b/drivers/bus/mhi/host/pm.c
+@@ -1279,7 +1279,7 @@ int mhi_sync_power_up(struct mhi_controller *mhi_cntrl)
+ 		mhi_cntrl->ready_timeout_ms : mhi_cntrl->timeout_ms;
+ 	wait_event_timeout(mhi_cntrl->state_event,
+ 			   MHI_IN_MISSION_MODE(mhi_cntrl->ee) ||
+-			   MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state),
++			   MHI_PM_FATAL_ERROR(mhi_cntrl->pm_state),
+ 			   msecs_to_jiffies(timeout_ms));
+ 
+ 	ret = (MHI_IN_MISSION_MODE(mhi_cntrl->ee)) ? 0 : -ETIMEDOUT;
+-- 
+2.51.0
+
diff --git a/queue-6.12/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-6.12/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..4666b79f4a
--- /dev/null
+++ b/queue-6.12/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From d43cf69fe7a2d990ff96e7a793a8c3e68668b571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 9ee78c76e8663..6f9ce6b3cc5a6 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -150,7 +150,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		break;
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -162,10 +163,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 			new_fops = fops_get(iter->fops);
+ 			break;
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-6.12/char-misc-make-misc_register-reentry-for-miscdevice-.patch b/queue-6.12/char-misc-make-misc_register-reentry-for-miscdevice-.patch
new file mode 100644
index 0000000000..4e81d3c21f
--- /dev/null
+++ b/queue-6.12/char-misc-make-misc_register-reentry-for-miscdevice-.patch
@@ -0,0 +1,71 @@
+From c067b1aa82488d19f48917fa98387d3aa0589999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:16 +0800
+Subject: char: misc: Make misc_register() reentry for miscdevice who wants
+ dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 52e2bb5ff089d65e2c7d982fe2826dc88e473d50 ]
+
+For miscdevice who wants dynamic minor, it may fail to be registered again
+without reinitialization after being de-registered, which is illustrated
+by kunit test case miscdev_test_dynamic_reentry() newly added.
+
+There is a real case found by cascardo when a part of minor range were
+contained by range [0, 255):
+
+1) wmi/dell-smbios registered minor 122, and acpi_thermal_rel registered
+   minor 123
+2) unbind "int3400 thermal" driver from its device, this will de-register
+   acpi_thermal_rel
+3) rmmod then insmod dell_smbios again, now wmi/dell-smbios is using minor
+   123
+4) bind the device to "int3400 thermal" driver again, acpi_thermal_rel
+   fails to register.
+
+Some drivers may reuse the miscdevice structure after they are deregistered
+If the intention is to allocate a dynamic minor, if the minor number is not
+reset to MISC_DYNAMIC_MINOR before calling misc_register(), it will try to
+register a previously dynamically allocated minor number, which may have
+been registered by a different driver.
+
+One such case is the acpi_thermal_rel misc device, registered by the
+int3400 thermal driver. If the device is unbound from the driver and later
+bound, if there was another dynamic misc device registered in between, it
+would fail to register the acpi_thermal_rel misc device. Other drivers
+behave similarly.
+
+Actually, this kind of issue is prone to happen if APIs
+misc_register()/misc_deregister() are invoked by driver's
+probe()/remove() separately.
+
+Instead of fixing all the drivers, just reset the minor member to
+MISC_DYNAMIC_MINOR in misc_deregister() in case it was a dynamically
+allocated minor number, as error handling of misc_register() does.
+
+Cc: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-5-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 30178e20d962d..9ee78c76e8663 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -300,6 +300,8 @@ void misc_deregister(struct miscdevice *misc)
+ 	list_del(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
++	if (misc->minor > MISC_DYNAMIC_MINOR)
++		misc->minor = MISC_DYNAMIC_MINOR;
+ 	mutex_unlock(&misc_mtx);
+ }
+ EXPORT_SYMBOL(misc_deregister);
+-- 
+2.51.0
+
diff --git a/queue-6.12/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch b/queue-6.12/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
new file mode 100644
index 0000000000..e1132f7230
--- /dev/null
+++ b/queue-6.12/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
@@ -0,0 +1,100 @@
+From 369c66b60ce4fd42e6be09e625f83f446f271bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 05:45:42 -0300
+Subject: char: misc: restrict the dynamic range to exclude reserved minors
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 31b636d2c41613e3bd36256a4bd53e9dacfa2677 ]
+
+When this was first reported [1], the possibility of having sufficient
+number of dynamic misc devices was theoretical, in the case of dlm driver.
+In practice, its userspace never created more than one device.
+
+What we know from commit ab760791c0cf ("char: misc: Increase the maximum
+number of dynamic misc devices to 1048448"), is that the miscdevice
+interface has been used for allocating more than the single-shot devices it
+was designed for. And it is not only coresight_tmc, but many other drivers
+are able to create multiple devices.
+
+On systems like the ones described in the above commit, it is certain that
+the dynamic allocation will allocate certain reserved minor numbers,
+leading to failures when a later driver tries to claim its reserved number.
+
+Instead of excluding the historically statically allocated range from
+dynamic allocation, restrict the latter to minors above 255. That also
+removes the need for DYNAMIC_MINORS and the convolution in allocating minor
+numbers, simplifying the code.
+
+Since commit ab760791c0cf ("char: misc: Increase the maximum number of
+dynamic misc devices to 1048448") has been applied, such range is already
+possible. And given such devices already need to be dynamically created,
+there should be no systems where this might become a problem.
+
+[1] https://lore.kernel.org/all/1257813017-28598-3-git-send-email-cascardo@holoscopio.com/
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Link: https://lore.kernel.org/r/20250423-misc-dynrange-v4-1-133b5ae4ca18@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 28 +++++-----------------------
+ 1 file changed, 5 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 792a1412faffe..8d8c4bcf07e1c 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -58,9 +58,8 @@ static LIST_HEAD(misc_list);
+ static DEFINE_MUTEX(misc_mtx);
+ 
+ /*
+- * Assigned numbers, used for dynamic minors
++ * Assigned numbers.
+  */
+-#define DYNAMIC_MINORS 128 /* like dynamic majors */
+ static DEFINE_IDA(misc_minors_ida);
+ 
+ static int misc_minor_alloc(int minor)
+@@ -69,34 +68,17 @@ static int misc_minor_alloc(int minor)
+ 
+ 	if (minor == MISC_DYNAMIC_MINOR) {
+ 		/* allocate free id */
+-		ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL);
+-		if (ret >= 0) {
+-			ret = DYNAMIC_MINORS - ret - 1;
+-		} else {
+-			ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
+-					      MINORMASK, GFP_KERNEL);
+-		}
++		ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
++				      MINORMASK, GFP_KERNEL);
+ 	} else {
+-		/* specific minor, check if it is in dynamic or misc dynamic range  */
+-		if (minor < DYNAMIC_MINORS) {
+-			minor = DYNAMIC_MINORS - minor - 1;
+-			ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+-		} else if (minor > MISC_DYNAMIC_MINOR) {
+-			ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+-		} else {
+-			/* case of non-dynamic minors, no need to allocate id */
+-			ret = 0;
+-		}
++		ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+ 	}
+ 	return ret;
+ }
+ 
+ static void misc_minor_free(int minor)
+ {
+-	if (minor < DYNAMIC_MINORS)
+-		ida_free(&misc_minors_ida, DYNAMIC_MINORS - minor - 1);
+-	else if (minor > MISC_DYNAMIC_MINOR)
+-		ida_free(&misc_minors_ida, minor);
++	ida_free(&misc_minors_ida, minor);
+ }
+ 
+ #ifdef CONFIG_PROC_FS
+-- 
+2.51.0
+
diff --git a/queue-6.12/char-use-list_del_init-in-misc_deregister-to-reiniti.patch b/queue-6.12/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
new file mode 100644
index 0000000000..2d070ecb03
--- /dev/null
+++ b/queue-6.12/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
@@ -0,0 +1,52 @@
+From eef11db45b9f940eeb565898d5d5f560459fe3eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 14:37:04 +0800
+Subject: char: Use list_del_init() in misc_deregister() to reinitialize list
+ pointer
+
+From: Xion Wang <xion.wang@mediatek.com>
+
+[ Upstream commit e28022873c0d051e980c4145f1965cab5504b498 ]
+
+Currently, misc_deregister() uses list_del() to remove the device
+from the list. After list_del(), the list pointers are set to
+LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs,
+but does not reset the list head.
+If misc_deregister() is called more than once on the same device,
+list_empty() will not return true, and list_del() may be called again,
+leading to undefined behavior.
+
+Replace list_del() with list_del_init() to reinitialize the list head
+after deletion. This makes the code more robust against double
+deregistration and allows safe usage of list_empty() on the miscdevice
+after deregistration.
+
+[ Note, this seems to keep broken out-of-tree drivers from doing foolish
+  things.  While this does not matter for any in-kernel drivers,
+  external drivers could use a bit of help to show them they shouldn't
+  be doing stuff like re-registering misc devices - gregkh ]
+
+Signed-off-by: Xion Wang <xion.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 6f9ce6b3cc5a6..792a1412faffe 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -299,7 +299,7 @@ void misc_deregister(struct miscdevice *misc)
+ 		return;
+ 
+ 	mutex_lock(&misc_mtx);
+-	list_del(&misc->list);
++	list_del_init(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
+ 	if (misc->minor > MISC_DYNAMIC_MINOR)
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-caam-double-the-entropy-delay-interval-for-re.patch b/queue-6.12/crypto-caam-double-the-entropy-delay-interval-for-re.patch
new file mode 100644
index 0000000000..9657eed06c
--- /dev/null
+++ b/queue-6.12/crypto-caam-double-the-entropy-delay-interval-for-re.patch
@@ -0,0 +1,49 @@
+From 275513bfe7c1566a1f293f7d7eed8f555242a428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:41:48 +0530
+Subject: crypto: caam - double the entropy delay interval for retry
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit 9048beca9c5614d486e2b492c0a7867164bf56a8 ]
+
+during entropy evaluation, if the generated samples fail
+any statistical test, then, all of the bits will be discarded,
+and a second set of samples will be generated and tested.
+
+the entropy delay interval should be doubled before performing the
+retry.
+
+also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG
+status register, but only inst_handles is updated before every retry.
+so only check inst_handles and removing ctrlpriv->rng4_sh_init
+
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/ctrl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index 707760fa1978e..d76bc94ba5054 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -702,12 +702,12 @@ static int caam_ctrl_rng_init(struct device *dev)
+ 			 */
+ 			if (needs_entropy_delay_adjustment())
+ 				ent_delay = 12000;
+-			if (!(ctrlpriv->rng4_sh_init || inst_handles)) {
++			if (!inst_handles) {
+ 				dev_info(dev,
+ 					 "Entropy delay = %u\n",
+ 					 ent_delay);
+ 				kick_trng(dev, ent_delay);
+-				ent_delay += 400;
++				ent_delay = ent_delay * 2;
+ 			}
+ 			/*
+ 			 * if instantiate_rng(...) fails, the loop will rerun
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch b/queue-6.12/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
new file mode 100644
index 0000000000..71df15c31d
--- /dev/null
+++ b/queue-6.12/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
@@ -0,0 +1,44 @@
+From 63975435dfbe8d58f31ccf68d74b09576160de29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 22:16:43 +0900
+Subject: crypto: ccp - Fix incorrect payload size calculation in
+ psp_poulate_hsti()
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 2b0dc40ac6ca16ee0c489927f4856cf9cd3874c7 ]
+
+payload_size field of the request header is incorrectly calculated using
+sizeof(req). Since 'req' is a pointer (struct hsti_request *), sizeof(req)
+returns the size of the pointer itself (e.g., 8 bytes on a 64-bit system),
+rather than the size of the structure it points to. This leads to an
+incorrect payload size being sent to the Platform Security Processor (PSP),
+potentially causing the HSTI query command to fail.
+
+Fix this by using sizeof(*req) to correctly calculate the size of the
+struct hsti_request.
+
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/hsti.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/hsti.c b/drivers/crypto/ccp/hsti.c
+index 1b39a4fb55c06..0e6b73b55dbf7 100644
+--- a/drivers/crypto/ccp/hsti.c
++++ b/drivers/crypto/ccp/hsti.c
+@@ -88,7 +88,7 @@ static int psp_poulate_hsti(struct psp_device *psp)
+ 	if (!req)
+ 		return -ENOMEM;
+ 
+-	req->header.payload_size = sizeof(req);
++	req->header.payload_size = sizeof(*req);
+ 
+ 	ret = psp_send_platform_access_msg(PSP_CMD_HSTI_QUERY, (struct psp_request *)req);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch b/queue-6.12/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
new file mode 100644
index 0000000000..cc1a191018
--- /dev/null
+++ b/queue-6.12/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
@@ -0,0 +1,58 @@
+From 0626d90fe7f7ed181a99a7ebc9f2c0ed0e3e894b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:38 +0000
+Subject: crypto: ccp: Skip SEV and SNP INIT for kdump boot
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 8c571019d8a817b701888926529a5d7a826b947b ]
+
+Since SEV or SNP may already be initialized in the previous kernel,
+attempting to initialize them again in the kdump kernel can result
+in SNP initialization failures, which in turn lead to IOMMU
+initialization failures. Moreover, SNP/SEV guests are not run under a
+kdump kernel, so there is no need to initialize SEV or SNP during
+kdump boot.
+
+Skip SNP and SEV INIT if doing kdump boot.
+
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/d884eff5f6180d8b8c6698a6168988118cf9cba1.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 4d072c084d7b0..bc0ecdb5c79e5 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -28,6 +28,7 @@
+ #include <linux/fs_struct.h>
+ #include <linux/psp.h>
+ #include <linux/amd-iommu.h>
++#include <linux/crash_dump.h>
+ 
+ #include <asm/smp.h>
+ #include <asm/cacheflush.h>
+@@ -1314,6 +1315,15 @@ static int _sev_platform_init_locked(struct sev_platform_init_args *args)
+ 	if (!psp_master || !psp_master->sev_data)
+ 		return -ENODEV;
+ 
++	/*
++	 * Skip SNP/SEV initialization under a kdump kernel as SEV/SNP
++	 * may already be initialized in the previous kernel. Since no
++	 * SNP/SEV guests are run under a kdump kernel, there is no
++	 * need to initialize SNP or SEV during kdump boot.
++	 */
++	if (is_kdump_kernel())
++		return 0;
++
+ 	sev = psp_master->sev_data;
+ 
+ 	if (sev->state == SEV_STATE_INIT)
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch b/queue-6.12/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
new file mode 100644
index 0000000000..38ee1b97f1
--- /dev/null
+++ b/queue-6.12/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
@@ -0,0 +1,87 @@
+From 588a433255482ab1b1fbf66b71f4aeefab9a1725 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:53 +0800
+Subject: crypto: hisilicon/qm - clear all VF configurations in the hardware
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 64b9642fc29a14e1fe67842be9c69c7b90a3bcd6 ]
+
+When disabling SR-IOV, clear the configuration of each VF
+in the hardware. Do not exit the configuration clearing process
+due to the failure of a single VF. Additionally, Clear the VF
+configurations before decrementing the PM counter.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 73eea2ee1b9b9..35b95996ef82c 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3475,19 +3475,19 @@ static int qm_vf_q_assign(struct hisi_qm *qm, u32 num_vfs)
+ 	return 0;
+ }
+ 
+-static int qm_clear_vft_config(struct hisi_qm *qm)
++static void qm_clear_vft_config(struct hisi_qm *qm)
+ {
+-	int ret;
+ 	u32 i;
+ 
+-	for (i = 1; i <= qm->vfs_num; i++) {
+-		ret = hisi_qm_set_vft(qm, i, 0, 0);
+-		if (ret)
+-			return ret;
+-	}
+-	qm->vfs_num = 0;
++	/*
++	 * When disabling SR-IOV, clear the configuration of each VF in the hardware
++	 * sequentially. Failure to clear a single VF should not affect the clearing
++	 * operation of other VFs.
++	 */
++	for (i = 1; i <= qm->vfs_num; i++)
++		(void)hisi_qm_set_vft(qm, i, 0, 0);
+ 
+-	return 0;
++	qm->vfs_num = 0;
+ }
+ 
+ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)
+@@ -3824,13 +3824,13 @@ int hisi_qm_sriov_enable(struct pci_dev *pdev, int max_vfs)
+ 		goto err_put_sync;
+ 	}
+ 
++	qm->vfs_num = num_vfs;
+ 	ret = pci_enable_sriov(pdev, num_vfs);
+ 	if (ret) {
+ 		pci_err(pdev, "Can't enable VF!\n");
+ 		qm_clear_vft_config(qm);
+ 		goto err_put_sync;
+ 	}
+-	qm->vfs_num = num_vfs;
+ 
+ 	pci_info(pdev, "VF enabled, vfs_num(=%d)!\n", num_vfs);
+ 
+@@ -3865,11 +3865,10 @@ int hisi_qm_sriov_disable(struct pci_dev *pdev, bool is_frozen)
+ 	}
+ 
+ 	pci_disable_sriov(pdev);
+-
+-	qm->vfs_num = 0;
++	qm_clear_vft_config(qm);
+ 	qm_pm_put_sync(qm);
+ 
+-	return qm_clear_vft_config(qm);
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_sriov_disable);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-hisilicon-qm-invalidate-queues-in-use.patch b/queue-6.12/crypto-hisilicon-qm-invalidate-queues-in-use.patch
new file mode 100644
index 0000000000..398c5985e0
--- /dev/null
+++ b/queue-6.12/crypto-hisilicon-qm-invalidate-queues-in-use.patch
@@ -0,0 +1,145 @@
+From 358525800516d4a0f775afb2a044c4f2f49dd79b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:50 +0800
+Subject: crypto: hisilicon/qm - invalidate queues in use
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 85acd1b26b8f5b838887dc965dc3aa2c0253f4d1 ]
+
+Before the device reset, although the driver has set the queue
+status to intercept doorbells sent by the task process, the reset
+thread is isolated from the user-mode task process, so the task process
+may still send doorbells. Therefore, before the reset, the queue is
+directly invalidated, and the device directly discards the doorbells
+sent by the process.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 53 ++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index a9550a05dfbd3..73eea2ee1b9b9 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -47,6 +47,8 @@
+ 
+ #define QM_SQ_TYPE_MASK			GENMASK(3, 0)
+ #define QM_SQ_TAIL_IDX(sqc)		((le16_to_cpu((sqc).w11) >> 6) & 0x1)
++#define QM_SQC_DISABLE_QP		(1U << 6)
++#define QM_XQC_RANDOM_DATA		0xaaaa
+ 
+ /* cqc shift */
+ #define QM_CQ_HOP_NUM_SHIFT		0
+@@ -3008,6 +3010,9 @@ static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm)
+ 
+ 	qm_init_eq_aeq_status(qm);
+ 
++	/* Before starting the dev, clear the memory and then configure to device using. */
++	memset(qm->qdma.va, 0, qm->qdma.size);
++
+ 	ret = qm_eq_ctx_cfg(qm);
+ 	if (ret) {
+ 		dev_err(dev, "Set eqc failed!\n");
+@@ -3019,9 +3024,13 @@ static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm)
+ 
+ static int __hisi_qm_start(struct hisi_qm *qm)
+ {
++	struct device *dev = &qm->pdev->dev;
+ 	int ret;
+ 
+-	WARN_ON(!qm->qdma.va);
++	if (!qm->qdma.va) {
++		dev_err(dev, "qm qdma is NULL!\n");
++		return -EINVAL;
++	}
+ 
+ 	if (qm->fun_type == QM_HW_PF) {
+ 		ret = hisi_qm_set_vft(qm, 0, qm->qp_base, qm->qp_num);
+@@ -3095,7 +3104,7 @@ static int qm_restart(struct hisi_qm *qm)
+ 	for (i = 0; i < qm->qp_num; i++) {
+ 		qp = &qm->qp_array[i];
+ 		if (atomic_read(&qp->qp_status.flags) == QP_STOP &&
+-		    qp->is_resetting == true) {
++		    qp->is_resetting == true && qp->is_in_kernel == true) {
+ 			ret = qm_start_qp_nolock(qp, 0);
+ 			if (ret < 0) {
+ 				dev_err(dev, "Failed to start qp%d!\n", i);
+@@ -3127,24 +3136,44 @@ static void qm_stop_started_qp(struct hisi_qm *qm)
+ }
+ 
+ /**
+- * qm_clear_queues() - Clear all queues memory in a qm.
+- * @qm: The qm in which the queues will be cleared.
++ * qm_invalid_queues() - invalid all queues in use.
++ * @qm: The qm in which the queues will be invalidated.
+  *
+- * This function clears all queues memory in a qm. Reset of accelerator can
+- * use this to clear queues.
++ * This function invalid all queues in use. If the doorbell command is sent
++ * to device in user space after the device is reset, the device discards
++ * the doorbell command.
+  */
+-static void qm_clear_queues(struct hisi_qm *qm)
++static void qm_invalid_queues(struct hisi_qm *qm)
+ {
+ 	struct hisi_qp *qp;
++	struct qm_sqc *sqc;
++	struct qm_cqc *cqc;
+ 	int i;
+ 
++	/*
++	 * Normal stop queues is no longer used and does not need to be
++	 * invalid queues.
++	 */
++	if (qm->status.stop_reason == QM_NORMAL)
++		return;
++
++	if (qm->status.stop_reason == QM_DOWN)
++		hisi_qm_cache_wb(qm);
++
+ 	for (i = 0; i < qm->qp_num; i++) {
+ 		qp = &qm->qp_array[i];
+-		if (qp->is_in_kernel && qp->is_resetting)
++		if (!qp->is_resetting)
++			continue;
++
++		/* Modify random data and set sqc close bit to invalid queue. */
++		sqc = qm->sqc + i;
++		cqc = qm->cqc + i;
++		sqc->w8 = cpu_to_le16(QM_XQC_RANDOM_DATA);
++		sqc->w13 = cpu_to_le16(QM_SQC_DISABLE_QP);
++		cqc->w8 = cpu_to_le16(QM_XQC_RANDOM_DATA);
++		if (qp->is_in_kernel)
+ 			memset(qp->qdma.va, 0, qp->qdma.size);
+ 	}
+-
+-	memset(qm->qdma.va, 0, qm->qdma.size);
+ }
+ 
+ /**
+@@ -3201,7 +3230,7 @@ int hisi_qm_stop(struct hisi_qm *qm, enum qm_stop_reason r)
+ 		}
+ 	}
+ 
+-	qm_clear_queues(qm);
++	qm_invalid_queues(qm);
+ 	qm->status.stop_reason = QM_NORMAL;
+ 
+ err_unlock:
+@@ -4586,8 +4615,6 @@ void hisi_qm_dev_shutdown(struct pci_dev *pdev)
+ 	ret = hisi_qm_stop(qm, QM_DOWN);
+ 	if (ret)
+ 		dev_err(&pdev->dev, "Fail to stop qm in shutdown!\n");
+-
+-	hisi_qm_cache_wb(qm);
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_dev_shutdown);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch b/queue-6.12/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
new file mode 100644
index 0000000000..c11b594f22
--- /dev/null
+++ b/queue-6.12/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
@@ -0,0 +1,43 @@
+From 1b9da6de97a45849971cb8251ec6fe08f6b82424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 22:20:26 +0800
+Subject: crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4c634b6b3c77bba237ee64bca172e73f9cee0cb2 ]
+
+As noted in the kernel documentation [1], open-coded multiplication in
+allocator arguments is discouraged because it can lead to integer overflow.
+
+Use kcalloc() to gain built-in overflow protection, making memory
+allocation safer when calculating allocation size compared to explicit
+multiplication.  Similarly, use size_add() instead of explicit addition
+for 'uobj_chunk_num + sobj_chunk_num'.
+
+Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/qat_uclo.c b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+index 7ea40b4f6e5b4..1bde198c0bc07 100644
+--- a/drivers/crypto/intel/qat/qat_common/qat_uclo.c
++++ b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+@@ -1746,7 +1746,7 @@ static int qat_uclo_map_objs_from_mof(struct icp_qat_mof_handle *mobj_handle)
+ 	if (sobj_hdr)
+ 		sobj_chunk_num = sobj_hdr->num_chunks;
+ 
+-	mobj_hdr = kzalloc((uobj_chunk_num + sobj_chunk_num) *
++	mobj_hdr = kcalloc(size_add(uobj_chunk_num, sobj_chunk_num),
+ 			   sizeof(*mobj_hdr), GFP_KERNEL);
+ 	if (!mobj_hdr)
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.12/crypto-sun8i-ce-remove-channel-timeout-field.patch b/queue-6.12/crypto-sun8i-ce-remove-channel-timeout-field.patch
new file mode 100644
index 0000000000..c7a53591c5
--- /dev/null
+++ b/queue-6.12/crypto-sun8i-ce-remove-channel-timeout-field.patch
@@ -0,0 +1,120 @@
+From 80366c3170247563a382346b74d952f9996a19f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:21:26 +0300
+Subject: crypto: sun8i-ce - remove channel timeout field
+
+From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+
+[ Upstream commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e ]
+
+Using the number of bytes in the request as DMA timeout is really
+inconsistent, as large requests could possibly set a timeout of
+hundreds of seconds.
+
+Remove the per-channel timeout field and use a single, static DMA
+timeout of 3 seconds for all requests.
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+Tested-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Reviewed-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c   | 5 ++---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c   | 2 --
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h        | 2 +-
+ 6 files changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+index 63e66a85477e5..d0ba2b2fb2161 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+@@ -264,7 +264,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req
+ 		goto theend_sgs;
+ 	}
+ 
+-	chan->timeout = areq->cryptlen;
+ 	rctx->nr_sgs = ns;
+ 	rctx->nr_sgd = nd;
+ 	return 0;
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+index fcc6832a065cb..61ae072e21d4c 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+@@ -210,11 +210,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name)
+ 	mutex_unlock(&ce->mlock);
+ 
+ 	wait_for_completion_interruptible_timeout(&ce->chanlist[flow].complete,
+-			msecs_to_jiffies(ce->chanlist[flow].timeout));
++			msecs_to_jiffies(CE_DMA_TIMEOUT_MS));
+ 
+ 	if (ce->chanlist[flow].status == 0) {
+-		dev_err(ce->dev, "DMA timeout for %s (tm=%d) on flow %d\n", name,
+-			ce->chanlist[flow].timeout, flow);
++		dev_err(ce->dev, "DMA timeout for %s on flow %d\n", name, flow);
+ 		err = -EFAULT;
+ 	}
+ 	/* No need to lock for this read, the channel is locked so
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+index 3f9d79ea01aaa..b428497b72a32 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+@@ -457,8 +457,6 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 	else
+ 		cet->t_dlen = cpu_to_le32(areq->nbytes / 4 + j);
+ 
+-	chan->timeout = areq->nbytes;
+-
+ 	err = sun8i_ce_run_task(ce, flow, crypto_ahash_alg_name(tfm));
+ 
+ 	dma_unmap_single(ce->dev, addr_pad, j * 4, DMA_TO_DEVICE);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+index 762459867b6c5..d0a1ac66738bf 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+@@ -137,7 +137,6 @@ int sun8i_ce_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ 
+ 	cet->t_dst[0].addr = desc_addr_val_le32(ce, dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = 2000;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "PRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+index e1e8bc15202e0..244529bf06162 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+@@ -79,7 +79,6 @@ static int sun8i_ce_trng_read(struct hwrng *rng, void *data, size_t max, bool wa
+ 
+ 	cet->t_dst[0].addr = desc_addr_val_le32(ce, dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = todo;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "TRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+index 83df4d7190531..4afca65d3355c 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+@@ -106,6 +106,7 @@
+ #define MAX_SG 8
+ 
+ #define CE_MAX_CLOCKS 4
++#define CE_DMA_TIMEOUT_MS	3000
+ 
+ #define MAXFLOW 4
+ 
+@@ -196,7 +197,6 @@ struct sun8i_ce_flow {
+ 	struct completion complete;
+ 	int status;
+ 	dma_addr_t t_phy;
+-	int timeout;
+ 	struct ce_task *tl;
+ 	void *backup_iv;
+ 	void *bounce_iv;
+-- 
+2.51.0
+
diff --git a/queue-6.12/dm-error-mark-as-dm_target_passes_integrity.patch b/queue-6.12/dm-error-mark-as-dm_target_passes_integrity.patch
new file mode 100644
index 0000000000..d3612a4503
--- /dev/null
+++ b/queue-6.12/dm-error-mark-as-dm_target_passes_integrity.patch
@@ -0,0 +1,41 @@
+From 4a26db59b85489ec4daf51dab8b8a7044f777bc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 06:58:21 +0200
+Subject: dm error: mark as DM_TARGET_PASSES_INTEGRITY
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 499cbe0f2fb0641cf07a1a8ac9f7317674295fea ]
+
+Mark dm error as DM_TARGET_PASSES_INTEGRITY so that it can be stacked on
+top of PI capable devices.  The claim is strictly speaking as lie as dm
+error fails all I/O and doesn't pass anything on, but doing the same for
+integrity I/O work just fine :)
+
+This helps to make about two dozen xfstests test cases pass on PI capable
+devices.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-target.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 652627aea11b6..b676fd01a0227 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -263,7 +263,8 @@ static long io_err_dax_direct_access(struct dm_target *ti, pgoff_t pgoff,
+ static struct target_type error_target = {
+ 	.name = "error",
+ 	.version = {1, 7, 0},
+-	.features = DM_TARGET_WILDCARD | DM_TARGET_ZONED_HM,
++	.features = DM_TARGET_WILDCARD | DM_TARGET_ZONED_HM |
++		DM_TARGET_PASSES_INTEGRITY,
+ 	.ctr  = io_err_ctr,
+ 	.dtr  = io_err_dtr,
+ 	.map  = io_err_map,
+-- 
+2.51.0
+
diff --git a/queue-6.12/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-6.12/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..f6d0f31908
--- /dev/null
+++ b/queue-6.12/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From 56fd2baa8305a09415ec5f165262a15c892a2c95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 68236247059d1..9ae789d4aca7b 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -595,6 +595,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -608,6 +627,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -644,6 +665,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-6.12/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..0a1e66689f
--- /dev/null
+++ b/queue-6.12/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From f54f4e186f54279b8ce33529ea52552482f785e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 184813766cd15..33716794d50e2 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-6.12/dmaengine-sh-setup_xref-error-handling.patch b/queue-6.12/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..afde97da72
--- /dev/null
+++ b/queue-6.12/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From 94297896b301ea0fa8c43d255451efd6cbc65a8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 588c5f409a808..8d796504cb7f1 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 8ead0a1fd2371..2ed0e72a7ffa3 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -300,21 +300,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-add-more-cyan-skillfish-pci-ids.patch b/queue-6.12/drm-amd-add-more-cyan-skillfish-pci-ids.patch
new file mode 100644
index 0000000000..4c237aa683
--- /dev/null
+++ b/queue-6.12/drm-amd-add-more-cyan-skillfish-pci-ids.patch
@@ -0,0 +1,36 @@
+From 50a541c2ab0abc6b64b9566fa37dee5bd3357f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:09:06 -0400
+Subject: drm/amd: add more cyan skillfish PCI ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
+
+Add additional PCI IDs to the cyan skillfish family.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 93c3de2d27d3a..41397f1cdeb8a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2135,6 +2135,11 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
+ 
+ 	/* CYAN_SKILLFISH */
++	{0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch b/queue-6.12/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
new file mode 100644
index 0000000000..236e646266
--- /dev/null
+++ b/queue-6.12/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
@@ -0,0 +1,147 @@
+From 58bfa77e1228824b3920861278e6679a3a60ba18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 13:44:24 +0800
+Subject: drm/amd/amdgpu: Release xcp drm memory after unplug
+
+From: Meng Li <li.meng@amd.com>
+
+[ Upstream commit e6c2b0f23221ed43c4cc6f636e9ab7862954d562 ]
+
+Add a new API amdgpu_xcp_drm_dev_free().
+After unplug xcp device, need to release xcp drm memory etc.
+
+Co-developed-by: Jiang Liu <gerry@linux.alibaba.com>
+Signed-off-by: Jiang Liu <gerry@linux.alibaba.com>
+Signed-off-by: Meng Li <li.meng@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c     |  1 +
+ drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 56 +++++++++++++++++----
+ drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h |  1 +
+ 3 files changed, 49 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+index a6d456ec6aeb1..9e9c7ac1f5075 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+@@ -382,6 +382,7 @@ void amdgpu_xcp_dev_unplug(struct amdgpu_device *adev)
+ 		p_ddev->primary->dev = adev->xcp_mgr->xcp[i].pdev;
+ 		p_ddev->driver =  adev->xcp_mgr->xcp[i].driver;
+ 		p_ddev->vma_offset_manager = adev->xcp_mgr->xcp[i].vma_offset_manager;
++		amdgpu_xcp_drm_dev_free(p_ddev);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
+index faed84172dd43..587ad4132561c 100644
+--- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
++++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
+@@ -45,18 +45,29 @@ static const struct drm_driver amdgpu_xcp_driver = {
+ 
+ static int8_t pdev_num;
+ static struct xcp_device *xcp_dev[MAX_XCP_PLATFORM_DEVICE];
++static DEFINE_MUTEX(xcp_mutex);
+ 
+ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ {
+ 	struct platform_device *pdev;
+ 	struct xcp_device *pxcp_dev;
+ 	char dev_name[20];
+-	int ret;
++	int ret, i;
++
++	guard(mutex)(&xcp_mutex);
+ 
+ 	if (pdev_num >= MAX_XCP_PLATFORM_DEVICE)
+ 		return -ENODEV;
+ 
+-	snprintf(dev_name, sizeof(dev_name), "amdgpu_xcp_%d", pdev_num);
++	for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		if (!xcp_dev[i])
++			break;
++	}
++
++	if (i >= MAX_XCP_PLATFORM_DEVICE)
++		return -ENODEV;
++
++	snprintf(dev_name, sizeof(dev_name), "amdgpu_xcp_%d", i);
+ 	pdev = platform_device_register_simple(dev_name, -1, NULL, 0);
+ 	if (IS_ERR(pdev))
+ 		return PTR_ERR(pdev);
+@@ -72,8 +83,8 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ 		goto out_devres;
+ 	}
+ 
+-	xcp_dev[pdev_num] = pxcp_dev;
+-	xcp_dev[pdev_num]->pdev = pdev;
++	xcp_dev[i] = pxcp_dev;
++	xcp_dev[i]->pdev = pdev;
+ 	*ddev = &pxcp_dev->drm;
+ 	pdev_num++;
+ 
+@@ -88,16 +99,43 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ }
+ EXPORT_SYMBOL(amdgpu_xcp_drm_dev_alloc);
+ 
+-void amdgpu_xcp_drv_release(void)
++static void free_xcp_dev(int8_t index)
+ {
+-	for (--pdev_num; pdev_num >= 0; --pdev_num) {
+-		struct platform_device *pdev = xcp_dev[pdev_num]->pdev;
++	if ((index < MAX_XCP_PLATFORM_DEVICE) && (xcp_dev[index])) {
++		struct platform_device *pdev = xcp_dev[index]->pdev;
+ 
+ 		devres_release_group(&pdev->dev, NULL);
+ 		platform_device_unregister(pdev);
+-		xcp_dev[pdev_num] = NULL;
++
++		xcp_dev[index] = NULL;
++		pdev_num--;
++	}
++}
++
++void amdgpu_xcp_drm_dev_free(struct drm_device *ddev)
++{
++	int8_t i;
++
++	guard(mutex)(&xcp_mutex);
++
++	for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		if ((xcp_dev[i]) && (&xcp_dev[i]->drm == ddev)) {
++			free_xcp_dev(i);
++			break;
++		}
++	}
++}
++EXPORT_SYMBOL(amdgpu_xcp_drm_dev_free);
++
++void amdgpu_xcp_drv_release(void)
++{
++	int8_t i;
++
++	guard(mutex)(&xcp_mutex);
++
++	for (i = 0; pdev_num && i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		free_xcp_dev(i);
+ 	}
+-	pdev_num = 0;
+ }
+ EXPORT_SYMBOL(amdgpu_xcp_drv_release);
+ 
+diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
+index c1c4b679bf95c..580a1602c8e36 100644
+--- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
++++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
+@@ -25,5 +25,6 @@
+ #define _AMDGPU_XCP_DRV_H_
+ 
+ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev);
++void amdgpu_xcp_drm_dev_free(struct drm_device *ddev);
+ void amdgpu_xcp_drv_release(void);
+ #endif /* _AMDGPU_XCP_DRV_H_ */
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-avoid-evicting-resources-at-s5.patch b/queue-6.12/drm-amd-avoid-evicting-resources-at-s5.patch
new file mode 100644
index 0000000000..1ff6281fa8
--- /dev/null
+++ b/queue-6.12/drm-amd-avoid-evicting-resources-at-s5.patch
@@ -0,0 +1,48 @@
+From 7342f3fe55b91ca144e0ce7e8255c2e1fdf904bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 12:00:06 -0500
+Subject: drm/amd: Avoid evicting resources at S5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
+
+Normally resources are evicted on dGPUs at suspend or hibernate and
+on APUs at hibernate.  These steps are unnecessary when using the S4
+callbacks to put the system into S5.
+
+Cc: AceLan Kao <acelan.kao@canonical.com>
+Cc: Kai-Heng Feng <kaihengf@nvidia.com>
+Cc: Mark Pearson <mpearson-lenovo@squebb.ca>
+Cc: Denis Benato <benato.denis96@gmail.com>
+Cc: Merthan Karakaş <m3rthn.k@gmail.com>
+Tested-by: Eric Naim <dnaim@cachyos.org>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 7ff81bd1ec200..7a8a53fbe918c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4731,6 +4731,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
+ 	if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU))
+ 		return 0;
+ 
++	/* No need to evict when going to S5 through S4 callbacks */
++	if (system_state == SYSTEM_POWER_OFF)
++		return 0;
++
+ 	ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM);
+ 	if (ret)
+ 		DRM_WARN("evicting device resources failed\n");
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch b/queue-6.12/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
new file mode 100644
index 0000000000..8a8986ed39
--- /dev/null
+++ b/queue-6.12/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
@@ -0,0 +1,105 @@
+From b730718bb1325068d90dca397caabc20fd7eacac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:16:27 +0200
+Subject: drm/amd/display: Add AVI infoframe copy in
+ copy_stream_update_to_stream
+
+From: Karthi Kandasamy <karthi.kandasamy@amd.com>
+
+[ Upstream commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 ]
+
+[WHY]
+Ensure AVI infoframe updates from stream updates are applied to the active
+stream so OS overrides are not lost.
+
+[HOW]
+Copy avi_infopacket to stream when valid flag is set.
+Follow existing infopacket copy pattern and perform a basic validity check before assignment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Karthi Kandasamy <karthi.kandasamy@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c          | 7 ++++++-
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 ++++++
+ drivers/gpu/drm/amd/display/dc/dc_stream.h        | 3 +++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 426912d82179c..257d77aa7c979 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3035,6 +3035,9 @@ static void copy_stream_update_to_stream(struct dc *dc,
+ 	if (update->adaptive_sync_infopacket)
+ 		stream->adaptive_sync_infopacket = *update->adaptive_sync_infopacket;
+ 
++	if (update->avi_infopacket)
++		stream->avi_infopacket = *update->avi_infopacket;
++
+ 	if (update->dither_option)
+ 		stream->dither_option = *update->dither_option;
+ 
+@@ -3325,7 +3328,8 @@ static void commit_planes_do_stream_update(struct dc *dc,
+ 					stream_update->vsp_infopacket ||
+ 					stream_update->hfvsif_infopacket ||
+ 					stream_update->adaptive_sync_infopacket ||
+-					stream_update->vtem_infopacket) {
++					stream_update->vtem_infopacket ||
++					stream_update->avi_infopacket) {
+ 				resource_build_info_frame(pipe_ctx);
+ 				dc->hwss.update_info_frame(pipe_ctx);
+ 
+@@ -4759,6 +4763,7 @@ static bool full_update_required(struct dc *dc,
+ 			stream_update->hfvsif_infopacket ||
+ 			stream_update->vtem_infopacket ||
+ 			stream_update->adaptive_sync_infopacket ||
++			stream_update->avi_infopacket ||
+ 			stream_update->dpms_off ||
+ 			stream_update->allow_freesync ||
+ 			stream_update->vrr_active_variable ||
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 36f8eb37e6710..07473e9604277 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -4156,8 +4156,14 @@ static void set_avi_info_frame(
+ 	unsigned int fr_ind = pipe_ctx->stream->timing.fr_index;
+ 	enum dc_timing_3d_format format;
+ 
++	if (stream->avi_infopacket.valid) {
++		*info_packet = stream->avi_infopacket;
++		return;
++	}
++
+ 	memset(&hdmi_info, 0, sizeof(union hdmi_info_packet));
+ 
++
+ 	color_space = pipe_ctx->stream->output_color_space;
+ 	if (color_space == COLOR_SPACE_UNKNOWN)
+ 		color_space = (stream->timing.pixel_encoding == PIXEL_ENCODING_RGB) ?
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+index 8b9af1a6a0316..1ecf956a71020 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+@@ -200,6 +200,7 @@ struct dc_stream_state {
+ 	struct dc_info_packet hfvsif_infopacket;
+ 	struct dc_info_packet vtem_infopacket;
+ 	struct dc_info_packet adaptive_sync_infopacket;
++	struct dc_info_packet avi_infopacket;
+ 	uint8_t dsc_packed_pps[128];
+ 	struct rect src; /* composition area */
+ 	struct rect dst; /* stream addressable area */
+@@ -331,6 +332,8 @@ struct dc_stream_update {
+ 	struct dc_info_packet *hfvsif_infopacket;
+ 	struct dc_info_packet *vtem_infopacket;
+ 	struct dc_info_packet *adaptive_sync_infopacket;
++	struct dc_info_packet *avi_infopacket;
++
+ 	bool *dpms_off;
+ 	bool integer_scaling_update;
+ 	bool *allow_freesync;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-add-fallback-path-for-ycbcr422.patch b/queue-6.12/drm-amd-display-add-fallback-path-for-ycbcr422.patch
new file mode 100644
index 0000000000..f18bc61f1c
--- /dev/null
+++ b/queue-6.12/drm-amd-display-add-fallback-path-for-ycbcr422.patch
@@ -0,0 +1,121 @@
+From 02fb2819b089220040246d13992b34986d951242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 12:17:19 -0500
+Subject: drm/amd/display: Add fallback path for YCBCR422
+
+From: Mario Limonciello <Mario.Limonciello@amd.com>
+
+[ Upstream commit db291ed1732e02e79dca431838713bbf602bda1c ]
+
+[Why]
+DP validation may fail with multiple displays and higher color depths.
+The sink may support others though.
+
+[How]
+When DP bandwidth validation fails, progressively fallback through:
+- YUV422 8bpc (bandwidth efficient)
+- YUV422 6bpc (reduced color depth)
+- YUV420 (last resort)
+
+This resolves cases where displays would show no image due to insufficient
+DP link bandwidth for the requested RGB mode.
+
+Suggested-by: Mauri Carvalho <mcarvalho3@lenovo.com>
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Mario Limonciello <Mario.Limonciello@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 45 +++++++++++++++----
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h |  1 +
+ 2 files changed, 37 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index c314c213c21c3..271710104f0e5 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6162,7 +6162,8 @@ static void fill_stream_properties_from_drm_display_mode(
+ 			&& aconnector->force_yuv420_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR422)
+-			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
++			&& aconnector
++			&& aconnector->force_yuv422_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR422;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444)
+ 			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+@@ -7421,6 +7422,7 @@ create_validate_stream_for_sink(struct drm_connector *connector,
+ 		bpc_limit = 8;
+ 
+ 	do {
++		drm_dbg_kms(connector->dev, "Trying with %d bpc\n", requested_bpc);
+ 		stream = create_stream_for_sink(connector, drm_mode,
+ 						dm_state, old_stream,
+ 						requested_bpc);
+@@ -7456,16 +7458,41 @@ create_validate_stream_for_sink(struct drm_connector *connector,
+ 
+ 	} while (stream == NULL && requested_bpc >= bpc_limit);
+ 
+-	if ((dc_result == DC_FAIL_ENC_VALIDATE ||
+-	     dc_result == DC_EXCEED_DONGLE_CAP) &&
+-	     !aconnector->force_yuv420_output) {
+-		DRM_DEBUG_KMS("%s:%d Retry forcing yuv420 encoding\n",
+-				     __func__, __LINE__);
+-
+-		aconnector->force_yuv420_output = true;
++	switch (dc_result) {
++	/*
++	 * If we failed to validate DP bandwidth stream with the requested RGB color depth,
++	 * we try to fallback and configure in order:
++	 * YUV422 (8bpc, 6bpc)
++	 * YUV420 (8bpc, 6bpc)
++	 */
++	case DC_FAIL_ENC_VALIDATE:
++	case DC_EXCEED_DONGLE_CAP:
++	case DC_NO_DP_LINK_BANDWIDTH:
++		/* recursively entered twice and already tried both YUV422 and YUV420 */
++		if (aconnector->force_yuv422_output && aconnector->force_yuv420_output)
++			break;
++		/* first failure; try YUV422 */
++		if (!aconnector->force_yuv422_output) {
++			drm_dbg_kms(connector->dev, "%s:%d Validation failed with %d, retrying w/ YUV422\n",
++				    __func__, __LINE__, dc_result);
++			aconnector->force_yuv422_output = true;
++		/* recursively entered and YUV422 failed, try YUV420 */
++		} else if (!aconnector->force_yuv420_output) {
++			drm_dbg_kms(connector->dev, "%s:%d Validation failed with %d, retrying w/ YUV420\n",
++				    __func__, __LINE__, dc_result);
++			aconnector->force_yuv420_output = true;
++		}
+ 		stream = create_validate_stream_for_sink(connector, drm_mode,
+-						dm_state, old_stream);
++							 dm_state, old_stream);
++		aconnector->force_yuv422_output = false;
+ 		aconnector->force_yuv420_output = false;
++		break;
++	case DC_OK:
++		break;
++	default:
++		drm_dbg_kms(connector->dev, "%s:%d Unhandled validation failure %d\n",
++			    __func__, __LINE__, dc_result);
++		break;
+ 	}
+ 
+ 	return stream;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index 47f6569be54cb..2c0e1180706fa 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -724,6 +724,7 @@ struct amdgpu_dm_connector {
+ 
+ 	bool fake_enable;
+ 	bool force_yuv420_output;
++	bool force_yuv422_output;
+ 	struct dsc_preferred_settings dsc_settings;
+ 	union dp_downstream_port_present mst_downstream_port_present;
+ 	/* Cached display modes */
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-add-more-cyan-skillfish-devices.patch b/queue-6.12/drm-amd-display-add-more-cyan-skillfish-devices.patch
new file mode 100644
index 0000000000..70d2e68500
--- /dev/null
+++ b/queue-6.12/drm-amd-display-add-more-cyan-skillfish-devices.patch
@@ -0,0 +1,58 @@
+From 8a2e21c81e49b5c3d59586c1eb081f7462865ffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:10:31 -0400
+Subject: drm/amd/display: add more cyan skillfish devices
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
+
+Add PCI IDs to support display probe for cyan skillfish
+family of SOCs.
+
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
+ drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 6dbf139c51f72..36f8eb37e6710 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -164,7 +164,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)
+ 
+ 	case FAMILY_NV:
+ 		dc_version = DCN_VERSION_2_0;
+-		if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) {
++		if (asic_id.chip_id == DEVICE_ID_NV_13FE ||
++		    asic_id.chip_id == DEVICE_ID_NV_143F ||
++		    asic_id.chip_id == DEVICE_ID_NV_13F9 ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FA ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FB ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FC ||
++		    asic_id.chip_id == DEVICE_ID_NV_13DB) {
+ 			dc_version = DCN_VERSION_2_01;
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+index 090230d29df82..f030e167c58e1 100644
+--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+@@ -213,6 +213,11 @@ enum {
+ #endif
+ #define DEVICE_ID_NV_13FE 0x13FE  // CYAN_SKILLFISH
+ #define DEVICE_ID_NV_143F 0x143F
++#define DEVICE_ID_NV_13F9 0x13F9
++#define DEVICE_ID_NV_13FA 0x13FA
++#define DEVICE_ID_NV_13FB 0x13FB
++#define DEVICE_ID_NV_13FC 0x13FC
++#define DEVICE_ID_NV_13DB 0x13DB
+ #define FAMILY_VGH 144
+ #define DEVICE_ID_VGH_163F 0x163F
+ #define DEVICE_ID_VGH_1435 0x1435
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-change-dc-stream-color-settings-only.patch b/queue-6.12/drm-amd-display-change-dc-stream-color-settings-only.patch
new file mode 100644
index 0000000000..7254c5a22f
--- /dev/null
+++ b/queue-6.12/drm-amd-display-change-dc-stream-color-settings-only.patch
@@ -0,0 +1,218 @@
+From fbdf5decdbe18e9488d0bf6ade60f63bf0348ee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 14:21:20 -0300
+Subject: drm/amd/display: change dc stream color settings only in atomic
+ commit
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 51cb93aa0c4a9bb126b76f6e9fd640d88de25cee ]
+
+Don't update DC stream color components during atomic check. The driver
+will continue validating the new CRTC color state but will not change DC
+stream color components. The DC stream color state will only be
+programmed at commit time in the `atomic_setup_commit` stage.
+
+It fixes gamma LUT loss reported by KDE users when changing brightness
+quickly or changing Display settings (such as overscan) with nightlight
+on and HDR. As KWin can do a test commit with color settings different
+from those that should be applied in a non-test-only commit, if the
+driver changes DC stream color state in atomic check, this state can be
+eventually HW programmed in commit tail, instead of the respective state
+set by the non-blocking commit.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4444
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |  2 +-
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h |  2 +
+ .../amd/display/amdgpu_dm/amdgpu_dm_color.c   | 86 ++++++++++++++-----
+ 3 files changed, 66 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index ea6bc9517ed86..c314c213c21c3 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10773,7 +10773,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	if (dm_new_crtc_state->base.color_mgmt_changed ||
+ 	    dm_old_crtc_state->regamma_tf != dm_new_crtc_state->regamma_tf ||
+ 	    drm_atomic_crtc_needs_modeset(new_crtc_state)) {
+-		ret = amdgpu_dm_update_crtc_color_mgmt(dm_new_crtc_state);
++		ret = amdgpu_dm_check_crtc_color_mgmt(dm_new_crtc_state, true);
+ 		if (ret)
+ 			goto fail;
+ 	}
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index 9603352ee0949..47f6569be54cb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -971,6 +971,8 @@ void amdgpu_dm_init_color_mod(void);
+ int amdgpu_dm_create_color_properties(struct amdgpu_device *adev);
+ int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state);
+ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc);
++int amdgpu_dm_check_crtc_color_mgmt(struct dm_crtc_state *crtc,
++				    bool check_only);
+ int amdgpu_dm_update_plane_color_mgmt(struct dm_crtc_state *crtc,
+ 				      struct drm_plane_state *plane_state,
+ 				      struct dc_plane_state *dc_plane_state);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+index ebabfe3a512f4..e9c765e1c17ce 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+@@ -566,12 +566,11 @@ static int __set_output_tf(struct dc_transfer_func *func,
+ 	return res ? 0 : -ENOMEM;
+ }
+ 
+-static int amdgpu_dm_set_atomic_regamma(struct dc_stream_state *stream,
++static int amdgpu_dm_set_atomic_regamma(struct dc_transfer_func *out_tf,
+ 					const struct drm_color_lut *regamma_lut,
+ 					uint32_t regamma_size, bool has_rom,
+ 					enum dc_transfer_func_predefined tf)
+ {
+-	struct dc_transfer_func *out_tf = &stream->out_transfer_func;
+ 	int ret = 0;
+ 
+ 	if (regamma_size || tf != TRANSFER_FUNCTION_LINEAR) {
+@@ -885,33 +884,33 @@ int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state)
+ }
+ 
+ /**
+- * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream.
++ * amdgpu_dm_check_crtc_color_mgmt: Check if DRM color props are programmable by DC.
+  * @crtc: amdgpu_dm crtc state
++ * @check_only: only check color state without update dc stream
+  *
+- * With no plane level color management properties we're free to use any
+- * of the HW blocks as long as the CRTC CTM always comes before the
+- * CRTC RGM and after the CRTC DGM.
+- *
+- * - The CRTC RGM block will be placed in the RGM LUT block if it is non-linear.
+- * - The CRTC DGM block will be placed in the DGM LUT block if it is non-linear.
+- * - The CRTC CTM will be placed in the gamut remap block if it is non-linear.
++ * This function just verifies CRTC LUT sizes, if there is enough space for
++ * output transfer function and if its parameters can be calculated by AMD
++ * color module. It also adjusts some settings for programming CRTC degamma at
++ * plane stage, using plane DGM block.
+  *
+  * The RGM block is typically more fully featured and accurate across
+  * all ASICs - DCE can't support a custom non-linear CRTC DGM.
+  *
+  * For supporting both plane level color management and CRTC level color
+- * management at once we have to either restrict the usage of CRTC properties
+- * or blend adjustments together.
++ * management at once we have to either restrict the usage of some CRTC
++ * properties or blend adjustments together.
+  *
+  * Returns:
+- * 0 on success. Error code if setup fails.
++ * 0 on success. Error code if validation fails.
+  */
+-int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
++
++int amdgpu_dm_check_crtc_color_mgmt(struct dm_crtc_state *crtc,
++				    bool check_only)
+ {
+ 	struct dc_stream_state *stream = crtc->stream;
+ 	struct amdgpu_device *adev = drm_to_adev(crtc->base.state->dev);
+ 	bool has_rom = adev->asic_type <= CHIP_RAVEN;
+-	struct drm_color_ctm *ctm = NULL;
++	struct dc_transfer_func *out_tf;
+ 	const struct drm_color_lut *degamma_lut, *regamma_lut;
+ 	uint32_t degamma_size, regamma_size;
+ 	bool has_regamma, has_degamma;
+@@ -940,6 +939,14 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 	crtc->cm_has_degamma = false;
+ 	crtc->cm_is_degamma_srgb = false;
+ 
++	if (check_only) {
++		out_tf = kvzalloc(sizeof(*out_tf), GFP_KERNEL);
++		if (!out_tf)
++			return -ENOMEM;
++	} else {
++		out_tf = &stream->out_transfer_func;
++	}
++
+ 	/* Setup regamma and degamma. */
+ 	if (is_legacy) {
+ 		/*
+@@ -954,8 +961,8 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 		 * inverse color ramp in legacy userspace.
+ 		 */
+ 		crtc->cm_is_degamma_srgb = true;
+-		stream->out_transfer_func.type = TF_TYPE_DISTRIBUTED_POINTS;
+-		stream->out_transfer_func.tf = TRANSFER_FUNCTION_SRGB;
++		out_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
++		out_tf->tf = TRANSFER_FUNCTION_SRGB;
+ 		/*
+ 		 * Note: although we pass has_rom as parameter here, we never
+ 		 * actually use ROM because the color module only takes the ROM
+@@ -963,16 +970,12 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 		 *
+ 		 * See more in mod_color_calculate_regamma_params()
+ 		 */
+-		r = __set_legacy_tf(&stream->out_transfer_func, regamma_lut,
++		r = __set_legacy_tf(out_tf, regamma_lut,
+ 				    regamma_size, has_rom);
+-		if (r)
+-			return r;
+ 	} else {
+ 		regamma_size = has_regamma ? regamma_size : 0;
+-		r = amdgpu_dm_set_atomic_regamma(stream, regamma_lut,
++		r = amdgpu_dm_set_atomic_regamma(out_tf, regamma_lut,
+ 						 regamma_size, has_rom, tf);
+-		if (r)
+-			return r;
+ 	}
+ 
+ 	/*
+@@ -981,6 +984,43 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 	 * have to place the CTM in the OCSC in that case.
+ 	 */
+ 	crtc->cm_has_degamma = has_degamma;
++	if (check_only)
++		kvfree(out_tf);
++
++	return r;
++}
++
++/**
++ * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream.
++ * @crtc: amdgpu_dm crtc state
++ *
++ * With no plane level color management properties we're free to use any
++ * of the HW blocks as long as the CRTC CTM always comes before the
++ * CRTC RGM and after the CRTC DGM.
++ *
++ * - The CRTC RGM block will be placed in the RGM LUT block if it is non-linear.
++ * - The CRTC DGM block will be placed in the DGM LUT block if it is non-linear.
++ * - The CRTC CTM will be placed in the gamut remap block if it is non-linear.
++ *
++ * The RGM block is typically more fully featured and accurate across
++ * all ASICs - DCE can't support a custom non-linear CRTC DGM.
++ *
++ * For supporting both plane level color management and CRTC level color
++ * management at once we have to either restrict the usage of CRTC properties
++ * or blend adjustments together.
++ *
++ * Returns:
++ * 0 on success. Error code if setup fails.
++ */
++int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
++{
++	struct dc_stream_state *stream = crtc->stream;
++	struct drm_color_ctm *ctm = NULL;
++	int ret;
++
++	ret = amdgpu_dm_check_crtc_color_mgmt(crtc, false);
++	if (ret)
++		return ret;
+ 
+ 	/* Setup CRTC CTM. */
+ 	if (crtc->base.ctm) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-disable-vrr-on-dce-6.patch b/queue-6.12/drm-amd-display-disable-vrr-on-dce-6.patch
new file mode 100644
index 0000000000..c647510395
--- /dev/null
+++ b/queue-6.12/drm-amd-display-disable-vrr-on-dce-6.patch
@@ -0,0 +1,79 @@
+From 1fea24ee4c7bb45002c64c1b0c59788759c4f260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:30 +0200
+Subject: drm/amd/display: Disable VRR on DCE 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 043c87d7d56e135393f8aab927148096e2d17589 ]
+
+DCE 6 was not advertised as being able to support VRR,
+so let's mark it as unsupported for now.
+
+The VRR implementation in amdgpu_dm depends on the VUPDATE
+interrupt which is not registered for DCE 6.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ drivers/gpu/drm/amd/display/dc/dc_helper.c        | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dm_services.h      | 2 ++
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 37307caf92999..ea6bc9517ed86 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10455,6 +10455,8 @@ static void get_freesync_config_for_crtc(
+ 		} else {
+ 			config.state = VRR_STATE_INACTIVE;
+ 		}
++	} else {
++		config.state = VRR_STATE_UNSUPPORTED;
+ 	}
+ out:
+ 	new_crtc_state->freesync_config = config;
+@@ -12357,7 +12359,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector,
+ 
+ 	dm_con_state = to_dm_connector_state(connector->state);
+ 
+-	if (!adev->dm.freesync_module)
++	if (!adev->dm.freesync_module || !dc_supports_vrr(sink->ctx->dce_version))
+ 		goto update;
+ 
+ 	/* Some eDP panels only have the refresh rate range info in DisplayID */
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+index b402be59b2c83..0f333c27787d6 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_helper.c
++++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+@@ -747,3 +747,8 @@ char *dce_version_to_string(const int version)
+ 		return "Unknown";
+ 	}
+ }
++
++bool dc_supports_vrr(const enum dce_version v)
++{
++	return v >= DCE_VERSION_8_0;
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h
+index 9405c47ee2a9a..a7c2740e51b88 100644
+--- a/drivers/gpu/drm/amd/display/dc/dm_services.h
++++ b/drivers/gpu/drm/amd/display/dc/dm_services.h
+@@ -304,4 +304,6 @@ void dm_dtn_log_end(struct dc_context *ctx,
+ 
+ char *dce_version_to_string(const int version);
+ 
++bool dc_supports_vrr(const enum dce_version v);
++
+ #endif /* __DM_SERVICES_H__ */
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch b/queue-6.12/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
new file mode 100644
index 0000000000..b42faae32d
--- /dev/null
+++ b/queue-6.12/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
@@ -0,0 +1,71 @@
+From 3c10cfaa2412a05b9b13b76e69163c90f56d982d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:52:11 +0800
+Subject: drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg
+ with DC_FP_START
+
+From: Xi Ruoyao <xry111@xry111.site>
+
+[ Upstream commit c97a7dccb3ed680031011cfc1457506e6de49c9a ]
+
+dml21_map_dc_state_into_dml_display_cfg calls (the call is usually
+inlined by the compiler) populate_dml21_surface_config_from_plane_state
+and populate_dml21_plane_config_from_plane_state which may use FPU.  In
+a x86-64 build:
+
+    $ objdump --disassemble=dml21_map_dc_state_into_dml_display_cfg \
+    > drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.o |
+    > grep %xmm -c
+    63
+
+Thus it needs to be guarded with DC_FP_START.  But we must note that the
+current code quality of the in-kernel FPU use in AMD dml2 is very much
+problematic: we are actually calling DC_FP_START in dml21_wrapper.c
+here, and this translation unit is built with CC_FLAGS_FPU.  Strictly
+speaking this does not make any sense: with CC_FLAGS_FPU the compiler is
+allowed to generate FPU uses anywhere in the translated code, perhaps
+out of the DC_FP_START guard.  This problematic pattern also occurs in
+at least dml2_wrapper.c, dcn35_fpu.c, and dcn351_fpu.c.  Thus we really
+need a careful audit and refactor for the in-kernel FPU uses, and this
+patch is simply whacking a mole.  However per the reporter, whacking
+this mole is enough to make a 9060XT "just work."
+
+Reported-by: Asiacn <710187964@qq.com>
+Closes: https://github.com/loongson-community/discussions/issues/102
+Tested-by: Asiacn <710187964@qq.com>
+Signed-off-by: Xi Ruoyao <xry111@xry111.site>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
+index dcbe327209d5d..20c643ab756eb 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
+@@ -217,7 +217,9 @@ static bool dml21_mode_check_and_programming(const struct dc *in_dc, struct dc_s
+ 	dml_ctx->config.svp_pstate.callbacks.release_phantom_streams_and_planes(in_dc, context);
+ 
+ 	/* Populate stream, plane mappings and other fields in display config. */
++	DC_FP_START();
+ 	result = dml21_map_dc_state_into_dml_display_cfg(in_dc, context, dml_ctx);
++	DC_FP_END();
+ 	if (!result)
+ 		return false;
+ 
+@@ -271,7 +273,9 @@ static bool dml21_check_mode_support(const struct dc *in_dc, struct dc_state *co
+ 	dml_ctx->config.svp_pstate.callbacks.release_phantom_streams_and_planes(in_dc, context);
+ 
+ 	mode_support->dml2_instance = dml_init->dml2_instance;
++	DC_FP_START();
+ 	dml21_map_dc_state_into_dml_display_cfg(in_dc, context, dml_ctx);
++	DC_FP_END();
+ 	dml_ctx->v21.mode_programming.dml2_instance->scratch.build_mode_programming_locals.mode_programming_params.programming = dml_ctx->v21.mode_programming.programming;
+ 	DC_FP_START();
+ 	is_supported = dml2_check_mode_supported(mode_support);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-ensure-committing-streams-is-seamles.patch b/queue-6.12/drm-amd-display-ensure-committing-streams-is-seamles.patch
new file mode 100644
index 0000000000..46e96827d5
--- /dev/null
+++ b/queue-6.12/drm-amd-display-ensure-committing-streams-is-seamles.patch
@@ -0,0 +1,53 @@
+From 406b1a021bbaa5c52b203fe1f253eee8d0bb0c01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 13:21:30 -0400
+Subject: drm/amd/display: ensure committing streams is seamless
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit ca74cc428f2b9d0170c56b473dbcfd7fa01daf2d ]
+
+[Why]
+When transitioning between topologies such as multi-display to single
+display ODM 2:1, pipes might not be freed before use.
+
+[How]
+In dc_commit_streams, commit an additional, minimal transition if
+original transition is not seamless to ensure pipes are freed.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 13d5f0451fecf..bdcbebd5722d4 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2182,6 +2182,18 @@ enum dc_status dc_commit_streams(struct dc *dc, struct dc_commit_streams_params
+ 		goto fail;
+ 	}
+ 
++	/*
++	 * If not already seamless, make transition seamless by inserting intermediate minimal transition
++	 */
++	if (dc->hwss.is_pipe_topology_transition_seamless &&
++			!dc->hwss.is_pipe_topology_transition_seamless(dc, dc->current_state, context)) {
++		res = commit_minimal_transition_state(dc, context);
++		if (res != DC_OK) {
++			BREAK_TO_DEBUGGER();
++			goto fail;
++		}
++	}
++
+ 	res = dc_commit_state_no_check(dc, context);
+ 
+ 	for (i = 0; i < params->stream_count; i++) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-fix-condition-for-setting-timing_adj.patch b/queue-6.12/drm-amd-display-fix-condition-for-setting-timing_adj.patch
new file mode 100644
index 0000000000..512d1a9441
--- /dev/null
+++ b/queue-6.12/drm-amd-display-fix-condition-for-setting-timing_adj.patch
@@ -0,0 +1,43 @@
+From 7b537e55b4c13b7901a9ebd2c2a13ecb9e49b8e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 10:11:22 -0400
+Subject: drm/amd/display: fix condition for setting timing_adjust_pending
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 1a6a3374ecb9899ccf0d209b5783a796bdba8cec ]
+
+timing_adjust_pending is used to defer certain programming sequences
+when OTG timing is about to be changed, like with VRR. Insufficient
+checking for timing change in this case caused a regression which
+reduces PSR Replay residency.
+
+Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Robin Chen <robin.chen@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 84e377113e580..13d5f0451fecf 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -453,7 +453,9 @@ bool dc_stream_adjust_vmin_vmax(struct dc *dc,
+ 	 * avoid conflicting with firmware updates.
+ 	 */
+ 	if (dc->ctx->dce_version > DCE_VERSION_MAX) {
+-		if (dc->optimized_required || dc->wm_optimized_required) {
++		if ((dc->optimized_required || dc->wm_optimized_required) &&
++			(stream->adjust.v_total_max != adjust->v_total_max ||
++			stream->adjust.v_total_min != adjust->v_total_min)) {
+ 			stream->adjust.timing_adjust_pending = true;
+ 			return false;
+ 		}
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-fix-dml-ms-order-of-operations.patch b/queue-6.12/drm-amd-display-fix-dml-ms-order-of-operations.patch
new file mode 100644
index 0000000000..93e99af842
--- /dev/null
+++ b/queue-6.12/drm-amd-display-fix-dml-ms-order-of-operations.patch
@@ -0,0 +1,42 @@
+From 83c1e7c8abbf22fd367dba45ecd3dec85c4fab91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:10:18 -0400
+Subject: drm/amd/display: fix dml ms order of operations
+
+From: Ausef Yousof <Ausef.Yousof@amd.com>
+
+[ Upstream commit 02a6c2e4b28ff31f7a904c196a99fb2efe81e2cf ]
+
+[why&how]
+small error in order of operations in immediateflipbytes
+calculation on dml ms side that can result in dml ms
+and mp mismatch immediateflip support for a given pipe
+and thus an invalid hw state, correct the order to align
+with mp.
+
+Reviewed-by: Leo Chen <leo.chen@amd.com>
+Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+index 6822b07951204..d0b7fae7d73c8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+@@ -6527,7 +6527,7 @@ static void dml_prefetch_check(struct display_mode_lib_st *mode_lib)
+ 				mode_lib->ms.TotImmediateFlipBytes = 0;
+ 				for (k = 0; k <= mode_lib->ms.num_active_planes - 1; k++) {
+ 					if (!(mode_lib->ms.policy.ImmediateFlipRequirement[k] == dml_immediate_flip_not_required)) {
+-						mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * mode_lib->ms.PDEAndMetaPTEBytesPerFrame[j][k] + mode_lib->ms.MetaRowBytes[j][k];
++						mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * (mode_lib->ms.PDEAndMetaPTEBytesPerFrame[j][k] + mode_lib->ms.MetaRowBytes[j][k]);
+ 						if (mode_lib->ms.use_one_row_for_frame_flip[j][k]) {
+ 							mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * (2 * mode_lib->ms.DPTEBytesPerRow[j][k]);
+ 						} else {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-fix-dvi-d-hdmi-adapters.patch b/queue-6.12/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
new file mode 100644
index 0000000000..9dba55cfcd
--- /dev/null
+++ b/queue-6.12/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
@@ -0,0 +1,57 @@
+From 1fd256ec1fb45be4975ea51e4b481f39f87abd8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:33:33 +0200
+Subject: drm/amd/display: Fix DVI-D/HDMI adapters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 489f0f600ce2c0dae640df9035e1d82677d2580f ]
+
+When the EDID has the HDMI bit, we should simply select
+the HDMI signal type even on DVI ports.
+
+For reference see, the legacy amdgpu display code:
+amdgpu_atombios_encoder_get_encoder_mode
+which selects ATOM_ENCODER_MODE_HDMI for the same case.
+
+This commit fixes DVI connectors to work with DVI-D/HDMI
+adapters so that they can now produce output over these
+connectors for HDMI monitors with higher bandwidth modes.
+With this change, even HDMI audio works through DVI.
+
+For testing, I used a CAA-DMDHFD3 DVI-D/HDMI adapter
+with the following GPUs:
+
+Tahiti (DCE 6) - DC can now output 4K 30 Hz over DVI
+Polaris 10 (DCE 11.2) - DC can now output 4K 60 Hz over DVI
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+index d21ee9d12d269..3f609f5468595 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -1132,6 +1132,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,
+ 		if (sink->sink_signal == SIGNAL_TYPE_HDMI_TYPE_A &&
+ 		    !sink->edid_caps.edid_hdmi)
+ 			sink->sink_signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
++		else if (dc_is_dvi_signal(sink->sink_signal) &&
++			 aud_support->hdmi_audio_native &&
++			 sink->edid_caps.edid_hdmi)
++			sink->sink_signal = SIGNAL_TYPE_HDMI_TYPE_A;
+ 
+ 		if (link->local_sink && dc_is_dp_signal(sink_caps.signal))
+ 			dp_trace_init(link);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch b/queue-6.12/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
new file mode 100644
index 0000000000..b9787433c4
--- /dev/null
+++ b/queue-6.12/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
@@ -0,0 +1,39 @@
+From 087ba77df22baebea1cffcc4794d984170914082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 11:04:07 -0400
+Subject: drm/amd/display: Fix for test crash due to power gating
+
+From: Sridevi Arvindekar <sarvinde@amd.com>
+
+[ Upstream commit 0bf6b216d4783cb51f9af05a49d3cce4fc22dc24 ]
+
+[Why/How]
+Call power gating routine only if it is defined.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Sridevi Arvindekar <sarvinde@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 55f067c9e4948..8a1ba78c27f97 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3086,7 +3086,8 @@ void dcn20_fpga_init_hw(struct dc *dc)
+ 		res_pool->dccg->funcs->dccg_init(res_pool->dccg);
+ 
+ 	//Enable ability to power gate / don't force power on permanently
+-	hws->funcs.enable_power_gating_plane(hws, true);
++	if (hws->funcs.enable_power_gating_plane)
++		hws->funcs.enable_power_gating_plane(hws, true);
+ 
+ 	// Specific to FPGA dccg and registers
+ 	REG_WRITE(RBBMIF_TIMEOUT_DIS, 0xFFFFFFFF);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-fix-pbn_div-calculation-error.patch b/queue-6.12/drm-amd-display-fix-pbn_div-calculation-error.patch
new file mode 100644
index 0000000000..237a371a14
--- /dev/null
+++ b/queue-6.12/drm-amd-display-fix-pbn_div-calculation-error.patch
@@ -0,0 +1,96 @@
+From adf9677dda6b59c8fd8e9babb4a194027b847dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 15:11:43 -0400
+Subject: drm/amd/display: Fix pbn_div Calculation Error
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+[ Upstream commit 12cdfb61b32a7be581ec5932e0b6a482cb098204 ]
+
+[Why]
+dm_mst_get_pbn_divider() returns value integer coming from
+the cast from fixed point, but the casted integer will then be used
+in dfixed_const to be multiplied by 4096. The cast from fixed point to integer
+causes the calculation error becomes bigger when multiplied by 4096.
+
+That makes the calculated pbn_div value becomes smaller than
+it should be, which leads to the req_slot number becomes bigger.
+
+Such error is getting reflected in 8k30 timing,
+where the correct and incorrect calculated req_slot 62.9 Vs 63.1.
+That makes the wrong calculation failed to light up 8k30
+after a dock under HBR3 x 4.
+
+[How]
+Restore the accuracy by keeping the fraction part
+calculated for the left shift operation.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c   |  2 +-
+ .../drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 13 ++++++++++---
+ .../drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h |  2 +-
+ 3 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index ffa0d7483ffc1..fd44d011ffd2d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7715,7 +7715,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder,
+ 	if (IS_ERR(mst_state))
+ 		return PTR_ERR(mst_state);
+ 
+-	mst_state->pbn_div.full = dfixed_const(dm_mst_get_pbn_divider(aconnector->mst_root->dc_link));
++	mst_state->pbn_div.full = dm_mst_get_pbn_divider(aconnector->mst_root->dc_link);
+ 
+ 	if (!state->duplicated) {
+ 		int max_bpc = conn_state->max_requested_bpc;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 92158009cfa73..a2a70c1e9afdc 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -816,13 +816,20 @@ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
+ 	drm_connector_attach_dp_subconnector_property(&aconnector->base);
+ }
+ 
+-int dm_mst_get_pbn_divider(struct dc_link *link)
++uint32_t dm_mst_get_pbn_divider(struct dc_link *link)
+ {
++	uint32_t pbn_div_x100;
++	uint64_t dividend, divisor;
++
+ 	if (!link)
+ 		return 0;
+ 
+-	return dc_link_bandwidth_kbps(link,
+-			dc_link_get_link_cap(link)) / (8 * 1000 * 54);
++	dividend = (uint64_t)dc_link_bandwidth_kbps(link, dc_link_get_link_cap(link)) * 100;
++	divisor = 8 * 1000 * 54;
++
++	pbn_div_x100 = div64_u64(dividend, divisor);
++
++	return dfixed_const(pbn_div_x100) / 100;
+ }
+ 
+ struct dsc_mst_fairness_params {
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+index 600d6e2210111..179f622492dbf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+@@ -59,7 +59,7 @@ enum mst_msg_ready_type {
+ struct amdgpu_display_manager;
+ struct amdgpu_dm_connector;
+ 
+-int dm_mst_get_pbn_divider(struct dc_link *link);
++uint32_t dm_mst_get_pbn_divider(struct dc_link *link);
+ 
+ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
+ 				       struct amdgpu_dm_connector *aconnector,
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-incorrect-conditions-for-failing-dto.patch b/queue-6.12/drm-amd-display-incorrect-conditions-for-failing-dto.patch
new file mode 100644
index 0000000000..77830ab8b7
--- /dev/null
+++ b/queue-6.12/drm-amd-display-incorrect-conditions-for-failing-dto.patch
@@ -0,0 +1,41 @@
+From af988cae783fbde88923c436e2f8f0f44026a87e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:04:29 -0400
+Subject: drm/amd/display: incorrect conditions for failing dto calculations
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit 306cbcc6f687d791ab3cc8fbbe30f5286fd0d1e5 ]
+
+[Why & How]
+Previously, when calculating dto phase, we would incorrectly fail when phase
+<=0 without additionally checking for the integer value. This meant that
+calculations would incorrectly fail when the desired pixel clock was an exact
+multiple of the reference clock.
+
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c b/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
+index 62402c7be0a5e..8cdc7ad104549 100644
+--- a/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
+@@ -619,7 +619,7 @@ static void dccg401_set_dp_dto(
+ 		dto_integer = div_u64(params->pixclk_hz, dto_modulo_hz);
+ 		dto_phase_hz = params->pixclk_hz - dto_integer * dto_modulo_hz;
+ 
+-		if (dto_phase_hz <= 0) {
++		if (dto_phase_hz <= 0 && dto_integer <= 0) {
+ 			/* negative pixel rate should never happen */
+ 			BREAK_TO_DEBUGGER();
+ 			return;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch b/queue-6.12/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
new file mode 100644
index 0000000000..dc5340a7c0
--- /dev/null
+++ b/queue-6.12/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
@@ -0,0 +1,59 @@
+From 9abbf9d485d820f2fae329b988425f96eeb599d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 18:04:01 -0400
+Subject: drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit e3419e1e44b87d4176fb98679a77301b1ca40f63 ]
+
+[WHY]
+In the worst case, AUX intra-hop done can take hundreds of milliseconds as
+each retimer in a link might have to wait a full AUX_RD_INTERVAL to send
+LT abort downstream.
+
+[HOW]
+Wait 300ms for each retimer in a link to allow time to propagate a LT abort
+without infinitely waiting on intra-hop done.
+For no-retimer case, keep the max duration at 10ms.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/link/protocols/link_dp_training.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+index 9385a32a471b8..16b5e6b64162a 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+@@ -1012,7 +1012,12 @@ static enum link_training_result dpcd_exit_training_mode(struct dc_link *link, e
+ {
+ 	enum dc_status status;
+ 	uint8_t sink_status = 0;
+-	uint8_t i;
++	uint32_t i;
++	uint8_t lttpr_count = dp_parse_lttpr_repeater_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt);
++	uint32_t intra_hop_disable_time_ms = (lttpr_count > 0 ? lttpr_count * 300 : 10);
++
++	// Each hop could theoretically take over 256ms (max 128b/132b AUX RD INTERVAL)
++	// To be safe, allow 300ms per LTTPR and 10ms for no LTTPR case
+ 
+ 	/* clear training pattern set */
+ 	status = dpcd_set_training_pattern(link, DP_TRAINING_PATTERN_VIDEOIDLE);
+@@ -1022,7 +1027,7 @@ static enum link_training_result dpcd_exit_training_mode(struct dc_link *link, e
+ 
+ 	if (encoding == DP_128b_132b_ENCODING) {
+ 		/* poll for intra-hop disable */
+-		for (i = 0; i < 10; i++) {
++		for (i = 0; i < intra_hop_disable_time_ms; i++) {
+ 			if ((core_link_read_dpcd(link, DP_SINK_STATUS, &sink_status, 1) == DC_OK) &&
+ 					(sink_status & DP_INTRA_HOP_AUX_REPLY_INDICATION) == 0)
+ 				break;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch b/queue-6.12/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
new file mode 100644
index 0000000000..13cfc0d898
--- /dev/null
+++ b/queue-6.12/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
@@ -0,0 +1,84 @@
+From 56f67f2ca034fd1784f12be3e648ac60e9861680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 11:33:22 -0400
+Subject: drm/amd/display: Increase minimum clock for TMDS 420 with pipe
+ splitting
+
+From: Relja Vojvodic <rvojvodi@amd.com>
+
+[ Upstream commit 002a612023c8b105bd3829d81862dee04368d6de ]
+
+[Why]
+-Pipe splitting allows for clocks to be reduced, but when using TMDS 420,
+reduced clocks lead to missed clocks cycles on clock resyncing
+
+[How]
+-Impose a minimum clock when using TMDS 420
+
+Reviewed-by: Chris Park <chris.park@amd.com>
+Signed-off-by: Relja Vojvodic <rvojvodi@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../src/dml2_core/dml2_core_dcn4_calcs.c      | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+index 157903115f3b4..54969ba7e2b7e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+@@ -1262,18 +1262,27 @@ static void CalculateDETBufferSize(
+ 
+ static double CalculateRequiredDispclk(
+ 	enum dml2_odm_mode ODMMode,
+-	double PixelClock)
++	double PixelClock,
++	bool isTMDS420)
+ {
++	double DispClk;
+ 
+ 	if (ODMMode == dml2_odm_mode_combine_4to1) {
+-		return PixelClock / 4.0;
++		DispClk = PixelClock / 4.0;
+ 	} else if (ODMMode == dml2_odm_mode_combine_3to1) {
+-		return PixelClock / 3.0;
++		DispClk = PixelClock / 3.0;
+ 	} else if (ODMMode == dml2_odm_mode_combine_2to1) {
+-		return PixelClock / 2.0;
++		DispClk = PixelClock / 2.0;
+ 	} else {
+-		return PixelClock;
++		DispClk = PixelClock;
++	}
++
++	if (isTMDS420) {
++		double TMDS420MinPixClock = PixelClock / 2.0;
++		DispClk = math_max2(DispClk, TMDS420MinPixClock);
+ 	}
++
++	return DispClk;
+ }
+ 
+ static double TruncToValidBPP(
+@@ -4088,11 +4097,12 @@ static void CalculateODMMode(
+ 	bool success;
+ 	bool UseDSC = DSCEnable && (NumberOfDSCSlices > 0);
+ 	enum dml2_odm_mode DecidedODMMode;
++	bool isTMDS420 = (OutFormat == dml2_420 && Output == dml2_hdmi);
+ 
+-	SurfaceRequiredDISPCLKWithoutODMCombine = CalculateRequiredDispclk(dml2_odm_mode_bypass, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineTwoToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_2to1, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineThreeToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_3to1, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineFourToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_4to1, PixelClock);
++	SurfaceRequiredDISPCLKWithoutODMCombine = CalculateRequiredDispclk(dml2_odm_mode_bypass, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineTwoToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_2to1, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineThreeToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_3to1, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineFourToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_4to1, PixelClock, isTMDS420);
+ #ifdef __DML_VBA_DEBUG__
+ 	dml2_printf("DML::%s: ODMUse = %d\n", __func__, ODMUse);
+ 	dml2_printf("DML::%s: Output = %d\n", __func__, Output);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch b/queue-6.12/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
new file mode 100644
index 0000000000..7b2d4c3dab
--- /dev/null
+++ b/queue-6.12/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
@@ -0,0 +1,271 @@
+From 96de270affedc7e0f5e0b1ba55a25f245fe8ee2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 18:16:24 +0800
+Subject: drm/amd/display: Init dispclk from bootup clock for DCN314
+
+From: Lo-an Chen <lo-an.chen@amd.com>
+
+[ Upstream commit f082daf08f2ff313bdf9cf929a28f6d888117986 ]
+
+[Why]
+Driver does not pick up and save vbios's clocks during init clocks,
+the dispclk in clk_mgr will keep 0 until the first update clocks.
+In some cases, OS changes the timing in the second set mode
+(lower the pixel clock), causing the driver to lower the dispclk
+in prepare bandwidth, which is illegal and causes grey screen.
+
+[How]
+1. Dump and save the vbios's clocks, and init the dispclk in
+dcn314_init_clocks.
+2. Fix the condition in dcn314_update_clocks, regarding a 0kHz value.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Lo-an Chen <lo-an.chen@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c        | 142 +++++++++++++++++-
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.h        |   5 +
+ .../dc/resource/dcn314/dcn314_resource.c      |   1 +
+ 3 files changed, 143 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+index 91d872d6d392b..bc2ad0051b35b 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+@@ -77,6 +77,7 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #undef DC_LOGGER
+ #define DC_LOGGER \
+ 	clk_mgr->base.base.ctx->logger
++
+ #define regCLK1_CLK_PLL_REQ			0x0237
+ #define regCLK1_CLK_PLL_REQ_BASE_IDX		0
+ 
+@@ -87,8 +88,70 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK	0x0000F000L
+ #define CLK1_CLK_PLL_REQ__FbMult_frac_MASK	0xFFFF0000L
+ 
++#define regCLK1_CLK0_DFS_CNTL				0x0269
++#define regCLK1_CLK0_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK1_DFS_CNTL				0x026c
++#define regCLK1_CLK1_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK2_DFS_CNTL				0x026f
++#define regCLK1_CLK2_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK3_DFS_CNTL				0x0272
++#define regCLK1_CLK3_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK4_DFS_CNTL				0x0275
++#define regCLK1_CLK4_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK5_DFS_CNTL				0x0278
++#define regCLK1_CLK5_DFS_CNTL_BASE_IDX		0
++
++#define regCLK1_CLK0_CURRENT_CNT			0x02fb
++#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK1_CURRENT_CNT			0x02fc
++#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK2_CURRENT_CNT			0x02fd
++#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK3_CURRENT_CNT			0x02fe
++#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK4_CURRENT_CNT			0x02ff
++#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK5_CURRENT_CNT			0x0300
++#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX	0
++
++#define regCLK1_CLK0_BYPASS_CNTL			0x028a
++#define regCLK1_CLK0_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK1_BYPASS_CNTL			0x0293
++#define regCLK1_CLK1_BYPASS_CNTL_BASE_IDX	0
+ #define regCLK1_CLK2_BYPASS_CNTL			0x029c
+ #define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK3_BYPASS_CNTL			0x02a5
++#define regCLK1_CLK3_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK4_BYPASS_CNTL			0x02ae
++#define regCLK1_CLK4_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK5_BYPASS_CNTL			0x02b7
++#define regCLK1_CLK5_BYPASS_CNTL_BASE_IDX	0
++
++#define regCLK1_CLK0_DS_CNTL				0x0283
++#define regCLK1_CLK0_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK1_DS_CNTL				0x028c
++#define regCLK1_CLK1_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK2_DS_CNTL				0x0295
++#define regCLK1_CLK2_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK3_DS_CNTL				0x029e
++#define regCLK1_CLK3_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK4_DS_CNTL				0x02a7
++#define regCLK1_CLK4_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK5_DS_CNTL				0x02b0
++#define regCLK1_CLK5_DS_CNTL_BASE_IDX		0
++
++#define regCLK1_CLK0_ALLOW_DS				0x0284
++#define regCLK1_CLK0_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK1_ALLOW_DS				0x028d
++#define regCLK1_CLK1_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK2_ALLOW_DS				0x0296
++#define regCLK1_CLK2_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK3_ALLOW_DS				0x029f
++#define regCLK1_CLK3_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK4_ALLOW_DS				0x02a8
++#define regCLK1_CLK4_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK5_ALLOW_DS				0x02b1
++#define regCLK1_CLK5_ALLOW_DS_BASE_IDX		0
+ 
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT	0x0
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT	0x10
+@@ -185,6 +248,8 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ {
+ 	struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
+ 	uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
++	struct clk_mgr_dcn314 *clk_mgr_dcn314 = TO_CLK_MGR_DCN314(clk_mgr_int);
++	struct clk_log_info log_info = {0};
+ 
+ 	memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+ 	// Assumption is that boot state always supports pstate
+@@ -200,6 +265,9 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ 			dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz);
+ 	else
+ 		clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz;
++
++	dcn314_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn314->base.base, &log_info);
++	clk_mgr->clks.dispclk_khz =  clk_mgr->boot_snapshot.dispclk * 1000;
+ }
+ 
+ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+@@ -218,6 +286,8 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 	if (dc->work_arounds.skip_clock_update)
+ 		return;
+ 
++	display_count = dcn314_get_active_display_cnt_wa(dc, context);
++
+ 	/*
+ 	 * if it is safe to lower, but we are already in the lower state, we don't have to do anything
+ 	 * also if safe to lower is false, we just go in the higher state
+@@ -236,7 +306,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 		}
+ 		/* check that we're not already in lower */
+ 		if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
+-			display_count = dcn314_get_active_display_cnt_wa(dc, context);
+ 			/* if we can go lower, go lower */
+ 			if (display_count == 0) {
+ 				union display_idle_optimization_u idle_info = { 0 };
+@@ -293,11 +362,19 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 		update_dppclk = true;
+ 	}
+ 
+-	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) {
++	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) &&
++	    (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
++		int requested_dispclk_khz = new_clocks->dispclk_khz;
++
+ 		dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true);
+ 
++		/* Clamp the requested clock to PMFW based on their limit. */
++		if (dc->debug.min_disp_clk_khz > 0 && requested_dispclk_khz < dc->debug.min_disp_clk_khz)
++			requested_dispclk_khz = dc->debug.min_disp_clk_khz;
++
++		dcn314_smu_set_dispclk(clk_mgr, requested_dispclk_khz);
+ 		clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
+-		dcn314_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz);
++
+ 		dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false);
+ 
+ 		update_dispclk = true;
+@@ -385,10 +462,65 @@ bool dcn314_are_clock_states_equal(struct dc_clocks *a,
+ 	return true;
+ }
+ 
+-static void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
++
++static void dcn314_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
++{
++	struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
++
++	// read dtbclk
++	internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
++	internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL);
++
++	// read dcfclk
++	internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
++	internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL);
++
++	// read dcf deep sleep divider
++	internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL);
++	internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS);
++
++	// read dppclk
++	internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
++	internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL);
++
++	// read dprefclk
++	internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
++	internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL);
++
++	// read dispclk
++	internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
++	internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL);
++}
++
++void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+ 		struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
+ {
+-	return;
++
++	struct dcn35_clk_internal internal = {0};
++
++	dcn314_dump_clk_registers_internal(&internal, clk_mgr_base);
++
++	regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
++	regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10;
++	regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS;
++	regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
++	regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
++	regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
++	regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
++
++	regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dppclk_bypass < 0 || regs_and_bypass->dppclk_bypass > 4)
++		regs_and_bypass->dppclk_bypass = 0;
++	regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dcfclk_bypass < 0 || regs_and_bypass->dcfclk_bypass > 4)
++		regs_and_bypass->dcfclk_bypass = 0;
++	regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dispclk_bypass < 0 || regs_and_bypass->dispclk_bypass > 4)
++		regs_and_bypass->dispclk_bypass = 0;
++	regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dprefclk_bypass < 0 || regs_and_bypass->dprefclk_bypass > 4)
++		regs_and_bypass->dprefclk_bypass = 0;
++
+ }
+ 
+ static struct clk_bw_params dcn314_bw_params = {
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+index 002c28e807208..0577eb527bc36 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+@@ -65,4 +65,9 @@ void dcn314_clk_mgr_construct(struct dc_context *ctx,
+ 
+ void dcn314_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
+ 
++
++void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
++		struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info);
++
++
+ #endif //__DCN314_CLK_MGR_H__
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+index 585c3e8a21948..024bbf6687af3 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+@@ -928,6 +928,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ 	.enable_legacy_fast_update = true,
+ 	.using_dml2 = false,
+ 	.disable_dsc_power_gate = true,
++	.min_disp_clk_khz = 100000,
+ };
+ 
+ static const struct dc_panel_config panel_config_defaults = {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-move-setup_stream_attribute.patch b/queue-6.12/drm-amd-display-move-setup_stream_attribute.patch
new file mode 100644
index 0000000000..59e0e13abd
--- /dev/null
+++ b/queue-6.12/drm-amd-display-move-setup_stream_attribute.patch
@@ -0,0 +1,122 @@
+From e00f0125958bde81e0facc7d437ede6eaad30b14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 14:08:08 -0500
+Subject: drm/amd/display: Move setup_stream_attribute
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414 ]
+
+[WHY]
+If symclk RCO is enabled, stream encoder may not be receiving an ungated
+clock by the time we attempt to set stream attributes when setting dpms
+on. Since the clock is gated, register writes to the stream encoder fail.
+
+[HOW]
+Move set_stream_attribute call into enable_stream, just after the point
+where symclk32_se is ungated.
+Logically there is no need to set stream attributes as early as is
+currently done in link_set_dpms_on, so this should have no impact beyond
+the RCO fix.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  | 1 +
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c    | 2 ++
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c  | 2 ++
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c            | 3 ---
+ .../drm/amd/display/dc/virtual/virtual_stream_encoder.c    | 7 +++++++
+ 5 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index 03b22e9115ea8..9e5cb609e89ee 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -670,6 +670,7 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
+ 	uint32_t early_control = 0;
+ 	struct timing_generator *tg = pipe_ctx->stream_res.tg;
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
+ 	link_hwss->setup_stream_encoder(pipe_ctx);
+ 
+ 	dc->hwss.update_info_frame(pipe_ctx);
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index d96f52a551940..55f067c9e4948 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3009,6 +3009,8 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
+ 						      link_enc->transmitter - TRANSMITTER_UNIPHY_A);
+ 	}
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
++
+ 	if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+ 		dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ 			dc->res_pool->dccg,
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index bcb296a954f2b..f1a3e70893805 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1019,6 +1019,8 @@ void dcn401_enable_stream(struct pipe_ctx *pipe_ctx)
+ 		}
+ 	}
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
++
+ 	if (dc->res_pool->dccg->funcs->set_pixel_rate_div) {
+ 		dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ 			dc->res_pool->dccg,
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index 9d740659521a4..f6ab52979e331 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -2447,7 +2447,6 @@ void link_set_dpms_on(
+ 	struct link_encoder *link_enc;
+ 	enum otg_out_mux_dest otg_out_dest = OUT_MUX_DIO;
+ 	struct vpg *vpg = pipe_ctx->stream_res.stream_enc->vpg;
+-	const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
+ 	bool apply_edp_fast_boot_optimization =
+ 		pipe_ctx->stream->apply_edp_fast_boot_optimization;
+ 
+@@ -2490,8 +2489,6 @@ void link_set_dpms_on(
+ 		pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, otg_out_dest);
+ 	}
+ 
+-	link_hwss->setup_stream_attribute(pipe_ctx);
+-
+ 	pipe_ctx->stream->apply_edp_fast_boot_optimization = false;
+ 
+ 	// Enable VPG before building infoframe
+diff --git a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
+index ad088d70e1893..6ffc74fc9dcd8 100644
+--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
+@@ -44,6 +44,11 @@ static void virtual_stream_encoder_dvi_set_stream_attribute(
+ 	struct dc_crtc_timing *crtc_timing,
+ 	bool is_dual_link) {}
+ 
++static void virtual_stream_encoder_lvds_set_stream_attribute(
++	struct stream_encoder *enc,
++	struct dc_crtc_timing *crtc_timing)
++{}
++
+ static void virtual_stream_encoder_set_throttled_vcp_size(
+ 	struct stream_encoder *enc,
+ 	struct fixed31_32 avg_time_slots_per_mtp)
+@@ -115,6 +120,8 @@ static const struct stream_encoder_funcs virtual_str_enc_funcs = {
+ 		virtual_stream_encoder_hdmi_set_stream_attribute,
+ 	.dvi_set_stream_attribute =
+ 		virtual_stream_encoder_dvi_set_stream_attribute,
++	.lvds_set_stream_attribute =
++		virtual_stream_encoder_lvds_set_stream_attribute,
+ 	.set_throttled_vcp_size =
+ 		virtual_stream_encoder_set_throttled_vcp_size,
+ 	.update_hdmi_info_packets =
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch b/queue-6.12/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
new file mode 100644
index 0000000000..470e12cac8
--- /dev/null
+++ b/queue-6.12/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
@@ -0,0 +1,44 @@
+From 12301d9251ccb541d05f10d2db0a74b5c8545d96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:58:21 +0800
+Subject: drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Danny Wang <Danny.Wang@amd.com>
+
+[ Upstream commit ad335b5fc9ed1cdeb33fbe97d2969b3a2eedaf3e ]
+
+[WHY&HOW]
+The user closed the lid while the system was powering on and opened it
+again before the “apply_seamless_boot_optimization” was set to false,
+resulting in the eDP remaining blank.
+Reset the “apply_seamless_boot_optimization” to false when dpms off.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Danny Wang <Danny.Wang@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index bdcbebd5722d4..426912d82179c 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3132,7 +3132,7 @@ static void update_seamless_boot_flags(struct dc *dc,
+ 		int surface_count,
+ 		struct dc_stream_state *stream)
+ {
+-	if (get_seamless_boot_stream_count(context) > 0 && surface_count > 0) {
++	if (get_seamless_boot_stream_count(context) > 0 && (surface_count > 0 || stream->dpms_off)) {
+ 		/* Optimize seamless boot flag keeps clocks and watermarks high until
+ 		 * first flip. After first flip, optimization is required to lower
+ 		 * bandwidth. Important to note that it is expected UEFI will
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch b/queue-6.12/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
new file mode 100644
index 0000000000..2a91b2a1b3
--- /dev/null
+++ b/queue-6.12/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
@@ -0,0 +1,45 @@
+From 259ba75b9aec16cb0e3354d10c63ab576c9e936a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 20:18:22 -0500
+Subject: drm/amd/display: Set up pixel encoding for YCBCR422
+
+From: Mario Limonciello <Mario.Limonciello@amd.com>
+
+[ Upstream commit 5e76bc677cb7c92b37d8bc66bb67a18922895be2 ]
+
+[Why]
+fill_stream_properties_from_drm_display_mode() will not configure pixel
+encoding to YCBCR422 when the DRM color format supports YCBCR422 but not
+YCBCR420 or YCBCR4444.  Instead it will fallback to RGB.
+
+[How]
+Add support for YCBCR422 in pixel encoding mapping.
+
+Suggested-by: Mauri Carvalho <mcarvalho3@lenovo.com>
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Mario Limonciello <Mario.Limonciello@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index fd44d011ffd2d..37307caf92999 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6161,6 +6161,9 @@ static void fill_stream_properties_from_drm_display_mode(
+ 			&& aconnector
+ 			&& aconnector->force_yuv420_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
++	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR422)
++			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
++		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR422;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444)
+ 			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR444;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch b/queue-6.12/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
new file mode 100644
index 0000000000..1a92de2def
--- /dev/null
+++ b/queue-6.12/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
@@ -0,0 +1,162 @@
+From ac86958b7737a470a61226d023f9b9151f3894c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:45:26 -0400
+Subject: drm/amd/display: Support HW cursor 180 rot for any number of pipe
+ splits
+
+From: Ivan Lipski <ivan.lipski@amd.com>
+
+[ Upstream commit 8a359f0f138d5ac7ceffd21b73279be50e516c0a ]
+
+[Why]
+For the HW cursor, its current position in the pipe_ctx->stream struct is
+not affected by the 180 rotation, i. e. the top left corner is still at
+0,0. However, the DPP & HUBP set_cursor_position functions require rotated
+position.
+
+The current approach is hard-coded for ODM 2:1, thus it's failing for
+ODM 4:1, resulting in a double cursor.
+
+[How]
+Instead of calculating the new cursor position relatively to the
+viewports, we calculate it using a viewavable clip_rect of each plane.
+
+The clip_rects are first offset and scaled to the same space as the
+src_rect, i. e. Stream space -> Plane space.
+
+In case of a pipe split, which divides the plane into 2 or more viewports,
+the clip_rect is the union of all the viewports of the given plane.
+
+With the assumption that the viewports in HUBP's set_cursor_position are
+in the Plane space as well, it should produce a correct cursor position
+for any number of pipe splits.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dcn10/dcn10_hwseq.c   | 73 +++++++------------
+ 1 file changed, 27 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+index 00be0b26689d3..d33bdefca05bb 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+@@ -3494,6 +3494,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	int y_plane = pipe_ctx->plane_state->dst_rect.y;
+ 	int x_pos = pos_cpy.x;
+ 	int y_pos = pos_cpy.y;
++	int clip_x = pipe_ctx->plane_state->clip_rect.x;
++	int clip_width = pipe_ctx->plane_state->clip_rect.width;
+ 
+ 	if ((pipe_ctx->top_pipe != NULL) || (pipe_ctx->bottom_pipe != NULL)) {
+ 		if ((pipe_ctx->plane_state->src_rect.width != pipe_ctx->plane_res.scl_data.viewport.width) ||
+@@ -3512,7 +3514,7 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	 */
+ 
+ 	/**
+-	 * Translate cursor from stream space to plane space.
++	 * Translate cursor and clip offset from stream space to plane space.
+ 	 *
+ 	 * If the cursor is scaled then we need to scale the position
+ 	 * to be in the approximately correct place. We can't do anything
+@@ -3529,6 +3531,10 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 				pipe_ctx->plane_state->dst_rect.width;
+ 		y_pos = (y_pos - y_plane) * pipe_ctx->plane_state->src_rect.height /
+ 				pipe_ctx->plane_state->dst_rect.height;
++		clip_x = (clip_x - x_plane) * pipe_ctx->plane_state->src_rect.width /
++				pipe_ctx->plane_state->dst_rect.width;
++		clip_width = clip_width * pipe_ctx->plane_state->src_rect.width /
++				pipe_ctx->plane_state->dst_rect.width;
+ 	}
+ 
+ 	/**
+@@ -3575,30 +3581,18 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 
+ 
+ 	if (param.rotation == ROTATION_ANGLE_0) {
+-		int viewport_width =
+-			pipe_ctx->plane_res.scl_data.viewport.width;
+-		int viewport_x =
+-			pipe_ctx->plane_res.scl_data.viewport.x;
+ 
+ 		if (param.mirror) {
+-			if (pipe_split_on || odm_combine_on) {
+-				if (pos_cpy.x >= viewport_width + viewport_x) {
+-					pos_cpy.x = 2 * viewport_width
+-							- pos_cpy.x + 2 * viewport_x;
+-				} else {
+-					uint32_t temp_x = pos_cpy.x;
+-
+-					pos_cpy.x = 2 * viewport_x - pos_cpy.x;
+-					if (temp_x >= viewport_x +
+-						(int)hubp->curs_attr.width || pos_cpy.x
+-						<= (int)hubp->curs_attr.width +
+-						pipe_ctx->plane_state->src_rect.x) {
+-						pos_cpy.x = 2 * viewport_width - temp_x;
+-					}
+-				}
+-			} else {
+-				pos_cpy.x = viewport_width - pos_cpy.x + 2 * viewport_x;
+-			}
++			/*
++			 * The plane is split into multiple viewports.
++			 * The combination of all viewports span the
++			 * entirety of the clip rect.
++			 *
++			 * For no pipe_split, viewport_width is represents
++			 * the full width of the clip_rect, so we can just
++			 * mirror it.
++			 */
++			pos_cpy.x = clip_width - pos_cpy.x + 2 * clip_x;
+ 		}
+ 	}
+ 	// Swap axis and mirror horizontally
+@@ -3668,30 +3662,17 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	}
+ 	// Mirror horizontally and vertically
+ 	else if (param.rotation == ROTATION_ANGLE_180) {
+-		int viewport_width =
+-			pipe_ctx->plane_res.scl_data.viewport.width;
+-		int viewport_x =
+-			pipe_ctx->plane_res.scl_data.viewport.x;
+-
+ 		if (!param.mirror) {
+-			if (pipe_split_on || odm_combine_on) {
+-				if (pos_cpy.x >= viewport_width + viewport_x) {
+-					pos_cpy.x = 2 * viewport_width
+-							- pos_cpy.x + 2 * viewport_x;
+-				} else {
+-					uint32_t temp_x = pos_cpy.x;
+-
+-					pos_cpy.x = 2 * viewport_x - pos_cpy.x;
+-					if (temp_x >= viewport_x +
+-						(int)hubp->curs_attr.width || pos_cpy.x
+-						<= (int)hubp->curs_attr.width +
+-						pipe_ctx->plane_state->src_rect.x) {
+-						pos_cpy.x = temp_x + viewport_width;
+-					}
+-				}
+-			} else {
+-				pos_cpy.x = viewport_width - pos_cpy.x + 2 * viewport_x;
+-			}
++			/*
++			 * The plane is split into multiple viewports.
++			 * The combination of all viewports span the
++			 * entirety of the clip rect.
++			 *
++			 * For no pipe_split, viewport_width is represents
++			 * the full width of the clip_rect, so we can just
++			 * mirror it.
++			 */
++			pos_cpy.x = clip_width - pos_cpy.x + 2 * clip_x;
+ 		}
+ 
+ 		/**
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch b/queue-6.12/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
new file mode 100644
index 0000000000..67b3ad3fb5
--- /dev/null
+++ b/queue-6.12/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
@@ -0,0 +1,123 @@
+From 8fb76b9f9c557347ee06e7ac789d4b78ddd96cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 11:51:42 +0800
+Subject: drm/amd/display: update dpp/disp clock from smu clock table
+
+From: Paul Hsieh <Paul.Hsieh@amd.com>
+
+[ Upstream commit 2e72fdba8a32ce062a86571edff4592710c26215 ]
+
+[Why]
+The reason some high-resolution monitors fail to display properly
+is that this platform does not support sufficiently high DPP and
+DISP clock frequencies
+
+[How]
+Update DISP and DPP clocks from the smu clock table then DML can
+filter these mode if not support.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Paul Hsieh <Paul.Hsieh@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c    | 16 +++++++++++++++
+ .../amd/display/dc/dml/dcn301/dcn301_fpu.c    | 20 ++++++++++++++++---
+ 2 files changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+index 9e2ef0e724fcf..7aee02d562923 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+@@ -563,6 +563,7 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ {
+ 	int i, j;
+ 	struct clk_bw_params *bw_params = clk_mgr->base.bw_params;
++	uint32_t max_dispclk = 0, max_dppclk = 0;
+ 
+ 	j = -1;
+ 
+@@ -584,6 +585,15 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		return;
+ 	}
+ 
++	/* dispclk and dppclk can be max at any voltage, same number of levels for both */
++	if (clock_table->NumDispClkLevelsEnabled <= VG_NUM_DISPCLK_DPM_LEVELS &&
++	    clock_table->NumDispClkLevelsEnabled <= VG_NUM_DPPCLK_DPM_LEVELS) {
++		max_dispclk = find_max_clk_value(clock_table->DispClocks, clock_table->NumDispClkLevelsEnabled);
++		max_dppclk = find_max_clk_value(clock_table->DppClocks, clock_table->NumDispClkLevelsEnabled);
++	} else {
++		ASSERT(0);
++	}
++
+ 	bw_params->clk_table.num_entries = j + 1;
+ 
+ 	for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) {
+@@ -591,11 +601,17 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 		bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 		bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage);
++
++		/* Now update clocks we do read */
++		bw_params->clk_table.entries[i].dispclk_mhz = max_dispclk;
++		bw_params->clk_table.entries[i].dppclk_mhz = max_dppclk;
+ 	}
+ 	bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk;
+ 	bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 	bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 	bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dispclk_mhz = find_max_clk_value(clock_table->DispClocks, VG_NUM_DISPCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dppclk_mhz = find_max_clk_value(clock_table->DppClocks, VG_NUM_DPPCLK_DPM_LEVELS);
+ 
+ 	bw_params->vram_type = bios_info->memory_type;
+ 	bw_params->num_channels = bios_info->ma_channel_number;
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+index 0c0b2d67c9cd9..2066a65c69bbc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+@@ -326,7 +326,7 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 	struct dcn301_resource_pool *pool = TO_DCN301_RES_POOL(dc->res_pool);
+ 	struct clk_limit_table *clk_table = &bw_params->clk_table;
+ 	unsigned int i, closest_clk_lvl;
+-	int j;
++	int j = 0, max_dispclk_mhz = 0, max_dppclk_mhz = 0;
+ 
+ 	dc_assert_fp_enabled();
+ 
+@@ -338,6 +338,15 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 	dcn3_01_soc.num_chans = bw_params->num_channels;
+ 
+ 	ASSERT(clk_table->num_entries);
++
++	/* Prepass to find max clocks independent of voltage level. */
++	for (i = 0; i < clk_table->num_entries; ++i) {
++		if (clk_table->entries[i].dispclk_mhz > max_dispclk_mhz)
++			max_dispclk_mhz = clk_table->entries[i].dispclk_mhz;
++		if (clk_table->entries[i].dppclk_mhz > max_dppclk_mhz)
++			max_dppclk_mhz = clk_table->entries[i].dppclk_mhz;
++	}
++
+ 	for (i = 0; i < clk_table->num_entries; i++) {
+ 		/* loop backwards*/
+ 		for (closest_clk_lvl = 0, j = dcn3_01_soc.num_states - 1; j >= 0; j--) {
+@@ -353,8 +362,13 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 		s[i].socclk_mhz = clk_table->entries[i].socclk_mhz;
+ 		s[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 2;
+ 
+-		s[i].dispclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
+-		s[i].dppclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++		/* Clocks independent of voltage level. */
++		s[i].dispclk_mhz = max_dispclk_mhz ? max_dispclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
++
++		s[i].dppclk_mhz = max_dppclk_mhz ? max_dppclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++
+ 		s[i].dram_bw_per_chan_gbps =
+ 			dcn3_01_soc.clock_limits[closest_clk_lvl].dram_bw_per_chan_gbps;
+ 		s[i].dscclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dscclk_mhz;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-display-wait-until-otg-enable-state-is-clear.patch b/queue-6.12/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
new file mode 100644
index 0000000000..89fd8442d2
--- /dev/null
+++ b/queue-6.12/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
@@ -0,0 +1,48 @@
+From 6222749da264379e125980cdbd1e54165ed19d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:56:59 +0800
+Subject: drm/amd/display: Wait until OTG enable state is cleared
+
+From: TungYu Lu <tungyu.lu@amd.com>
+
+[ Upstream commit e7496c15d830689cc4fc666b976c845ed2c5ed28 ]
+
+[Why]
+Customer reported an issue that OS starts and stops device multiple times
+during driver installation. Frequently disabling and enabling OTG may
+prevent OTG from being safely disabled and cause incorrect configuration
+upon the next enablement.
+
+[How]
+Add a wait until OTG_CURRENT_MASTER_EN_STATE is cleared as a short term
+solution.
+
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: TungYu Lu <tungyu.lu@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
+index a5d6a7dca554c..27a9ec55d53ec 100644
+--- a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
+@@ -226,6 +226,11 @@ static bool optc401_disable_crtc(struct timing_generator *optc)
+ 	REG_UPDATE(CONTROL,
+ 			VTG0_ENABLE, 0);
+ 
++	// wait until CRTC_CURRENT_MASTER_EN_STATE == 0
++	REG_WAIT(OTG_CONTROL,
++			 OTG_CURRENT_MASTER_EN_STATE,
++			 0, 10, 15000);
++
+ 	/* CRTC disabled, so disable  clock. */
+ 	REG_WAIT(OTG_CLOCK_CONTROL,
+ 			OTG_BUSY, 0,
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch b/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
new file mode 100644
index 0000000000..4cd4ebccca
--- /dev/null
+++ b/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
@@ -0,0 +1,37 @@
+From baad2dd87e2ba16383e2b6d9a5f661d2286e621b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:15:45 +0530
+Subject: drm/amd/pm: Use cached metrics data on aldebaran
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
+
+Cached metrics data validity is 1ms on aldebaran. It's not reasonable
+for any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index 5a1f24438e472..dcd0422b67895 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1716,7 +1716,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..61e408d568
--- /dev/null
+++ b/queue-6.12/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From 48b1c3a9a85b5a50a8d1b8b7889a559fc964d2ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index d4b954b22441c..3e52668a98b4c 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2326,7 +2326,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch b/queue-6.12/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
new file mode 100644
index 0000000000..cd461a289b
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
@@ -0,0 +1,137 @@
+From bf78e9ec7310aa5c8ba8e56d76584ed3ca1afd77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 16:16:02 +0800
+Subject: drm/amdgpu: add range check for RAS bad page address
+
+From: Tao Zhou <tao.zhou1@amd.com>
+
+[ Upstream commit 2b17c240e8cd9ac61d3c82277fbed27edad7f002 ]
+
+Exclude invalid bad pages.
+
+Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 58 ++++++++++++-------------
+ 1 file changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 1a1395c5fff15..f5148027107bc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -134,9 +134,9 @@ enum amdgpu_ras_retire_page_reservation {
+ 
+ atomic_t amdgpu_ras_in_intr = ATOMIC_INIT(0);
+ 
+-static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
++static int amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+ 				uint64_t addr);
+-static bool amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
++static int amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
+ 				uint64_t addr);
+ #ifdef CONFIG_X86_MCE_AMD
+ static void amdgpu_register_bad_pages_mca_notifier(struct amdgpu_device *adev);
+@@ -167,18 +167,16 @@ static int amdgpu_reserve_page_direct(struct amdgpu_device *adev, uint64_t addre
+ 	struct eeprom_table_record err_rec;
+ 	int ret;
+ 
+-	if ((address >= adev->gmc.mc_vram_size) ||
+-	    (address >= RAS_UMC_INJECT_ADDR_LIMIT)) {
++	ret = amdgpu_ras_check_bad_page(adev, address);
++	if (ret == -EINVAL) {
+ 		dev_warn(adev->dev,
+-		         "RAS WARN: input address 0x%llx is invalid.\n",
+-		         address);
++			"RAS WARN: input address 0x%llx is invalid.\n",
++			address);
+ 		return -EINVAL;
+-	}
+-
+-	if (amdgpu_ras_check_bad_page(adev, address)) {
++	} else if (ret == 1) {
+ 		dev_warn(adev->dev,
+-			 "RAS WARN: 0x%llx has already been marked as bad page!\n",
+-			 address);
++			"RAS WARN: 0x%llx has already been marked as bad page!\n",
++			address);
+ 		return 0;
+ 	}
+ 
+@@ -511,22 +509,16 @@ static ssize_t amdgpu_ras_debugfs_ctrl_write(struct file *f,
+ 		ret = amdgpu_ras_feature_enable(adev, &data.head, 1);
+ 		break;
+ 	case 2:
+-		if ((data.inject.address >= adev->gmc.mc_vram_size &&
+-		    adev->gmc.mc_vram_size) ||
+-		    (data.inject.address >= RAS_UMC_INJECT_ADDR_LIMIT)) {
+-			dev_warn(adev->dev, "RAS WARN: input address "
+-					"0x%llx is invalid.",
++		/* umc ce/ue error injection for a bad page is not allowed */
++		if (data.head.block == AMDGPU_RAS_BLOCK__UMC)
++			ret = amdgpu_ras_check_bad_page(adev, data.inject.address);
++		if (ret == -EINVAL) {
++			dev_warn(adev->dev, "RAS WARN: input address 0x%llx is invalid.",
+ 					data.inject.address);
+-			ret = -EINVAL;
+ 			break;
+-		}
+-
+-		/* umc ce/ue error injection for a bad page is not allowed */
+-		if ((data.head.block == AMDGPU_RAS_BLOCK__UMC) &&
+-		    amdgpu_ras_check_bad_page(adev, data.inject.address)) {
+-			dev_warn(adev->dev, "RAS WARN: inject: 0x%llx has "
+-				 "already been marked as bad!\n",
+-				 data.inject.address);
++		} else if (ret == 1) {
++			dev_warn(adev->dev, "RAS WARN: inject: 0x%llx has already been marked as bad!\n",
++					data.inject.address);
+ 			break;
+ 		}
+ 
+@@ -2774,18 +2766,24 @@ static int amdgpu_ras_load_bad_pages(struct amdgpu_device *adev)
+ 	return ret;
+ }
+ 
+-static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
++static int amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+ 				uint64_t addr)
+ {
+ 	struct ras_err_handler_data *data = con->eh_data;
++	struct amdgpu_device *adev = con->adev;
+ 	int i;
+ 
++	if ((addr >= adev->gmc.mc_vram_size &&
++	    adev->gmc.mc_vram_size) ||
++	    (addr >= RAS_UMC_INJECT_ADDR_LIMIT))
++		return -EINVAL;
++
+ 	addr >>= AMDGPU_GPU_PAGE_SHIFT;
+ 	for (i = 0; i < data->count; i++)
+ 		if (addr == data->bps[i].retired_page)
+-			return true;
++			return 1;
+ 
+-	return false;
++	return 0;
+ }
+ 
+ /*
+@@ -2793,11 +2791,11 @@ static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+  *
+  * Note: this check is only for umc block
+  */
+-static bool amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
++static int amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
+ 				uint64_t addr)
+ {
+ 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
+-	bool ret = false;
++	int ret = 0;
+ 
+ 	if (!con || !con->eh_data)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch b/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
new file mode 100644
index 0000000000..c90a0d1a37
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
@@ -0,0 +1,44 @@
+From cb9488c89b571437106a492fb759d590bd13d8bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:21:16 -0400
+Subject: drm/amdgpu: add support for cyan skillfish gpu_info
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
+
+Some SOCs which are part of the cyan skillfish family
+rely on an explicit firmware for IP discovery.  Add support
+for the gpu_info firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 373c626247a1a..7ff81bd1ec200 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -93,6 +93,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin");
++MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin");
+ 
+ #define AMDGPU_RESUME_MS		2000
+ #define AMDGPU_MAX_RETRY_LIMIT		2
+@@ -2412,6 +2413,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
+ 			return 0;
+ 		chip_name = "navi12";
+ 		break;
++	case CHIP_CYAN_SKILLFISH:
++		chip_name = "cyan_skillfish";
++		break;
+ 	}
+ 
+ 	err = amdgpu_ucode_request(adev, &adev->firmware.gpu_info_fw,
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch b/queue-6.12/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
new file mode 100644
index 0000000000..731d223bde
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
@@ -0,0 +1,40 @@
+From 50ca68f72c8e0fcd5eb337e59404e2db8040180e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:01:32 -0500
+Subject: drm/amdgpu: Allow kfd CRIU with no buffer objects
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
+
+The kfd CRIU checkpoint ioctl would return an error if trying
+to checkpoint a process with no kfd buffer objects.
+
+This is a normal case and should not be an error.
+
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 7fbbc67adfd9e..0e73ec69192c3 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2572,8 +2572,8 @@ static int criu_restore(struct file *filep,
+ 	pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
+ 		 args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
+ 
+-	if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size ||
+-	    !args->num_devices || !args->num_bos)
++	if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
++	    !args->priv_data_size || !args->num_devices)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&p->mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch b/queue-6.12/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
new file mode 100644
index 0000000000..70f97af61e
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
@@ -0,0 +1,41 @@
+From 1a40c5551cdc12f52ba57a64f9e149e9e9cd873b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:57:05 +0800
+Subject: drm/amdgpu/atom: Check kcalloc() for WS buffer in
+ amdgpu_atom_execute_table_locked()
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+[ Upstream commit cc9a8e238e42c1f43b98c097995137d644b69245 ]
+
+kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws
+remains NULL while ectx.ws_size is set, leading to a potential NULL
+pointer dereference in atom_get_src_int() when accessing WS entries.
+
+Return -ENOMEM on allocation failure to avoid the NULL dereference.
+
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/atom.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index 81d195d366ceb..bed3083f317b8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -1246,6 +1246,10 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
+ 	ectx.last_jump_jiffies = 0;
+ 	if (ws) {
+ 		ectx.ws = kcalloc(4, ws, GFP_KERNEL);
++		if (!ectx.ws) {
++			ret = -ENOMEM;
++			goto free;
++		}
+ 		ectx.ws_size = ws;
+ 	} else {
+ 		ectx.ws = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch b/queue-6.12/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
new file mode 100644
index 0000000000..b8f4960d95
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
@@ -0,0 +1,103 @@
+From 8baea98b24b075bdf654df018c5e12c627f4d1f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 12:06:55 +0800
+Subject: drm/amdgpu: Avoid rma causes GPU duplicate reset
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 21c0ffa612c98bcc6dab5bd9d977a18d565ee28e ]
+
+Try to ensure poison creation handle is completed in time
+to set device rma value.
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 17 ++++++++++-------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h |  1 +
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index f5148027107bc..d9cdc89d4cde1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -2927,7 +2927,6 @@ static void amdgpu_ras_do_page_retirement(struct work_struct *work)
+ 					      page_retirement_dwork.work);
+ 	struct amdgpu_device *adev = con->adev;
+ 	struct ras_err_data err_data;
+-	unsigned long err_cnt;
+ 
+ 	/* If gpu reset is ongoing, delay retiring the bad pages */
+ 	if (amdgpu_in_reset(adev) || amdgpu_ras_in_recovery(adev)) {
+@@ -2939,13 +2938,9 @@ static void amdgpu_ras_do_page_retirement(struct work_struct *work)
+ 	amdgpu_ras_error_data_init(&err_data);
+ 
+ 	amdgpu_umc_handle_bad_pages(adev, &err_data);
+-	err_cnt = err_data.err_addr_cnt;
+ 
+ 	amdgpu_ras_error_data_fini(&err_data);
+ 
+-	if (err_cnt && amdgpu_ras_is_rma(adev))
+-		amdgpu_ras_reset_gpu(adev);
+-
+ 	amdgpu_ras_schedule_retirement_dwork(con,
+ 			AMDGPU_RAS_RETIRE_PAGE_INTERVAL);
+ }
+@@ -3008,6 +3003,9 @@ static int amdgpu_ras_poison_creation_handler(struct amdgpu_device *adev,
+ 	if (total_detect_count)
+ 		schedule_delayed_work(&ras->page_retirement_dwork, 0);
+ 
++	if (amdgpu_ras_is_rma(adev) && atomic_cmpxchg(&ras->rma_in_recovery, 0, 1) == 0)
++		amdgpu_ras_reset_gpu(adev);
++
+ 	return 0;
+ }
+ 
+@@ -3043,6 +3041,12 @@ static int amdgpu_ras_poison_consumption_handler(struct amdgpu_device *adev,
+ 		reset_flags |= msg.reset;
+ 	}
+ 
++	/*
++	 * Try to ensure poison creation handler is completed first
++	 * to set rma if bad page exceed threshold.
++	 */
++	flush_delayed_work(&con->page_retirement_dwork);
++
+ 	/* for RMA, amdgpu_ras_poison_creation_handler will trigger gpu reset */
+ 	if (reset_flags && !amdgpu_ras_is_rma(adev)) {
+ 		if (reset_flags & AMDGPU_RAS_GPU_RESET_MODE1_RESET)
+@@ -3052,8 +3056,6 @@ static int amdgpu_ras_poison_consumption_handler(struct amdgpu_device *adev,
+ 		else
+ 			reset = reset_flags;
+ 
+-		flush_delayed_work(&con->page_retirement_dwork);
+-
+ 		con->gpu_reset_flags |= reset;
+ 		amdgpu_ras_reset_gpu(adev);
+ 
+@@ -3174,6 +3176,7 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev)
+ 	mutex_init(&con->recovery_lock);
+ 	INIT_WORK(&con->recovery_work, amdgpu_ras_do_recovery);
+ 	atomic_set(&con->in_recovery, 0);
++	atomic_set(&con->rma_in_recovery, 0);
+ 	con->eeprom_control.bad_channel_bitmap = 0;
+ 
+ 	max_eeprom_records_count = amdgpu_ras_eeprom_max_record_count(&con->eeprom_control);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+index 669720a9c60af..7e7521fedafc7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+@@ -510,6 +510,7 @@ struct amdgpu_ras {
+ 	/* gpu recovery */
+ 	struct work_struct recovery_work;
+ 	atomic_t in_recovery;
++	atomic_t rma_in_recovery;
+ 	struct amdgpu_device *adev;
+ 	/* error handler data */
+ 	struct ras_err_handler_data *eh_data;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch b/queue-6.12/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
new file mode 100644
index 0000000000..d32649a1d7
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
@@ -0,0 +1,36 @@
+From 1c9d9403c045b00ad41712219e1c49b14a832ce4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:22:30 +0800
+Subject: drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
+
+From: Mangesh Gadre <Mangesh.Gadre@amd.com>
+
+[ Upstream commit 37551277dfed796b6749e4fa52bdb62403cfdb42 ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini
+
+Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+index d8bbb93767318..0034e71283964 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+@@ -284,7 +284,7 @@ static int vcn_v5_0_1_hw_fini(struct amdgpu_ip_block *ip_block)
+ 			vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+ 	}
+ 
+-	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
+ 		amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-check-vcn-sram-load-return-value.patch b/queue-6.12/drm-amdgpu-check-vcn-sram-load-return-value.patch
new file mode 100644
index 0000000000..d8da107543
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-check-vcn-sram-load-return-value.patch
@@ -0,0 +1,255 @@
+From e343c4bede554c29de0ca8bc475da9e5183a29a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Jul 2025 01:28:02 +0530
+Subject: drm/amdgpu: Check vcn sram load return value
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit faab5ea0836733ef1c8e83cf6b05690a5c9066be ]
+
+Log an error when vcn sram load fails in indirect mode
+and return the same error value.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 11 ++++++++---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c |  9 +++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 11 ++++++++---
+ 8 files changed, 63 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+index f0edaabdcde5d..f085fdaafae00 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+@@ -842,6 +842,7 @@ static int vcn_v2_0_start_dpg_mode(struct amdgpu_device *adev, bool indirect)
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst->fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring = &adev->vcn.inst->ring_dec;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	vcn_v2_0_enable_static_power_gating(adev);
+ 
+@@ -925,8 +926,13 @@ static int vcn_v2_0_start_dpg_mode(struct amdgpu_device *adev, bool indirect)
+ 		UVD, 0, mmUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, 0, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, 0, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	/* force RBC into idle state */
+ 	rb_bufsz = order_base_2(ring->ring_size);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index e4d0c0310e76d..274d5063e9a26 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -870,6 +870,7 @@ static int vcn_v2_5_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, mmUVD_POWER_STATUS), 1,
+@@ -960,8 +961,13 @@ static int vcn_v2_5_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 		VCN, 0, mmUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_dec;
+ 	/* force RBC into idle state */
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+index 9700414520963..4196bdece253b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -990,6 +990,7 @@ static int vcn_v3_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, mmUVD_POWER_STATUS), 1,
+@@ -1082,8 +1083,13 @@ static int vcn_v3_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 	WREG32_SOC15_DPG_MODE(inst_idx, SOC15_DPG_MODE_OFFSET(
+ 		VCN, inst_idx, mmUVD_VCPU_CNTL), tmp, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_dec;
+ 	/* force RBC into idle state */
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+index 33d413444a46a..ae510fd9d2944 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+@@ -963,6 +963,7 @@ static int vcn_v4_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -1045,8 +1046,13 @@ static int vcn_v4_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, boo
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+index 77542dabec59f..2094357a931c4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -778,7 +778,7 @@ static int vcn_v4_0_3_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared =
+ 						adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+-	int vcn_inst;
++	int vcn_inst, ret;
+ 	uint32_t tmp;
+ 
+ 	vcn_inst = GET_INST(VCN, inst_idx);
+@@ -871,8 +871,13 @@ static int vcn_v4_0_3_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 		VCN, 0, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+index 3d114ea7049f7..48cb61a9c13fe 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+@@ -876,6 +876,7 @@ static int vcn_v4_0_5_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -956,8 +957,13 @@ static int vcn_v4_0_5_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 		VCN, inst_idx, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
+index d19eec4d47905..cc7add217fd19 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
+@@ -665,6 +665,7 @@ static int vcn_v5_0_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 	volatile struct amdgpu_vcn5_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -718,8 +719,12 @@ static int vcn_v5_0_0_start_dpg_mode(struct amdgpu_device *adev, int inst_idx, b
+ 		VCN, inst_idx, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		dev_err(adev->dev, "%s: vcn sram load failed %d\n", __func__, ret);
++		if (ret)
++			return ret;
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+index cdefd7fcb0da6..d8bbb93767318 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+@@ -605,7 +605,7 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	struct dpg_pause_state state = {.fw_based = VCN_DPG_STATE__PAUSE};
+-	int vcn_inst;
++	int vcn_inst, ret;
+ 	uint32_t tmp;
+ 
+ 	vcn_inst = GET_INST(VCN, inst_idx);
+@@ -666,8 +666,13 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		VCN, 0, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	/* resetting ring, fw should not check RB ring */
+ 	fw_shared->sq.queue_mode |= FW_QUEUE_RING_RESET;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch b/queue-6.12/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
new file mode 100644
index 0000000000..7439b77f7b
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
@@ -0,0 +1,43 @@
+From 7542cae1407f3f6de9352fdc52d9f846b4657c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 12:36:05 +0800
+Subject: drm/amdgpu: Correct the counts of nr_banks and nr_errors
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 907813e5d7cadfeafab12467d748705a5309efb0 ]
+
+Correct the counts of nr_banks and nr_errors
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+index a95f45d063144..a7ecc33ddf223 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+@@ -86,6 +86,7 @@ static void aca_banks_release(struct aca_banks *banks)
+ 	list_for_each_entry_safe(node, tmp, &banks->list, node) {
+ 		list_del(&node->node);
+ 		kvfree(node);
++		banks->nr_banks--;
+ 	}
+ }
+ 
+@@ -236,6 +237,7 @@ static struct aca_bank_error *new_bank_error(struct aca_error *aerr, struct aca_
+ 
+ 	mutex_lock(&aerr->lock);
+ 	list_add_tail(&bank_error->node, &aerr->list);
++	aerr->nr_errors++;
+ 	mutex_unlock(&aerr->lock);
+ 
+ 	return bank_error;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch b/queue-6.12/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
new file mode 100644
index 0000000000..e99832047c
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
@@ -0,0 +1,42 @@
+From 03e03db96b9e88a1bbe35744f3930103b34ca4aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:25:09 -0400
+Subject: drm/amdgpu: don't enable SMU on cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
+
+Cyan skillfish uses different SMU firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index e00b5e4542347..e09db65880e1a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2040,13 +2040,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
+ 	case IP_VERSION(11, 0, 5):
+ 	case IP_VERSION(11, 0, 9):
+ 	case IP_VERSION(11, 0, 7):
+-	case IP_VERSION(11, 0, 8):
+ 	case IP_VERSION(11, 0, 11):
+ 	case IP_VERSION(11, 0, 12):
+ 	case IP_VERSION(11, 0, 13):
+ 	case IP_VERSION(11, 5, 0):
+ 		amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
+ 		break;
++	case IP_VERSION(11, 0, 8):
++		if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2)
++			amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
++		break;
+ 	case IP_VERSION(12, 0, 0):
+ 	case IP_VERSION(12, 0, 1):
+ 		amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block);
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch b/queue-6.12/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
new file mode 100644
index 0000000000..75ea39ce8d
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
@@ -0,0 +1,52 @@
+From ea6fc649626d94c7c84349298bc2cd015176c3ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:18:04 +0800
+Subject: drm/amdgpu: fix nullptr err of vm_handle_moved
+
+From: Heng Zhou <Heng.Zhou@amd.com>
+
+[ Upstream commit 859958a7faefe5b7742b7b8cdbc170713d4bf158 ]
+
+If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL.
+So, such kind of amdgpu_bo_va should be updated separately before
+amdgpu_vm_handle_moved.
+
+Signed-off-by: Heng Zhou <Heng.Zhou@amd.com>
+Reviewed-by: Kasiviswanathan, Harish <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index d349a4816e537..fff89288e2f4b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -3001,9 +3001,22 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence __rcu *
+ 		struct amdgpu_device *adev = amdgpu_ttm_adev(
+ 			peer_vm->root.bo->tbo.bdev);
+ 
++		struct amdgpu_fpriv *fpriv =
++			container_of(peer_vm, struct amdgpu_fpriv, vm);
++
++		ret = amdgpu_vm_bo_update(adev, fpriv->prt_va, false);
++		if (ret) {
++			dev_dbg(adev->dev,
++				"Memory eviction: handle PRT moved failed, pid %8d. Try again.\n",
++				pid_nr(process_info->pid));
++			goto validate_map_fail;
++		}
++
+ 		ret = amdgpu_vm_handle_moved(adev, peer_vm, &exec.ticket);
+ 		if (ret) {
+-			pr_debug("Memory eviction: handle moved failed. Try again\n");
++			dev_dbg(adev->dev,
++				"Memory eviction: handle moved failed, pid %8d. Try again.\n",
++				pid_nr(process_info->pid));
+ 			goto validate_map_fail;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-6.12/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..e70e00a229
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From 54e9ea4a47ce9e3bea5c8e5d1c80dbb584bfb06c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 6df99cb00d9a5..f96a79a4d5397 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -117,10 +117,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 			fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec[j]);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-reject-gang-submissions-under-sriov.patch b/queue-6.12/drm-amdgpu-reject-gang-submissions-under-sriov.patch
new file mode 100644
index 0000000000..1657c2316a
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-reject-gang-submissions-under-sriov.patch
@@ -0,0 +1,52 @@
+From ddd40d1e4f8db3a71662b641b9c9bb99533f7418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 13:14:43 +0200
+Subject: drm/amdgpu: reject gang submissions under SRIOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
+
+Gang submission means that the kernel driver guarantees that multiple
+submissions are executed on the HW at the same time on different engines.
+
+Background is that those submissions then depend on each other and each
+can't finish stand alone.
+
+SRIOV now uses world switch to preempt submissions on the engines to allow
+sharing the HW resources between multiple VFs.
+
+The problem is now that the SRIOV world switch can't know about such inter
+dependencies and will cause a timeout if it waits for a partially running
+gang submission.
+
+To conclude SRIOV and gang submissions are fundamentally incompatible at
+the moment. For now just disable them.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 187263c0406ef..082fc12fe28dc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -286,7 +286,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
+ 		}
+ 	}
+ 
+-	if (!p->gang_size) {
++	if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) {
+ 		ret = -EINVAL;
+ 		goto free_all_kdata;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch b/queue-6.12/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
new file mode 100644
index 0000000000..b96977326c
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
@@ -0,0 +1,114 @@
+From 6ed87170c3ede3c04141295a0d79824bc131f7f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:50:36 +0200
+Subject: drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
+
+Update the legacy (non-DC) display code to respect the maximum
+pixel clock for HDMI and DVI-D. Reject modes that would require
+a higher pixel clock than can be supported.
+
+Also update the maximum supported HDMI clock value depending on
+the ASIC type.
+
+For reference, see the DC code:
+check max_hdmi_pixel_clock in dce*_resource.c
+
+v2:
+Fix maximum clocks for DVI-D and DVI/HDMI adapters.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/amdgpu_connectors.c    | 57 ++++++++++++++-----
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index 344e0a9ee08a9..f9e679de79a7c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -1195,29 +1195,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector)
+ 		amdgpu_connector->use_digital = true;
+ }
+ 
++/**
++ * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
++ */
++static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
++{
++	if (adev->asic_type >= CHIP_POLARIS10)
++		return 600000;
++	else if (adev->asic_type >= CHIP_TONGA)
++		return 300000;
++	else
++		return 297000;
++}
++
++/**
++ * Validates the given display mode on DVI and HDMI connectors,
++ * including analog signals on DVI-I.
++ */
+ static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
+ 					    struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
++	const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev);
++	const int max_dvi_single_link_pixel_clock = 165000;
++	int max_digital_pixel_clock_khz;
+ 
+ 	/* XXX check mode bandwidth */
+ 
+-	if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
+-		if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
+-			return MODE_OK;
+-		} else if (connector->display_info.is_hdmi) {
+-			/* HDMI 1.3+ supports max clock of 340 Mhz */
+-			if (mode->clock > 340000)
+-				return MODE_CLOCK_HIGH;
+-			else
+-				return MODE_OK;
+-		} else {
+-			return MODE_CLOCK_HIGH;
++	if (amdgpu_connector->use_digital) {
++		switch (amdgpu_connector->connector_object_id) {
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_A:
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D:
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_B:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2;
++			break;
+ 		}
++
++		/* When the display EDID claims that it's an HDMI display,
++		 * we use the HDMI encoder mode of the display HW,
++		 * so we should verify against the max HDMI clock here.
++		 */
++		if (connector->display_info.is_hdmi)
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++
++		if (mode->clock > max_digital_pixel_clock_khz)
++			return MODE_CLOCK_HIGH;
+ 	}
+ 
+ 	/* check against the max pixel clock */
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch b/queue-6.12/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
new file mode 100644
index 0000000000..4a7f998562
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
@@ -0,0 +1,98 @@
+From e66897c90964d81bafee309697a571ca9d75df65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 11:07:43 +0800
+Subject: drm/amdgpu: Skip poison aca bank from UE channel
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 8e8e08c831f088ed581444c58a635c49ea1222ab ]
+
+Avoid GFX poison consumption errors logged when fatal error occurs.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 51 +++++++++++++++----------
+ 1 file changed, 30 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+index 9d6345146495f..a95f45d063144 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+@@ -132,6 +132,27 @@ static void aca_smu_bank_dump(struct amdgpu_device *adev, int idx, int total, st
+ 			      idx + 1, total, aca_regs[i].name, bank->regs[aca_regs[i].reg_idx]);
+ }
+ 
++static bool aca_bank_hwip_is_matched(struct aca_bank *bank, enum aca_hwip_type type)
++{
++
++	struct aca_hwip *hwip;
++	int hwid, mcatype;
++	u64 ipid;
++
++	if (!bank || type == ACA_HWIP_TYPE_UNKNOW)
++		return false;
++
++	hwip = &aca_hwid_mcatypes[type];
++	if (!hwip->hwid)
++		return false;
++
++	ipid = bank->regs[ACA_REG_IDX_IPID];
++	hwid = ACA_REG__IPID__HARDWAREID(ipid);
++	mcatype = ACA_REG__IPID__MCATYPE(ipid);
++
++	return hwip->hwid == hwid && hwip->mcatype == mcatype;
++}
++
+ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_type type,
+ 				       int start, int count,
+ 				       struct aca_banks *banks, struct ras_query_context *qctx)
+@@ -170,6 +191,15 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_
+ 
+ 		bank.type = type;
+ 
++		/*
++		 * Poison being consumed when injecting a UE while running background workloads,
++		 * which are unexpected.
++		 */
++		if (type == ACA_SMU_TYPE_UE &&
++		    ACA_REG__STATUS__POISON(bank.regs[ACA_REG_IDX_STATUS]) &&
++		    !aca_bank_hwip_is_matched(&bank, ACA_HWIP_TYPE_UMC))
++			continue;
++
+ 		aca_smu_bank_dump(adev, i, count, &bank, qctx);
+ 
+ 		ret = aca_banks_add_bank(banks, &bank);
+@@ -180,27 +210,6 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_
+ 	return 0;
+ }
+ 
+-static bool aca_bank_hwip_is_matched(struct aca_bank *bank, enum aca_hwip_type type)
+-{
+-
+-	struct aca_hwip *hwip;
+-	int hwid, mcatype;
+-	u64 ipid;
+-
+-	if (!bank || type == ACA_HWIP_TYPE_UNKNOW)
+-		return false;
+-
+-	hwip = &aca_hwid_mcatypes[type];
+-	if (!hwip->hwid)
+-		return false;
+-
+-	ipid = bank->regs[ACA_REG_IDX_IPID];
+-	hwid = ACA_REG__IPID__HARDWAREID(ipid);
+-	mcatype = ACA_REG__IPID__MCATYPE(ipid);
+-
+-	return hwip->hwid == hwid && hwip->mcatype == mcatype;
+-}
+-
+ static bool aca_bank_is_valid(struct aca_handle *handle, struct aca_bank *bank, enum aca_smu_type type)
+ {
+ 	const struct aca_bank_ops *bank_ops = handle->bank_ops;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch b/queue-6.12/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
new file mode 100644
index 0000000000..4d844e470a
--- /dev/null
+++ b/queue-6.12/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
@@ -0,0 +1,64 @@
+From b0497a3a733d4a41372b73e60b7f4c98c23ca100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 11:44:27 +0100
+Subject: drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
+
+Replace kmalloc_array() + copy_from_user() with memdup_array_user().
+
+This shrinks the source code and improves separation between the kernel
+and userspace slabs.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 5df21529b3b13..187263c0406ef 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1737,30 +1737,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
+ {
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	union drm_amdgpu_wait_fences *wait = data;
+-	uint32_t fence_count = wait->in.fence_count;
+-	struct drm_amdgpu_fence *fences_user;
+ 	struct drm_amdgpu_fence *fences;
+ 	int r;
+ 
+ 	/* Get the fences from userspace */
+-	fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
+-			GFP_KERNEL);
+-	if (fences == NULL)
+-		return -ENOMEM;
+-
+-	fences_user = u64_to_user_ptr(wait->in.fences);
+-	if (copy_from_user(fences, fences_user,
+-		sizeof(struct drm_amdgpu_fence) * fence_count)) {
+-		r = -EFAULT;
+-		goto err_free_fences;
+-	}
++	fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
++				   wait->in.fence_count,
++				   sizeof(struct drm_amdgpu_fence));
++	if (IS_ERR(fences))
++		return PTR_ERR(fences);
+ 
+ 	if (wait->in.wait_all)
+ 		r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
+ 	else
+ 		r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
+ 
+-err_free_fences:
+ 	kfree(fences);
+ 
+ 	return r;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch b/queue-6.12/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
new file mode 100644
index 0000000000..3502fbff9a
--- /dev/null
+++ b/queue-6.12/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
@@ -0,0 +1,43 @@
+From f1c284a973381fb7db00928ebcb62679e65d0672 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 14:22:53 -0400
+Subject: drm/amdkfd: fix vram allocation failure for a special case
+
+From: Eric Huang <jinhuieric.huang@amd.com>
+
+[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
+
+When it only allocates vram without va, which is 0, and a
+SVM range allocated stays in this range, the vram allocation
+returns failure. It should be skipped for this case from
+SVM usage check.
+
+Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index fc473e3ba2d00..7fbbc67adfd9e 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1069,7 +1069,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
+ 	svm_range_list_lock_and_flush_work(&p->svms, current->mm);
+ 	mutex_lock(&p->svms.lock);
+ 	mmap_write_unlock(current->mm);
+-	if (interval_tree_iter_first(&p->svms.objects,
++
++	/* Skip a special case that allocates VRAM without VA,
++	 * VA will be invalid of 0.
++	 */
++	if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
++	    interval_tree_iter_first(&p->svms.objects,
+ 				     args->va_addr >> PAGE_SHIFT,
+ 				     (args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
+ 		pr_err("Address: 0x%llx already allocated by SVM\n",
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch b/queue-6.12/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
new file mode 100644
index 0000000000..7ba2ef080a
--- /dev/null
+++ b/queue-6.12/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
@@ -0,0 +1,67 @@
+From 1878a6bb91cf949740accd36f7eb7d4a0edfa99e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 14:06:36 -0400
+Subject: drm/amdkfd: Handle lack of READ permissions in SVM mapping
+
+From: Kent Russell <kent.russell@amd.com>
+
+[ Upstream commit 0ed704d058cec7643a716a21888d58c7d03f2c3e ]
+
+HMM assumes that pages have READ permissions by default. Inside
+svm_range_validate_and_map, we add READ permissions then add WRITE
+permissions if the VMA isn't read-only. This will conflict with regions
+that only have PROT_WRITE or have PROT_NONE. When that happens,
+svm_range_restore_work will continue to retry, silently, giving the
+impression of a hang if pr_debug isn't enabled to show the retries..
+
+If pages don't have READ permissions, simply unmap them and continue. If
+they weren't mapped in the first place, this would be a no-op. Since x86
+doesn't support write-only, and PROT_NONE doesn't allow reads or writes
+anyways, this will allow the svm range validation to continue without
+getting stuck in a loop forever on mappings we can't use with HMM.
+
+Signed-off-by: Kent Russell <kent.russell@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index a8d4b3a3e77af..155948dc3d07a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -1704,6 +1704,29 @@ static int svm_range_validate_and_map(struct mm_struct *mm,
+ 
+ 			next = min(vma->vm_end, end);
+ 			npages = (next - addr) >> PAGE_SHIFT;
++			/* HMM requires at least READ permissions. If provided with PROT_NONE,
++			 * unmap the memory. If it's not already mapped, this is a no-op
++			 * If PROT_WRITE is provided without READ, warn first then unmap
++			 */
++			if (!(vma->vm_flags & VM_READ)) {
++				unsigned long e, s;
++
++				svm_range_lock(prange);
++				if (vma->vm_flags & VM_WRITE)
++					pr_debug("VM_WRITE without VM_READ is not supported");
++				s = max(start, prange->start);
++				e = min(end, prange->last);
++				if (e >= s)
++					r = svm_range_unmap_from_gpus(prange, s, e,
++						       KFD_SVM_UNMAP_TRIGGER_UNMAP_FROM_CPU);
++				svm_range_unlock(prange);
++				/* If unmap returns non-zero, we'll bail on the next for loop
++				 * iteration, so just leave r and continue
++				 */
++				addr = next;
++				continue;
++			}
++
+ 			WRITE_ONCE(p->svms.faulting_task, current);
+ 			r = amdgpu_hmm_range_get_pages(&prange->notifier, addr, npages,
+ 						       readonly, owner, NULL,
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-6.12/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..c82c023fe5
--- /dev/null
+++ b/queue-6.12/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 7c82bed6914ebed16788563bcaa672c6041a2f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 67b5f3d7ff8e9..fc473e3ba2d00 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -3253,8 +3253,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	int retcode = -EINVAL;
+ 	bool ptrace_attached = false;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -3267,8 +3269,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-6.12/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..2b6b45447a
--- /dev/null
+++ b/queue-6.12/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 0d5b3a3999ce3902b4ab26d9895ce73708f49980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 75523f30cd38b..5041860e2737c 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -111,7 +111,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ #define KFD_MAX_SDMA_QUEUES	128
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch b/queue-6.12/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
new file mode 100644
index 0000000000..161aa4b0b1
--- /dev/null
+++ b/queue-6.12/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
@@ -0,0 +1,44 @@
+From eca4d9bd2ec8748acec859b9cd6f82a952269367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:21 +0300
+Subject: drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 7070f55f294745c5a3c033623b76309f3512be67 ]
+
+While the cdns-dsi does not support DSI burst mode, the burst mode is
+essentially DSI event mode with more versatile clocking and timings.
+Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests
+MIPI_DSI_MODE_VIDEO_BURST.
+
+In my particular use case, this allows the use of ti-sn65dsi83 driver.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index faa0bdfd19370..ddfbb2009c8d3 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -959,10 +959,6 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host,
+ 	if (output->dev)
+ 		return -EBUSY;
+ 
+-	/* We do not support burst mode yet. */
+-	if (dev->mode_flags & MIPI_DSI_MODE_VIDEO_BURST)
+-		return -ENOTSUPP;
+-
+ 	/*
+ 	 * The host <-> device link might be described using an OF-graph
+ 	 * representation, in this case we extract the device of_node from
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch b/queue-6.12/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
new file mode 100644
index 0000000000..eb1229d2d2
--- /dev/null
+++ b/queue-6.12/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
@@ -0,0 +1,58 @@
+From 67cfd5c54736b21f3cca6c672665f6d858d352c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:17 +0300
+Subject: drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit eea4f89b6461294ed6bea1d3285bb3f79c09a041 ]
+
+The driver tries to calculate the value for REG_WAKEUP_TIME. However,
+the calculation itself is not correct, and to add on it, the resulting
+value is almost always larger than the field's size, so the actual
+result is more or less random.
+
+According to the docs, figuring out the value for REG_WAKEUP_TIME
+requires HW characterization and there's no way to have a generic
+algorithm to come up with the value. That doesn't help at all...
+
+However, we know that the value must be smaller than the line time, and,
+at least in my understanding, the proper value for it is quite small.
+Testing shows that setting it to 1/10 of the line time seems to work
+well. All video modes from my HDMI monitor work with this algorithm.
+
+Hopefully we'll get more information on how to calculate the value, and
+we can then update this.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-11-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index 89eed0668bfb2..faa0bdfd19370 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -833,7 +833,13 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge)
+ 
+ 	tx_byte_period = DIV_ROUND_DOWN_ULL((u64)NSEC_PER_SEC * 8,
+ 					    phy_cfg->hs_clk_rate);
+-	reg_wakeup = (phy_cfg->hs_prepare + phy_cfg->hs_zero) / tx_byte_period;
++
++	/*
++	 * Estimated time [in clock cycles] to perform LP->HS on D-PHY.
++	 * It is not clear how to calculate this, so for now,
++	 * set it to 1/10 of the total number of clocks in a line.
++	 */
++	reg_wakeup = dsi_cfg.htotal / nlanes / 10;
+ 	writel(REG_WAKEUP_TIME(reg_wakeup) | REG_LINE_DURATION(tmp),
+ 	       dsi->regs + VID_DPHY_TIME);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-6.12/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..43caa562e6
--- /dev/null
+++ b/queue-6.12/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From d3accb17721633aaf05e9f0cf7f8f19d1920e025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index ab8e00baf3f16..e5817f5439144 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -363,7 +363,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch b/queue-6.12/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
new file mode 100644
index 0000000000..6951dcbb4f
--- /dev/null
+++ b/queue-6.12/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
@@ -0,0 +1,44 @@
+From 614cbbeba08bde094259fb78ca48fb8b71587676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:44 +0200
+Subject: drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
+
+According to Hardware Programming Guide for DSI PHY, the retime buffer
+resync should be done after PLL clock users (byte_clk and intf_byte_clk)
+are enabled.  Downstream also does it as part of configuring the PLL.
+
+Driver was only turning off the resync FIFO buffer, but never bringing it
+on again.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657823/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index a2c87c84aa05b..ec5aa8cb37d9a 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -465,6 +465,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+ 	if (pll_7nm->slave)
+ 		dsi_pll_enable_global_clk(pll_7nm->slave);
+ 
++	writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++	if (pll_7nm->slave)
++		writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++
+ error:
+ 	return rc;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch b/queue-6.12/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
new file mode 100644
index 0000000000..97b7eab936
--- /dev/null
+++ b/queue-6.12/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
@@ -0,0 +1,54 @@
+From bd7b600441689bf1a330ab4a12d8804b87adbb93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:47 +0200
+Subject: drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
+
+Driver unconditionally saves current state on first init in
+dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
+divider registers.  The state is then restored during probe/enable via
+msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
+dsi_7nm_pll_restore_state().
+
+Restoring calls dsi_pll_7nm_vco_set_rate() with
+pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
+VCO and messes with clock hierarchy, by setting frequency to 0 to clock
+tree.  This makes anyway little sense - VCO rate was not saved, so
+should not be restored.
+
+If PLL was not configured configure it to minimum rate to avoid glitches
+and configuring entire in clock hierarchy to 0 Hz.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657827/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index ec5aa8cb37d9a..0f8440fa73b4a 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -814,6 +814,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+ 
+ 	/* TODO: Remove this when we have proper display handover support */
+ 	msm_dsi_phy_pll_save_state(phy);
++	/*
++	 * Store also proper vco_current_rate, because its value will be used in
++	 * dsi_7nm_pll_restore_state().
++	 */
++	if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
++		pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch b/queue-6.12/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
new file mode 100644
index 0000000000..9d50c9c8e6
--- /dev/null
+++ b/queue-6.12/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
@@ -0,0 +1,43 @@
+From bb9d272e3c01eee734d9a37a5d364ff9fba9eed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:06:34 +0200
+Subject: drm/msm: make sure to not queue up recovery more than once
+
+From: Antonino Maniscalco <antomani103@gmail.com>
+
+[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
+
+If two fault IRQs arrive in short succession recovery work will be
+queued up twice.
+
+When recovery runs a second time it may end up killing an unrelated
+context.
+
+Prevent this by masking off interrupts when triggering recovery.
+
+Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670023/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 80c78aff96433..29d39b2bd86e0 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1522,6 +1522,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+ 	/* Turn off the hangcheck timer to keep it from bothering us */
+ 	del_timer(&gpu->hangcheck_timer);
+ 
++	/* Turn off interrupts to avoid triggering recovery again */
++	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
++
+ 	kthread_queue_work(gpu->worker, &gpu->recover_work);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch b/queue-6.12/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
new file mode 100644
index 0000000000..65b6856497
--- /dev/null
+++ b/queue-6.12/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
@@ -0,0 +1,61 @@
+From 6eb3c25e722eb7e88b2e9596d653c7b7b52b2622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 12:30:07 -0700
+Subject: drm/msm/registers: Generate _HI/LO builders for reg64
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 60e9f776b7932d67c88e8475df7830cb9cdf3154 ]
+
+The upstream mesa copy of the GPU regs has shifted more things to reg64
+instead of seperate 32b HI/LO reg32's.  This works better with the "new-
+style" c++ builders that mesa has been migrating to for a6xx+ (to better
+handle register shuffling between gens), but it leaves the C builders
+with missing _HI/LO builders.
+
+So handle the special case of reg64, automatically generating the
+missing _HI/LO builders.
+
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/673559/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/registers/gen_header.py | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/registers/gen_header.py b/drivers/gpu/drm/msm/registers/gen_header.py
+index 3926485bb197b..812eb89a224a6 100644
+--- a/drivers/gpu/drm/msm/registers/gen_header.py
++++ b/drivers/gpu/drm/msm/registers/gen_header.py
+@@ -149,6 +149,7 @@ class Bitset(object):
+ 	def __init__(self, name, template):
+ 		self.name = name
+ 		self.inline = False
++		self.reg = None
+ 		if template:
+ 			self.fields = template.fields[:]
+ 		else:
+@@ -255,6 +256,11 @@ class Bitset(object):
+ 	def dump(self, prefix=None):
+ 		if prefix == None:
+ 			prefix = self.name
++		if self.reg and self.reg.bit_size == 64:
++			print("static inline uint32_t %s_LO(uint32_t val)\n{" % prefix)
++			print("\treturn val;\n}")
++			print("static inline uint32_t %s_HI(uint32_t val)\n{" % prefix)
++			print("\treturn val;\n}")
+ 		for f in self.fields:
+ 			if f.name:
+ 				name = prefix + "_" + f.name
+@@ -619,6 +625,7 @@ class Parser(object):
+ 
+ 		self.current_reg = Reg(attrs, self.prefix(variant), self.current_array, bit_size)
+ 		self.current_reg.bitset = self.current_bitset
++		self.current_bitset.reg = self.current_reg
+ 
+ 		if len(self.stack) == 1:
+ 			self.file.append(self.current_reg)
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-6.12/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..4b80ef1edd
--- /dev/null
+++ b/queue-6.12/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From 9a1c81c88aaa58ab1a51ca491a98e2212b573c90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-panel-backlight-quirks-make-edid-match-optional.patch b/queue-6.12/drm-panel-backlight-quirks-make-edid-match-optional.patch
new file mode 100644
index 0000000000..08926a5c3c
--- /dev/null
+++ b/queue-6.12/drm-panel-backlight-quirks-make-edid-match-optional.patch
@@ -0,0 +1,44 @@
+From 5e4e32a9936a1d438237fcf745fbb8867631f071 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:55:36 +0200
+Subject: drm: panel-backlight-quirks: Make EDID match optional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit 9931e4be11f2129a20ffd908bc364598a63016f8 ]
+
+Currently, having a valid panel_id match is required to use the quirk
+system. For certain devices, we know that all SKUs need a certain quirk.
+Therefore, allow not specifying ident by only checking for a match
+if panel_id is non-zero.
+
+Tested-by: Philip Müller <philm@manjaro.org>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250829145541.512671-2-lkml@antheas.dev
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_backlight_quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c
+index c477d98ade2b4..99d8b6b2d6bd2 100644
+--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c
++++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c
+@@ -49,7 +49,7 @@ static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_bac
+ 	if (!dmi_match(quirk->dmi_match.field, quirk->dmi_match.value))
+ 		return false;
+ 
+-	if (!drm_edid_match(edid, &quirk->ident))
++	if (quirk->ident.panel_id && !drm_edid_match(edid, &quirk->ident))
+ 		return false;
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch b/queue-6.12/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
new file mode 100644
index 0000000000..ce583a67da
--- /dev/null
+++ b/queue-6.12/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
@@ -0,0 +1,48 @@
+From 159771ac5718ffe3ce973ac625a4bbcec76dfe45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:01:16 -0700
+Subject: drm/panthor: check bo offset alignment in vm bind
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 5afa9d2a9bb1410f816e0123846047288b16e4b9 ]
+
+Fail early from panthor_vm_bind_prepare_op_ctx instead of late from
+ops->map_pages.
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20250828200116.3532255-1-olvaffe@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
+index 2214dbf472fa4..d548a6e0311dd 100644
+--- a/drivers/gpu/drm/panthor/panthor_mmu.c
++++ b/drivers/gpu/drm/panthor/panthor_mmu.c
+@@ -1219,7 +1219,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
+ 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
+ 		return -EINVAL;
+ 
+-	/* Make sure the VA and size are aligned and in-bounds. */
++	/* Make sure the VA and size are in-bounds. */
+ 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
+ 		return -EINVAL;
+ 
+@@ -2389,7 +2389,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
+ 	int ret;
+ 
+ 	/* Aligned on page size. */
+-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
++	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
+ 		return -EINVAL;
+ 
+ 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-panthor-serialize-gpu-cache-flush-operations.patch b/queue-6.12/drm-panthor-serialize-gpu-cache-flush-operations.patch
new file mode 100644
index 0000000000..aab67ea01a
--- /dev/null
+++ b/queue-6.12/drm-panthor-serialize-gpu-cache-flush-operations.patch
@@ -0,0 +1,61 @@
+From 66c24f3d9c40df540f0d5c29a2b55eeec2a28e6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 17:26:31 +0100
+Subject: drm/panthor: Serialize GPU cache flush operations
+
+From: Karunika Choo <karunika.choo@arm.com>
+
+[ Upstream commit e322a4844811b54477b7072eb40dc9e402a1725d ]
+
+In certain scenarios, it is possible for multiple cache flushes to be
+requested before the previous one completes. This patch introduces the
+cache_flush_lock mutex to serialize these operations and ensure that
+any requested cache flushes are completed instead of dropped.
+
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Co-developed-by: Dennis Tsiang <dennis.tsiang@arm.com>
+Signed-off-by: Dennis Tsiang <dennis.tsiang@arm.com>
+Signed-off-by: Karunika Choo <karunika.choo@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20250807162633.3666310-6-karunika.choo@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_gpu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_gpu.c b/drivers/gpu/drm/panthor/panthor_gpu.c
+index 5251d8764e7d7..1ca2924e6d552 100644
+--- a/drivers/gpu/drm/panthor/panthor_gpu.c
++++ b/drivers/gpu/drm/panthor/panthor_gpu.c
+@@ -35,6 +35,9 @@ struct panthor_gpu {
+ 
+ 	/** @reqs_acked: GPU request wait queue. */
+ 	wait_queue_head_t reqs_acked;
++
++	/** @cache_flush_lock: Lock to serialize cache flushes */
++	struct mutex cache_flush_lock;
+ };
+ 
+ /**
+@@ -201,6 +204,7 @@ int panthor_gpu_init(struct panthor_device *ptdev)
+ 
+ 	spin_lock_init(&gpu->reqs_lock);
+ 	init_waitqueue_head(&gpu->reqs_acked);
++	mutex_init(&gpu->cache_flush_lock);
+ 	ptdev->gpu = gpu;
+ 	panthor_gpu_init_info(ptdev);
+ 
+@@ -383,6 +387,9 @@ int panthor_gpu_flush_caches(struct panthor_device *ptdev,
+ 	bool timedout = false;
+ 	unsigned long flags;
+ 
++	/* Serialize cache flush operations. */
++	guard(mutex)(&ptdev->gpu->cache_flush_lock);
++
+ 	spin_lock_irqsave(&ptdev->gpu->reqs_lock, flags);
+ 	if (!drm_WARN_ON(&ptdev->base,
+ 			 ptdev->gpu->pending_reqs & GPU_IRQ_CLEAN_CACHES_COMPLETED)) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch b/queue-6.12/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
new file mode 100644
index 0000000000..ecb1328fbf
--- /dev/null
+++ b/queue-6.12/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
@@ -0,0 +1,48 @@
+From 6247e53be104f807c081f29f3576798c74f2192c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:34:02 +0530
+Subject: drm/tidss: Set crtc modesetting parameters with adjusted mode
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
+
+TIDSS uses crtc_* fields to propagate its registers and set the
+clock rates. So set the CRTC modesetting timing parameters with
+the adjusted mode when needed, to set correct values.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 1604eca265ef6..36c22d8608527 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -91,7 +91,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 	struct dispc_device *dispc = tidss->dispc;
+ 	struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
+ 	u32 hw_videoport = tcrtc->hw_videoport;
+-	const struct drm_display_mode *mode;
++	struct drm_display_mode *mode;
+ 	enum drm_mode_status ok;
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+@@ -108,6 +108,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 		return -EINVAL;
+ 	}
+ 
++	if (drm_atomic_crtc_needs_modeset(crtc_state))
++		drm_mode_set_crtcinfo(mode, 0);
++
+ 	return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-6.12/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..34b7925c8d
--- /dev/null
+++ b/queue-6.12/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From bf694ec32d93bcb32ee99efca2c89dc095afd3ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 94f8e3178df58..1604eca265ef6 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -225,7 +225,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 45f22ead3e61d..8ee6a6dc8dbd2 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -1086,13 +1086,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1134,8 +1134,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch b/queue-6.12/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
new file mode 100644
index 0000000000..a40b4b9a3f
--- /dev/null
+++ b/queue-6.12/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
@@ -0,0 +1,77 @@
+From 8b7f8196ce5015bd0b3793628b7fc2b673fd836c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 17:20:58 +0200
+Subject: drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
+
+From: Maarten Lankhorst <dev@lankhorst.se>
+
+[ Upstream commit 1cda3c755bb7770be07d75949bb0f45fb88651f6 ]
+
+I saw an oops in xe_gem_fault when running the xe-fast-feedback
+testlist against the realtime kernel without debug options enabled.
+
+The panic happens after core_hotunplug unbind-rebind finishes.
+Presumably what happens is that a process mmaps, unlocks because
+of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,
+causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since
+there was nothing left to populate, and then oopses in
+"mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource
+is NULL.
+
+It's convoluted, but fits the data and explains the oops after
+the test exits.
+
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://lore.kernel.org/r/20250715152057.23254-2-dev@lankhorst.se
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index b5058a35c4513..b71156e9976aa 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -1218,22 +1218,26 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
+ 		ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
+ 					       TTM_BO_VM_NUM_PREFAULT);
+ 		drm_dev_exit(idx);
++
++		if (ret == VM_FAULT_RETRY &&
++		    !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
++			goto out;
++
++		/*
++		 * ttm_bo_vm_reserve() already has dma_resv_lock.
++		 */
++		if (ret == VM_FAULT_NOPAGE &&
++		    mem_type_is_vram(tbo->resource->mem_type)) {
++			mutex_lock(&xe->mem_access.vram_userfault.lock);
++			if (list_empty(&bo->vram_userfault_link))
++				list_add(&bo->vram_userfault_link,
++					 &xe->mem_access.vram_userfault.list);
++			mutex_unlock(&xe->mem_access.vram_userfault.lock);
++		}
+ 	} else {
+ 		ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot);
+ 	}
+ 
+-	if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
+-		goto out;
+-	/*
+-	 * ttm_bo_vm_reserve() already has dma_resv_lock.
+-	 */
+-	if (ret == VM_FAULT_NOPAGE && mem_type_is_vram(tbo->resource->mem_type)) {
+-		mutex_lock(&xe->mem_access.vram_userfault.lock);
+-		if (list_empty(&bo->vram_userfault_link))
+-			list_add(&bo->vram_userfault_link, &xe->mem_access.vram_userfault.list);
+-		mutex_unlock(&xe->mem_access.vram_userfault.lock);
+-	}
+-
+ 	dma_resv_unlock(tbo->base.resv);
+ out:
+ 	if (needs_rpm)
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-xe-guc-add-more-guc-load-error-status-codes.patch b/queue-6.12/drm-xe-guc-add-more-guc-load-error-status-codes.patch
new file mode 100644
index 0000000000..ff91814723
--- /dev/null
+++ b/queue-6.12/drm-xe-guc-add-more-guc-load-error-status-codes.patch
@@ -0,0 +1,103 @@
+From 8e3d560180105c64a12aa2294d45fe8ff9efbe51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 19:43:37 -0700
+Subject: drm/xe/guc: Add more GuC load error status codes
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 45fbb51050e72723c2bdcedc1ce32305256c70ed ]
+
+The GuC load process will abort if certain status codes (which are
+indicative of a fatal error) are reported. Otherwise, it keeps waiting
+until the 'success' code is returned. New error codes have been added
+in recent GuC releases, so add support for aborting on those as well.
+
+v2: Shuffle HWCONFIG_START to the front of the switch to keep the
+ordering as per the enum define for clarity (review feedback by
+Jonathan). Also add a description for the basic 'invalid init data'
+code which was missing.
+
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250726024337.4056272-1-John.C.Harrison@Intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/abi/guc_errors_abi.h |  3 +++
+ drivers/gpu/drm/xe/xe_guc.c             | 19 +++++++++++++++++--
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/abi/guc_errors_abi.h b/drivers/gpu/drm/xe/abi/guc_errors_abi.h
+index 2c627a21648f7..9260f4a1997d9 100644
+--- a/drivers/gpu/drm/xe/abi/guc_errors_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_errors_abi.h
+@@ -55,6 +55,7 @@ enum xe_guc_load_status {
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_START                   = 0x05,
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_DONE                    = 0x06,
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_ERROR                   = 0x07,
++	XE_GUC_LOAD_STATUS_BOOTROM_VERSION_MISMATCH         = 0x08,
+ 	XE_GUC_LOAD_STATUS_GDT_DONE                         = 0x10,
+ 	XE_GUC_LOAD_STATUS_IDT_DONE                         = 0x20,
+ 	XE_GUC_LOAD_STATUS_LAPIC_DONE                       = 0x30,
+@@ -67,6 +68,8 @@ enum xe_guc_load_status {
+ 	XE_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_START,
+ 	XE_GUC_LOAD_STATUS_MPU_DATA_INVALID                 = 0x73,
+ 	XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID   = 0x74,
++	XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR        = 0x75,
++	XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG                 = 0x76,
+ 	XE_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_END,
+ 
+ 	XE_GUC_LOAD_STATUS_READY                            = 0xF0,
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 96373cdb366be..907a458c9eff5 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -527,11 +527,14 @@ static int guc_load_done(u32 status)
+ 	case XE_GUC_LOAD_STATUS_GUC_PREPROD_BUILD_MISMATCH:
+ 	case XE_GUC_LOAD_STATUS_ERROR_DEVID_INVALID_GUCTYPE:
+ 	case XE_GUC_LOAD_STATUS_HWCONFIG_ERROR:
++	case XE_GUC_LOAD_STATUS_BOOTROM_VERSION_MISMATCH:
+ 	case XE_GUC_LOAD_STATUS_DPC_ERROR:
+ 	case XE_GUC_LOAD_STATUS_EXCEPTION:
+ 	case XE_GUC_LOAD_STATUS_INIT_DATA_INVALID:
+ 	case XE_GUC_LOAD_STATUS_MPU_DATA_INVALID:
+ 	case XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID:
++	case XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
++	case XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG:
+ 		return -1;
+ 	}
+ 
+@@ -670,17 +673,29 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 		}
+ 
+ 		switch (ukernel) {
++		case XE_GUC_LOAD_STATUS_HWCONFIG_START:
++			xe_gt_err(gt, "still extracting hwconfig table.\n");
++			break;
++
+ 		case XE_GUC_LOAD_STATUS_EXCEPTION:
+ 			xe_gt_err(gt, "firmware exception. EIP: %#x\n",
+ 				  xe_mmio_read32(gt, SOFT_SCRATCH(13)));
+ 			break;
+ 
++		case XE_GUC_LOAD_STATUS_INIT_DATA_INVALID:
++			xe_gt_err(gt, "illegal init/ADS data\n");
++			break;
++
+ 		case XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID:
+ 			xe_gt_err(gt, "illegal register in save/restore workaround list\n");
+ 			break;
+ 
+-		case XE_GUC_LOAD_STATUS_HWCONFIG_START:
+-			xe_gt_err(gt, "still extracting hwconfig table.\n");
++		case XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
++			xe_gt_err(gt, "illegal workaround KLV data\n");
++			break;
++
++		case XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG:
++			xe_gt_err(gt, "illegal feature flag specified\n");
+ 			break;
+ 		}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch b/queue-6.12/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
new file mode 100644
index 0000000000..73812d201f
--- /dev/null
+++ b/queue-6.12/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
@@ -0,0 +1,37 @@
+From 1090b19ea83454976d8dd3d3fc75e02e4c1877c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 12:04:27 -0400
+Subject: drm/xe/guc: Increase GuC crash dump buffer size
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit ad83b1da5b786ee2d245e41ce55cb1c71fed7c22 ]
+
+There are platforms already have a maximum dump size of 12KB, to avoid
+data truncating, increase GuC crash dump buffer size to 16KB.
+
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://lore.kernel.org/r/20250829160427.1245732-1-zhanjun.dong@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_log.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_log.h b/drivers/gpu/drm/xe/xe_guc_log.h
+index 2d25ab28b4b3a..1c673c2fbd567 100644
+--- a/drivers/gpu/drm/xe/xe_guc_log.h
++++ b/drivers/gpu/drm/xe/xe_guc_log.h
+@@ -15,7 +15,7 @@ struct drm_printer;
+ #define DEBUG_BUFFER_SIZE       SZ_8M
+ #define CAPTURE_BUFFER_SIZE     SZ_2M
+ #else
+-#define CRASH_BUFFER_SIZE	SZ_8K
++#define CRASH_BUFFER_SIZE	SZ_16K
+ #define DEBUG_BUFFER_SIZE	SZ_64K
+ #define CAPTURE_BUFFER_SIZE	SZ_16K
+ #endif
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch b/queue-6.12/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
new file mode 100644
index 0000000000..192f049562
--- /dev/null
+++ b/queue-6.12/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
@@ -0,0 +1,94 @@
+From ee095e64ab0722c3e788cbb974c4ff235fa64679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:41:31 -0700
+Subject: drm/xe/guc: Return an error code if the GuC load fails
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 3b09b11805bfee32d5a0000f5ede42c07237a6c4 ]
+
+Due to multiple explosion issues in the early days of the Xe driver,
+the GuC load was hacked to never return a failure. That prevented
+kernel panics and such initially, but now all it achieves is creating
+more confusing errors when the driver tries to submit commands to a
+GuC it already knows is not there. So fix that up.
+
+As a stop-gap and to help with debug of load failures due to invalid
+GuC init params, a wedge call had been added to the inner GuC load
+function. The reason being that it leaves the GuC log accessible via
+debugfs. However, for an end user, simply aborting the module load is
+much cleaner than wedging and trying to continue. The wedge blocks
+user submissions but it seems that various bits of the driver itself
+still try to submit to a dead GuC and lots of subsequent errors occur.
+And with regards to developers debugging why their particular code
+change is being rejected by the GuC, it is trivial to either add the
+wedge back in and hack the return code to zero again or to just do a
+GuC log dump to dmesg.
+
+v2: Add support for error injection testing and drop the now redundant
+wedge call.
+
+CC: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Matt Atwood <matthew.s.atwood@intel.com>
+Link: https://lore.kernel.org/r/20250909224132.536320-1-John.C.Harrison@Intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 907a458c9eff5..bedd9894e182e 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -593,7 +593,7 @@ static s32 guc_pc_get_cur_freq(struct xe_guc_pc *guc_pc)
+ #endif
+ #define GUC_LOAD_TIME_WARN_MS      200
+ 
+-static void guc_wait_ucode(struct xe_guc *guc)
++static int guc_wait_ucode(struct xe_guc *guc)
+ {
+ 	struct xe_gt *gt = guc_to_gt(guc);
+ 	struct xe_guc_pc *guc_pc = &gt->uc.guc.pc;
+@@ -699,7 +699,7 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 			break;
+ 		}
+ 
+-		xe_device_declare_wedged(gt_to_xe(gt));
++		return -EPROTO;
+ 	} else if (delta_ms > GUC_LOAD_TIME_WARN_MS) {
+ 		xe_gt_warn(gt, "excessive init time: %lldms! [status = 0x%08X, timeouts = %d]\n",
+ 			   delta_ms, status, count);
+@@ -711,7 +711,10 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 			  delta_ms, xe_guc_pc_get_act_freq(guc_pc), guc_pc_get_cur_freq(guc_pc),
+ 			  before_freq, status, count);
+ 	}
++
++	return 0;
+ }
++ALLOW_ERROR_INJECTION(guc_wait_ucode, ERRNO);
+ 
+ static int __xe_guc_upload(struct xe_guc *guc)
+ {
+@@ -743,14 +746,16 @@ static int __xe_guc_upload(struct xe_guc *guc)
+ 		goto out;
+ 
+ 	/* Wait for authentication */
+-	guc_wait_ucode(guc);
++	ret = guc_wait_ucode(guc);
++	if (ret)
++		goto out;
+ 
+ 	xe_uc_fw_change_status(&guc->fw, XE_UC_FIRMWARE_RUNNING);
+ 	return 0;
+ 
+ out:
+ 	xe_uc_fw_change_status(&guc->fw, XE_UC_FIRMWARE_LOAD_FAIL);
+-	return 0	/* FIXME: ret, don't want to stop load currently */;
++	return ret;
+ }
+ 
+ static int vf_guc_min_load_for_hwconfig(struct xe_guc *guc)
+-- 
+2.51.0
+
diff --git a/queue-6.12/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch b/queue-6.12/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
new file mode 100644
index 0000000000..09e4295be2
--- /dev/null
+++ b/queue-6.12/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
@@ -0,0 +1,76 @@
+From c85e8f1195384c791ef42162e9618d852dd4cee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 00:33:30 +0200
+Subject: drm/xe/guc: Set upper limit of H2G retries over CTB
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 2506af5f8109a387a5e8e9e3d7c498480b8033db ]
+
+The GuC communication protocol allows GuC to send NO_RESPONSE_RETRY
+reply message to indicate that due to some interim condition it can
+not handle incoming H2G request and the host shall resend it.
+
+But in some cases, due to errors, this unsatisfied condition might
+be final and this could lead to endless retries as it was recently
+seen on the CI:
+
+ [drm] GT0: PF: VF1 FLR didn't finish in 5000 ms (-ETIMEDOUT)
+ [drm] GT0: PF: VF1 resource sanitizing failed (-ETIMEDOUT)
+ [drm] GT0: PF: VF1 FLR failed!
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+
+To avoid such dangerous loops allow only limited number of retries
+(for now 50) and add some delays (n * 5ms) to slow down the rate of
+resending this repeated request.
+
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://lore.kernel.org/r/20250903223330.6408-1-michal.wajdeczko@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index f1ce4e14dcb5f..d692e279d9fbf 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -977,11 +977,15 @@ static bool retry_failure(struct xe_guc_ct *ct, int ret)
+ 	return true;
+ }
+ 
++#define GUC_SEND_RETRY_LIMIT	50
++#define GUC_SEND_RETRY_MSLEEP	5
++
+ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+ 			    u32 *response_buffer, bool no_fail)
+ {
+ 	struct xe_gt *gt = ct_to_gt(ct);
+ 	struct g2h_fence g2h_fence;
++	unsigned int retries = 0;
+ 	int ret = 0;
+ 
+ 	/*
+@@ -1065,6 +1069,12 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+ 		xe_gt_dbg(gt, "H2G action %#x retrying: reason %#x\n",
+ 			  action[0], g2h_fence.reason);
+ 		mutex_unlock(&ct->lock);
++		if (++retries > GUC_SEND_RETRY_LIMIT) {
++			xe_gt_err(gt, "H2G action %#x reached retry limit=%u, aborting\n",
++				  action[0], GUC_SEND_RETRY_LIMIT);
++			return -ELOOP;
++		}
++		msleep(GUC_SEND_RETRY_MSLEEP * retries);
+ 		goto retry;
+ 	}
+ 	if (g2h_fence.fail) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-6.12/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..ad96f15375
--- /dev/null
+++ b/queue-6.12/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From e17cdb8b6632261b53f90a9ae07a04f786ff08f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index 8a8ea51c639e9..9c1247ddc238f 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-6.12/ethernet-extend-device_get_mac_address-to-use-nvmem.patch b/queue-6.12/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
new file mode 100644
index 0000000000..a930217769
--- /dev/null
+++ b/queue-6.12/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
@@ -0,0 +1,42 @@
+From e0e8286ed0092449f48b00465a1bba2d1cd9464e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:03:32 +0200
+Subject: ethernet: Extend device_get_mac_address() to use NVMEM
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
+
+A lot of modern SoC have the ability to store MAC addresses in their
+NVMEM. So extend the generic function device_get_mac_address() to
+obtain the MAC address from an nvmem cell named 'mac-address' in
+case there is no firmware node which contains the MAC address directly.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethernet/eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 4e3651101b866..43e211e611b16 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -613,7 +613,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);
+  */
+ int device_get_mac_address(struct device *dev, char *addr)
+ {
+-	return fwnode_get_mac_address(dev_fwnode(dev), addr);
++	if (!fwnode_get_mac_address(dev_fwnode(dev), addr))
++		return 0;
++
++	return nvmem_get_mac_address(dev, addr);
+ }
+ EXPORT_SYMBOL(device_get_mac_address);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/exfat-limit-log-print-for-io-error.patch b/queue-6.12/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..9fde9e3cef
--- /dev/null
+++ b/queue-6.12/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From d3ad5f559f8dc7b0bf86482abf1dba4063b1e167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 0c60ddc24c54a..2c3ab6313cc98 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-6.12/exfat-validate-cluster-allocation-bits-of-the-alloca.patch b/queue-6.12/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
new file mode 100644
index 0000000000..2d6119c87f
--- /dev/null
+++ b/queue-6.12/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
@@ -0,0 +1,130 @@
+From 1ea212128ad579ad6be3633db30303f68dbda108 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 14:44:35 +0900
+Subject: exfat: validate cluster allocation bits of the allocation bitmap
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 79c1587b6cda74deb0c86fc7ba194b92958c793c ]
+
+syzbot created an exfat image with cluster bits not set for the allocation
+bitmap. exfat-fs reads and uses the allocation bitmap without checking
+this. The problem is that if the start cluster of the allocation bitmap
+is 6, cluster 6 can be allocated when creating a directory with mkdir.
+exfat zeros out this cluster in exfat_mkdir, which can delete existing
+entries. This can reallocate the allocated entries. In addition,
+the allocation bitmap is also zeroed out, so cluster 6 can be reallocated.
+This patch adds exfat_test_bitmap_range to validate that clusters used for
+the allocation bitmap are correctly marked as in-use.
+
+Reported-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com
+Tested-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com
+Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/balloc.c | 72 +++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 60 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c
+index 9ff825f1502d5..b2b55ad76b7fd 100644
+--- a/fs/exfat/balloc.c
++++ b/fs/exfat/balloc.c
+@@ -26,12 +26,55 @@
+ /*
+  *  Allocation Bitmap Management Functions
+  */
++static bool exfat_test_bitmap_range(struct super_block *sb, unsigned int clu,
++		unsigned int count)
++{
++	struct exfat_sb_info *sbi = EXFAT_SB(sb);
++	unsigned int start = clu;
++	unsigned int end = clu + count;
++	unsigned int ent_idx, i, b;
++	unsigned int bit_offset, bits_to_check;
++	__le_long *bitmap_le;
++	unsigned long mask, word;
++
++	if (!is_valid_cluster(sbi, start) || !is_valid_cluster(sbi, end - 1))
++		return false;
++
++	while (start < end) {
++		ent_idx = CLUSTER_TO_BITMAP_ENT(start);
++		i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx);
++		b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx);
++
++		bitmap_le = (__le_long *)sbi->vol_amap[i]->b_data;
++
++		/* Calculate how many bits we can check in the current word */
++		bit_offset = b % BITS_PER_LONG;
++		bits_to_check = min(end - start,
++				    (unsigned int)(BITS_PER_LONG - bit_offset));
++
++		/* Create a bitmask for the range of bits to check */
++		if (bits_to_check >= BITS_PER_LONG)
++			mask = ~0UL;
++		else
++			mask = ((1UL << bits_to_check) - 1) << bit_offset;
++		word = lel_to_cpu(bitmap_le[b / BITS_PER_LONG]);
++
++		/* Check if all bits in the mask are set */
++		if ((word & mask) != mask)
++			return false;
++
++		start += bits_to_check;
++	}
++
++	return true;
++}
++
+ static int exfat_allocate_bitmap(struct super_block *sb,
+ 		struct exfat_dentry *ep)
+ {
+ 	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ 	long long map_size;
+-	unsigned int i, need_map_size;
++	unsigned int i, j, need_map_size;
+ 	sector_t sector;
+ 
+ 	sbi->map_clu = le32_to_cpu(ep->dentry.bitmap.start_clu);
+@@ -58,20 +101,25 @@ static int exfat_allocate_bitmap(struct super_block *sb,
+ 	sector = exfat_cluster_to_sector(sbi, sbi->map_clu);
+ 	for (i = 0; i < sbi->map_sectors; i++) {
+ 		sbi->vol_amap[i] = sb_bread(sb, sector + i);
+-		if (!sbi->vol_amap[i]) {
+-			/* release all buffers and free vol_amap */
+-			int j = 0;
+-
+-			while (j < i)
+-				brelse(sbi->vol_amap[j++]);
+-
+-			kvfree(sbi->vol_amap);
+-			sbi->vol_amap = NULL;
+-			return -EIO;
+-		}
++		if (!sbi->vol_amap[i])
++			goto err_out;
+ 	}
+ 
++	if (exfat_test_bitmap_range(sb, sbi->map_clu,
++		EXFAT_B_TO_CLU_ROUND_UP(map_size, sbi)) == false)
++		goto err_out;
++
+ 	return 0;
++
++err_out:
++	j = 0;
++	/* release all buffers and free vol_amap */
++	while (j < i)
++		brelse(sbi->vol_amap[j++]);
++
++	kvfree(sbi->vol_amap);
++	sbi->vol_amap = NULL;
++	return -EIO;
+ }
+ 
+ int exfat_load_bitmap(struct super_block *sb)
+-- 
+2.51.0
+
diff --git a/queue-6.12/ext4-increase-io-priority-of-fastcommit.patch b/queue-6.12/ext4-increase-io-priority-of-fastcommit.patch
new file mode 100644
index 0000000000..ca6b34284c
--- /dev/null
+++ b/queue-6.12/ext4-increase-io-priority-of-fastcommit.patch
@@ -0,0 +1,50 @@
+From 1c67187935154f44bccd4f14b4c2700f54590e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:18:12 +0800
+Subject: ext4: increase IO priority of fastcommit
+
+From: Julian Sun <sunjunchao@bytedance.com>
+
+[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
+
+The following code paths may result in high latency or even task hangs:
+   1. fastcommit io is throttled by wbt.
+   2. jbd2_fc_wait_bufs() might wait for a long time while
+JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then
+jbd2_journal_commit_transaction() waits for the
+JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write
+lock of j_state_lock.
+   3. start_this_handle() waits for read lock of j_state_lock which
+results in high latency or task hang.
+
+Given the fact that ext4_fc_commit() already modifies the current
+process' IO priority to match that of the jbd2 thread, it should be
+reasonable to match jbd2's IO submission flags as well.
+
+Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/fast_commit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
+index b33664f6ce2ab..76a3c2e21b9db 100644
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star
+ 
+ static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail)
+ {
+-	blk_opf_t write_flags = REQ_SYNC;
++	blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS;
+ 	struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh;
+ 
+ 	/* Add REQ_FUA | REQ_PREFLUSH only its tail */
+-- 
+2.51.0
+
diff --git a/queue-6.12/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-6.12/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..5906f46451
--- /dev/null
+++ b/queue-6.12/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From 312b395eba215b093d137dab03a277831396f60a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 125016da7fde3..c7b5f3f0da2ef 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -164,6 +164,7 @@ static void adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch b/queue-6.12/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
new file mode 100644
index 0000000000..43cd7fabd9
--- /dev/null
+++ b/queue-6.12/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
@@ -0,0 +1,42 @@
+From 02935f076ed897782f5c4336c3870b0b9c25cd6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:22 +0800
+Subject: f2fs: fix infinite loop in __insert_extent_tree()
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 23361bd54966b437e1ed3eb1a704572f4b279e58 ]
+
+When we get wrong extent info data, and look up extent_node in rb tree,
+it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by
+return NULL and print some kernel messages in that case.
+
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/extent_cache.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 2ccc868750994..fe5e91c6e910d 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -561,7 +561,13 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ 			p = &(*p)->rb_right;
+ 			leftmost = false;
+ 		} else {
++			f2fs_err_ratelimited(sbi, "%s: corrupted extent, type: %d, "
++				"extent node in rb tree [%u, %u, %u], age [%llu, %llu], "
++				"extent node to insert [%u, %u, %u], age [%llu, %llu]",
++				__func__, et->type, en->ei.fofs, en->ei.blk, en->ei.len, en->ei.age,
++				en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks);
+ 			f2fs_bug_on(sbi, 1);
++			return NULL;
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch b/queue-6.12/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
new file mode 100644
index 0000000000..27b9531231
--- /dev/null
+++ b/queue-6.12/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
@@ -0,0 +1,76 @@
+From 94c282571fe5b904b5f8fd26251db36d12c53090 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:44:31 +0800
+Subject: f2fs: fix to detect potential corrupted nid in free_nid_list
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8fc6056dcf79937c46c97fa4996cda65956437a9 ]
+
+As reported, on-disk footer.ino and footer.nid is the same and
+out-of-range, let's add sanity check on f2fs_alloc_nid() to detect
+any potential corruption in free_nid_list.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c          | 17 ++++++++++++++++-
+ include/linux/f2fs_fs.h |  1 +
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 7c27878293697..720768d574ae6 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -27,12 +27,17 @@ static struct kmem_cache *free_nid_slab;
+ static struct kmem_cache *nat_entry_set_slab;
+ static struct kmem_cache *fsync_node_entry_slab;
+ 
++static inline bool is_invalid_nid(struct f2fs_sb_info *sbi, nid_t nid)
++{
++	return nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid;
++}
++
+ /*
+  * Check whether the given nid is within node id range.
+  */
+ int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
+ {
+-	if (unlikely(nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid)) {
++	if (unlikely(is_invalid_nid(sbi, nid))) {
+ 		set_sbi_flag(sbi, SBI_NEED_FSCK);
+ 		f2fs_warn(sbi, "%s: out-of-range nid=%x, run fsck to fix.",
+ 			  __func__, nid);
+@@ -2609,6 +2614,16 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid)
+ 		f2fs_bug_on(sbi, list_empty(&nm_i->free_nid_list));
+ 		i = list_first_entry(&nm_i->free_nid_list,
+ 					struct free_nid, list);
++
++		if (unlikely(is_invalid_nid(sbi, i->nid))) {
++			spin_unlock(&nm_i->nid_list_lock);
++			f2fs_err(sbi, "Corrupted nid %u in free_nid_list",
++								i->nid);
++			f2fs_stop_checkpoint(sbi, false,
++					STOP_CP_REASON_CORRUPTED_NID);
++			return false;
++		}
++
+ 		*nid = i->nid;
+ 
+ 		__move_free_nid(sbi, i, FREE_NID, PREALLOC_NID);
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index 5206d63b33860..cc13b4e0e9147 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -79,6 +79,7 @@ enum stop_cp_reason {
+ 	STOP_CP_REASON_FLUSH_FAIL,
+ 	STOP_CP_REASON_NO_SEGMENT,
+ 	STOP_CP_REASON_CORRUPTED_FREE_BITMAP,
++	STOP_CP_REASON_CORRUPTED_NID,
+ 	STOP_CP_REASON_MAX,
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/f2fs-fix-wrong-layout-information-on-16kb-page.patch b/queue-6.12/f2fs-fix-wrong-layout-information-on-16kb-page.patch
new file mode 100644
index 0000000000..f3e462ec92
--- /dev/null
+++ b/queue-6.12/f2fs-fix-wrong-layout-information-on-16kb-page.patch
@@ -0,0 +1,44 @@
+From 9cbbd8163b34c626e632df1f5daf2175d470fa54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 00:26:06 +0000
+Subject: f2fs: fix wrong layout information on 16KB page
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit a33be64b98d0723748d2fab0832b926613e1fce0 ]
+
+This patch fixes to support different block size.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index eb84b9418ac11..b3c04ecc3a271 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -1623,12 +1623,15 @@ static int __maybe_unused disk_map_seq_show(struct seq_file *seq,
+ 	seq_printf(seq, " Main          : 0x%010x (%10d)\n",
+ 			SM_I(sbi)->main_blkaddr,
+ 			le32_to_cpu(F2FS_RAW_SUPER(sbi)->segment_count_main));
+-	seq_printf(seq, " # of Sections : %12d\n",
+-			le32_to_cpu(F2FS_RAW_SUPER(sbi)->section_count));
++	seq_printf(seq, " Block size    : %12lu KB\n", F2FS_BLKSIZE >> 10);
++	seq_printf(seq, " Segment size  : %12d MB\n",
++			(BLKS_PER_SEG(sbi) << (F2FS_BLKSIZE_BITS - 10)) >> 10);
+ 	seq_printf(seq, " Segs/Sections : %12d\n",
+ 			SEGS_PER_SEC(sbi));
+ 	seq_printf(seq, " Section size  : %12d MB\n",
+-			SEGS_PER_SEC(sbi) << 1);
++			(BLKS_PER_SEC(sbi) << (F2FS_BLKSIZE_BITS - 10)) >> 10);
++	seq_printf(seq, " # of Sections : %12d\n",
++			le32_to_cpu(F2FS_RAW_SUPER(sbi)->section_count));
+ 
+ 	if (!f2fs_is_multi_device(sbi))
+ 		return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/fix-access-to-video_is_primary_device-when-compiled-.patch b/queue-6.12/fix-access-to-video_is_primary_device-when-compiled-.patch
new file mode 100644
index 0000000000..c1b6812e0e
--- /dev/null
+++ b/queue-6.12/fix-access-to-video_is_primary_device-when-compiled-.patch
@@ -0,0 +1,74 @@
+From ed278086e163a071c5f019e9af0f75be739f9626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:26:03 -0500
+Subject: Fix access to video_is_primary_device() when compiled without
+ CONFIG_VIDEO
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 6e490dea61b88aac9762c9f79a54aad4ea2e6cd1 ]
+
+When compiled without CONFIG_VIDEO the architecture specific
+implementations of video_is_primary_device() include prototypes and
+assume that video-common.c will be linked. Guard against this so that the
+fallback inline implementation that returns false will be used when
+compiled without CONFIG_VIDEO.
+
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506221312.49Fy1aNA-lkp@intel.com/
+Link: https://lore.kernel.org/r/20250811162606.587759-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/video.h | 2 +-
+ arch/sparc/include/asm/video.h  | 2 ++
+ arch/x86/include/asm/video.h    | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/parisc/include/asm/video.h b/arch/parisc/include/asm/video.h
+index c5dff3223194a..a9d50ebd6e769 100644
+--- a/arch/parisc/include/asm/video.h
++++ b/arch/parisc/include/asm/video.h
+@@ -6,7 +6,7 @@
+ 
+ struct device;
+ 
+-#if defined(CONFIG_STI_CORE)
++#if defined(CONFIG_STI_CORE) && defined(CONFIG_VIDEO)
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
+ #endif
+diff --git a/arch/sparc/include/asm/video.h b/arch/sparc/include/asm/video.h
+index a6f48f52db584..773717b6d4914 100644
+--- a/arch/sparc/include/asm/video.h
++++ b/arch/sparc/include/asm/video.h
+@@ -19,8 +19,10 @@ static inline pgprot_t pgprot_framebuffer(pgprot_t prot,
+ #define pgprot_framebuffer pgprot_framebuffer
+ #endif
+ 
++#ifdef CONFIG_VIDEO
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
++#endif
+ 
+ static inline void fb_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
+ {
+diff --git a/arch/x86/include/asm/video.h b/arch/x86/include/asm/video.h
+index 0950c9535fae9..08ec328203ef8 100644
+--- a/arch/x86/include/asm/video.h
++++ b/arch/x86/include/asm/video.h
+@@ -13,8 +13,10 @@ pgprot_t pgprot_framebuffer(pgprot_t prot,
+ 			    unsigned long offset);
+ #define pgprot_framebuffer pgprot_framebuffer
+ 
++#ifdef CONFIG_VIDEO
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
++#endif
+ 
+ #include <asm-generic/video.h>
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-6.12/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..3b53165081
--- /dev/null
+++ b/queue-6.12/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 26ec2029bb17cb29415de069b4f84dd60b653d12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 5ddfa4801bb30..ce986312bf685 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1552,7 +1552,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.12/ftrace-fix-softlockup-in-ftrace_module_enable.patch b/queue-6.12/ftrace-fix-softlockup-in-ftrace_module_enable.patch
new file mode 100644
index 0000000000..d176093d8f
--- /dev/null
+++ b/queue-6.12/ftrace-fix-softlockup-in-ftrace_module_enable.patch
@@ -0,0 +1,44 @@
+From cc52c7b10ad1355c2345a7e4961a368fcbfbb462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 13:28:55 +0200
+Subject: ftrace: Fix softlockup in ftrace_module_enable
+
+From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+
+[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
+
+A soft lockup was observed when loading amdgpu module.
+If a module has a lot of tracable functions, multiple calls
+to kallsyms_lookup can spend too much time in RCU critical
+section and with disabled preemption, causing kernel panic.
+This is the same issue that was fixed in
+commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY
+kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to
+ftrace_graph_set_hash()").
+
+Fix it the same way by adding cond_resched() in ftrace_module_enable.
+
+Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc
+Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 370cde32c696e..f7208f2525447 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7396,6 +7396,8 @@ void ftrace_module_enable(struct module *mod)
+ 		if (!within_module(rec->ip, mod))
+ 			break;
+ 
++		cond_resched();
++
+ 		/* Weak functions should still be ignored */
+ 		if (!test_for_valid_rec(rec)) {
+ 			/* Clear all other flags. Should not be enabled anyway */
+-- 
+2.51.0
+
diff --git a/queue-6.12/fuse-zero-initialize-inode-private-data.patch b/queue-6.12/fuse-zero-initialize-inode-private-data.patch
new file mode 100644
index 0000000000..187c3478a5
--- /dev/null
+++ b/queue-6.12/fuse-zero-initialize-inode-private-data.patch
@@ -0,0 +1,46 @@
+From 8902393f50aacb0e6af8b104346fd2ebee481e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 16:44:02 +0200
+Subject: fuse: zero initialize inode private data
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 3ca1b311181072415b6432a169de765ac2034e5a ]
+
+This is slightly tricky, since the VFS uses non-zeroing allocation to
+preserve some fields that are left in a consistent state.
+
+Reported-by: Chunsheng Luo <luochunsheng@ustc.edu>
+Closes: https://lore.kernel.org/all/20250818083224.229-1-luochunsheng@ustc.edu/
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/inode.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index fd3321e29a3e5..153f3102f167d 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -94,14 +94,11 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ 	if (!fi)
+ 		return NULL;
+ 
+-	fi->i_time = 0;
++	/* Initialize private data (i.e. everything except fi->inode) */
++	BUILD_BUG_ON(offsetof(struct fuse_inode, inode) != 0);
++	memset((void *) fi + sizeof(fi->inode), 0, sizeof(*fi) - sizeof(fi->inode));
++
+ 	fi->inval_mask = ~0;
+-	fi->nodeid = 0;
+-	fi->nlookup = 0;
+-	fi->attr_version = 0;
+-	fi->orig_ino = 0;
+-	fi->state = 0;
+-	fi->submount_lookup = NULL;
+ 	mutex_init(&fi->mutex);
+ 	spin_lock_init(&fi->lock);
+ 	fi->forget = fuse_alloc_forget();
+-- 
+2.51.0
+
diff --git a/queue-6.12/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch b/queue-6.12/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
new file mode 100644
index 0000000000..b127b5f73c
--- /dev/null
+++ b/queue-6.12/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
@@ -0,0 +1,65 @@
+From 82fb68a4e9257a793d1bad1c57d151146ba3658d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:01:51 +0200
+Subject: HID: asus: add Z13 folio to generic group for multitouch to work
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit b595974b4afe0e171dd707da570964ff642742e3 ]
+
+The Asus Z13 folio has a multitouch touchpad that needs to bind
+to the hid-multitouch driver in order to work properly. So bind
+it to the HID_GROUP_GENERIC group to release the touchpad and
+move it to the bottom so that the comment applies to it.
+
+While at it, change the generic KEYBOARD3 name to Z13_FOLIO.
+
+Reviewed-by: Luke D. Jones <luke@ljones.dev>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-asus.c | 6 +++---
+ drivers/hid/hid-ids.h  | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index dd989b519f86e..6cecfdae5c8fc 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1384,9 +1384,6 @@ static const struct hid_device_id asus_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+-	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3),
+-	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+@@ -1416,6 +1413,9 @@ static const struct hid_device_id asus_devices[] = {
+ 	 * Note bind to the HID_GROUP_GENERIC group, so that we only bind to the keyboard
+ 	 * part, while letting hid-multitouch.c handle the touchpad.
+ 	 */
++	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO),
++	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T101HA_KEYBOARD) },
+ 	{ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 18c4e5f143a77..d41a65362835d 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -219,7 +219,7 @@
+ #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3 0x1822
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD	0x1866
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2	0x19b6
+-#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3	0x1a30
++#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO		0x1a30
+ #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR		0x18c6
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY		0x1abe
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
+-- 
+2.51.0
+
diff --git a/queue-6.12/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch b/queue-6.12/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
new file mode 100644
index 0000000000..4f693f9a99
--- /dev/null
+++ b/queue-6.12/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
@@ -0,0 +1,130 @@
+From 377a08fe3728014ba88a8b50e877e27b530cdccb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 06:00:06 -0500
+Subject: HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 7d62beb102d6fa9a4e5e874be7fbf47a62fcc4f6 ]
+
+Dell systems utilize an EC-based touchpad emulation when the ACPI
+touchpad _DSM is not invoked. This emulation acts as a secondary
+master on the I2C bus, designed for scenarios where the I2C touchpad
+driver is absent, such as in BIOS menus. Typically, loading the
+i2c-hid module triggers the _DSM at initialization, disabling the
+EC-based emulation.
+
+However, if the i2c-hid module is missing from the boot kernel
+used for hibernation snapshot restoration, the _DSM remains
+uncalled, resulting in dual masters on the I2C bus and
+subsequent arbitration errors. This issue arises when i2c-hid
+resides in the rootfs instead of the kernel or initramfs.
+
+To address this, switch from using the SYSTEM_SLEEP_PM_OPS()
+macro to dedicated callbacks, introducing a specific
+callback for restoring the S4 image. This callback ensures
+the _DSM is invoked.
+
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-acpi.c |  8 ++++++++
+ drivers/hid/i2c-hid/i2c-hid-core.c | 28 +++++++++++++++++++++++++++-
+ drivers/hid/i2c-hid/i2c-hid.h      |  2 ++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+index 1b49243adb16a..abd700a101f46 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-acpi.c
++++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+@@ -76,6 +76,13 @@ static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi)
+ 	return hid_descriptor_address;
+ }
+ 
++static void i2c_hid_acpi_restore_sequence(struct i2chid_ops *ops)
++{
++	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
++
++	i2c_hid_acpi_get_descriptor(ihid_acpi);
++}
++
+ static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops)
+ {
+ 	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
+@@ -96,6 +103,7 @@ static int i2c_hid_acpi_probe(struct i2c_client *client)
+ 
+ 	ihid_acpi->adev = ACPI_COMPANION(dev);
+ 	ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail;
++	ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence;
+ 
+ 	ret = i2c_hid_acpi_get_descriptor(ihid_acpi);
+ 	if (ret < 0)
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index bcca89ef73606..276490547378d 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -955,6 +955,14 @@ static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid)
+ 	ihid->ops->shutdown_tail(ihid->ops);
+ }
+ 
++static void i2c_hid_core_restore_sequence(struct i2c_hid *ihid)
++{
++	if (!ihid->ops->restore_sequence)
++		return;
++
++	ihid->ops->restore_sequence(ihid->ops);
++}
++
+ static int i2c_hid_core_suspend(struct i2c_hid *ihid, bool force_poweroff)
+ {
+ 	struct i2c_client *client = ihid->client;
+@@ -1350,8 +1358,26 @@ static int i2c_hid_core_pm_resume(struct device *dev)
+ 	return i2c_hid_core_resume(ihid);
+ }
+ 
++static int i2c_hid_core_pm_restore(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++	if (ihid->is_panel_follower)
++		return 0;
++
++	i2c_hid_core_restore_sequence(ihid);
++
++	return i2c_hid_core_resume(ihid);
++}
++
+ const struct dev_pm_ops i2c_hid_core_pm = {
+-	SYSTEM_SLEEP_PM_OPS(i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume)
++	.suspend = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.resume = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.freeze = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.thaw = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.poweroff = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.restore = pm_sleep_ptr(i2c_hid_core_pm_restore),
+ };
+ EXPORT_SYMBOL_GPL(i2c_hid_core_pm);
+ 
+diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
+index 2c7b66d5caa0f..1724a435c783a 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.h
++++ b/drivers/hid/i2c-hid/i2c-hid.h
+@@ -27,11 +27,13 @@ static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+  * @power_up: do sequencing to power up the device.
+  * @power_down: do sequencing to power down the device.
+  * @shutdown_tail: called at the end of shutdown.
++ * @restore_sequence: hibernation restore sequence.
+  */
+ struct i2chid_ops {
+ 	int (*power_up)(struct i2chid_ops *ops);
+ 	void (*power_down)(struct i2chid_ops *ops);
+ 	void (*shutdown_tail)(struct i2chid_ops *ops);
++	void (*restore_sequence)(struct i2chid_ops *ops);
+ };
+ 
+ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+-- 
+2.51.0
+
diff --git a/queue-6.12/hid-pidff-permissive_control-quirk-autodetection.patch b/queue-6.12/hid-pidff-permissive_control-quirk-autodetection.patch
new file mode 100644
index 0000000000..8c0fb3fc89
--- /dev/null
+++ b/queue-6.12/hid-pidff-permissive_control-quirk-autodetection.patch
@@ -0,0 +1,59 @@
+From 497f3b82c031b421db63b688052a6e4c93a77002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 22:10:00 +0200
+Subject: HID: pidff: PERMISSIVE_CONTROL quirk autodetection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit c2dc9f0b368c08c34674311cf78407718d5715a7 ]
+
+Fixes force feedback for devices built with MMOS firmware and many more
+not yet detected devices.
+
+Update quirks mask debug message to always contain all 32 bits of data.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/usbhid/hid-pidff.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 0e60e4dc9e247..566eba0e045fa 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -1152,8 +1152,16 @@ static int pidff_find_special_fields(struct pidff_device *pidff)
+ 					 PID_DIRECTION, 0);
+ 	pidff->device_control =
+ 		pidff_find_special_field(pidff->reports[PID_DEVICE_CONTROL],
+-			PID_DEVICE_CONTROL_ARRAY,
+-			!(pidff->quirks & HID_PIDFF_QUIRK_PERMISSIVE_CONTROL));
++			PID_DEVICE_CONTROL_ARRAY, 1);
++
++	/* Detect and set permissive control quirk */
++	if (!pidff->device_control) {
++		pr_debug("Setting PERMISSIVE_CONTROL quirk\n");
++		pidff->quirks |= HID_PIDFF_QUIRK_PERMISSIVE_CONTROL;
++		pidff->device_control = pidff_find_special_field(
++			pidff->reports[PID_DEVICE_CONTROL],
++			PID_DEVICE_CONTROL_ARRAY, 0);
++	}
+ 
+ 	pidff->block_load_status =
+ 		pidff_find_special_field(pidff->reports[PID_BLOCK_LOAD],
+@@ -1492,7 +1500,7 @@ int hid_pidff_init_with_quirks(struct hid_device *hid, u32 initial_quirks)
+ 	ff->playback = pidff_playback;
+ 
+ 	hid_info(dev, "Force feedback for USB HID PID devices by Anssi Hannula <anssi.hannula@gmail.com>\n");
+-	hid_dbg(dev, "Active quirks mask: 0x%x\n", pidff->quirks);
++	hid_dbg(dev, "Active quirks mask: 0x%08x\n", pidff->quirks);
+ 
+ 	hid_device_io_stop(hid);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/hid-pidff-use-direction-fix-only-for-conditional-eff.patch b/queue-6.12/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
new file mode 100644
index 0000000000..bc55eb492e
--- /dev/null
+++ b/queue-6.12/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
@@ -0,0 +1,150 @@
+From 577349b7a8b5ae11d3970a6c8eb948a4f3b488a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 22:09:49 +0200
+Subject: HID: pidff: Use direction fix only for conditional effects
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit f345a4798dab800159b09d088e7bdae0f16076c3 ]
+
+The already fixed bug in SDL only affected conditional effects. This
+should fix FFB in Forza Horizion 4/5 on Moza Devices as Forza Horizon
+flips the constant force direction instead of using negative magnitude
+values.
+
+Changing the direction in the effect directly in pidff_upload_effect()
+would affect it's value in further operations like comparing to the old
+effect and/or just reading the effect values in the user application.
+
+This, in turn, would lead to constant PID_SET_EFFECT spam as the effect
+direction would constantly not match the value that's set by the
+application.
+
+This way, it's still transparent to any software/API.
+
+Only affects conditional effects now so it's better for it to explicitly
+state that in the name. If any HW ever needs fixed direction for other
+effects, we'll add more quirks.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-universal-pidff.c | 20 ++++++++++----------
+ drivers/hid/usbhid/hid-pidff.c    | 28 +++++++++++++++++++++++-----
+ drivers/hid/usbhid/hid-pidff.h    |  2 +-
+ 3 files changed, 34 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/hid/hid-universal-pidff.c b/drivers/hid/hid-universal-pidff.c
+index 5b89ec7b5c26c..dc1b262f28331 100644
+--- a/drivers/hid/hid-universal-pidff.c
++++ b/drivers/hid/hid-universal-pidff.c
+@@ -143,25 +143,25 @@ static int universal_pidff_input_configured(struct hid_device *hdev,
+ 
+ static const struct hid_device_id universal_pidff_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C5) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C12) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_DFP),
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 8dfd2c554a276..0e60e4dc9e247 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -205,6 +205,14 @@ struct pidff_device {
+ 	u8 effect_count;
+ };
+ 
++static int pidff_is_effect_conditional(struct ff_effect *effect)
++{
++	return effect->type == FF_SPRING  ||
++	       effect->type == FF_DAMPER  ||
++	       effect->type == FF_INERTIA ||
++	       effect->type == FF_FRICTION;
++}
++
+ /*
+  * Clamp value for a given field
+  */
+@@ -294,6 +302,20 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration)
+ 	pidff_set_time(usage, duration);
+ }
+ 
++static void pidff_set_effect_direction(struct pidff_device *pidff,
++				       struct ff_effect *effect)
++{
++	u16 direction = effect->direction;
++
++	/* Use fixed direction if needed */
++	if (pidff->quirks & HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION &&
++	    pidff_is_effect_conditional(effect))
++		direction = PIDFF_FIXED_WHEEL_DIRECTION;
++
++	pidff->effect_direction->value[0] =
++		pidff_rescale(direction, U16_MAX, pidff->effect_direction);
++}
++
+ /*
+  * Send envelope report to the device
+  */
+@@ -394,11 +416,7 @@ static void pidff_set_effect_report(struct pidff_device *pidff,
+ 		pidff->set_effect[PID_GAIN].field->logical_maximum;
+ 	pidff->set_effect[PID_DIRECTION_ENABLE].value[0] = 1;
+ 
+-	/* Use fixed direction if needed */
+-	pidff->effect_direction->value[0] = pidff_rescale(
+-		pidff->quirks & HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION ?
+-		PIDFF_FIXED_WHEEL_DIRECTION : effect->direction,
+-		U16_MAX, pidff->effect_direction);
++	pidff_set_effect_direction(pidff, effect);
+ 
+ 	/* Omit setting delay field if it's missing */
+ 	if (!(pidff->quirks & HID_PIDFF_QUIRK_MISSING_DELAY))
+diff --git a/drivers/hid/usbhid/hid-pidff.h b/drivers/hid/usbhid/hid-pidff.h
+index dda571e0a5bd3..e4ab05213ecac 100644
+--- a/drivers/hid/usbhid/hid-pidff.h
++++ b/drivers/hid/usbhid/hid-pidff.h
+@@ -17,7 +17,7 @@
+ #define HID_PIDFF_QUIRK_PERMISSIVE_CONTROL	BIT(2)
+ 
+ /* Use fixed 0x4000 direction during SET_EFFECT report upload */
+-#define HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION	BIT(3)
++#define HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION	BIT(3)
+ 
+ /* Force all periodic effects to be uploaded as SINE */
+ #define HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY	BIT(4)
+-- 
+2.51.0
+
diff --git a/queue-6.12/ib-ipoib-ignore-l3-master-device.patch b/queue-6.12/ib-ipoib-ignore-l3-master-device.patch
new file mode 100644
index 0000000000..4f575ced6f
--- /dev/null
+++ b/queue-6.12/ib-ipoib-ignore-l3-master-device.patch
@@ -0,0 +1,97 @@
+From b3c4b3eeaa0f14f7754d7a150feaef2fcae5da6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:03 +0300
+Subject: IB/ipoib: Ignore L3 master device
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 42f993d3439827c4959ea77e60620d7ebfb3a477 ]
+
+Currently, all master upper netdevices (e.g., bond, VRF) are treated
+equally.
+
+When a VRF netdevice is used over an IPoIB netdevice, the expected
+netdev resolution is on the lower IPoIB device which has the IP address
+assigned to it and not the VRF device.
+
+The rdma_cm module (CMA) tries to match incoming requests to a
+particular netdevice. When successful, it also validates that the return
+path points to the same device by performing a routing table lookup.
+Currently, the former would resolve to the VRF netdevice, while the
+latter to the correct lower IPoIB netdevice, leading to failure in
+rdma_cm.
+
+Improve this by ignoring the VRF master netdevice, if it exists, and
+instead return the lower IPoIB device.
+
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-5-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 4e31bb0b6466d..d65f3a5963651 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -317,26 +317,27 @@ static bool ipoib_is_dev_match_addr_rcu(const struct sockaddr *addr,
+ }
+ 
+ /*
+- * Find the master net_device on top of the given net_device.
++ * Find the L2 master net_device on top of the given net_device.
+  * @dev: base IPoIB net_device
+  *
+- * Returns the master net_device with a reference held, or the same net_device
+- * if no master exists.
++ * Returns the L2 master net_device with reference held if the L2 master
++ * exists (such as bond netdevice), or returns same netdev with reference
++ * held when master does not exist or when L3 master (such as VRF netdev).
+  */
+ static struct net_device *ipoib_get_master_net_dev(struct net_device *dev)
+ {
+ 	struct net_device *master;
+ 
+ 	rcu_read_lock();
++
+ 	master = netdev_master_upper_dev_get_rcu(dev);
++	if (!master || netif_is_l3_master(master))
++		master = dev;
++
+ 	dev_hold(master);
+ 	rcu_read_unlock();
+ 
+-	if (master)
+-		return master;
+-
+-	dev_hold(dev);
+-	return dev;
++	return master;
+ }
+ 
+ struct ipoib_walk_data {
+@@ -485,7 +486,7 @@ static struct net_device *ipoib_get_net_dev_by_params(
+ 	if (ret)
+ 		return NULL;
+ 
+-	/* See if we can find a unique device matching the L2 parameters */
++	/* See if we can find a unique device matching the pkey and GID */
+ 	matches = __ipoib_get_net_dev_by_params(dev_list, port, pkey_index,
+ 						gid, NULL, &net_dev);
+ 
+@@ -498,7 +499,7 @@ static struct net_device *ipoib_get_net_dev_by_params(
+ 
+ 	dev_put(net_dev);
+ 
+-	/* Couldn't find a unique device with L2 parameters only. Use L3
++	/* Couldn't find a unique device with pkey and GID only. Use L3
+ 	 * address to uniquely match the net device */
+ 	matches = __ipoib_get_net_dev_by_params(dev_list, port, pkey_index,
+ 						gid, addr, &net_dev);
+-- 
+2.51.0
+
diff --git a/queue-6.12/ice-don-t-use-pk-through-printk-or-tracepoints.patch b/queue-6.12/ice-don-t-use-pk-through-printk-or-tracepoints.patch
new file mode 100644
index 0000000000..b47b0fe861
--- /dev/null
+++ b/queue-6.12/ice-don-t-use-pk-through-printk-or-tracepoints.patch
@@ -0,0 +1,104 @@
+From 76720877aa6eed9e1b36ac8d2d44f5e731edb11e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:43:18 +0200
+Subject: ice: Don't use %pK through printk or tracepoints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c  |  2 +-
+ drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index bd5db525f1939..4f4678607e55f 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -9109,7 +9109,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)
+ 		list_add_tail(&ch->list, &vsi->ch_list);
+ 		vsi->tc_map_vsi[i] = ch->ch_vsi;
+ 		dev_dbg(ice_pf_to_dev(pf),
+-			"successfully created channel: VSI %pK\n", ch->ch_vsi);
++			"successfully created channel: VSI %p\n", ch->ch_vsi);
+ 	}
+ 	return 0;
+ 
+diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
+index 07aab6e130cd5..4f35ef8d6b299 100644
+--- a/drivers/net/ethernet/intel/ice/ice_trace.h
++++ b/drivers/net/ethernet/intel/ice/ice_trace.h
+@@ -130,7 +130,7 @@ DECLARE_EVENT_CLASS(ice_tx_template,
+ 				   __entry->buf = buf;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->buf)
+ );
+ 
+@@ -158,7 +158,7 @@ DECLARE_EVENT_CLASS(ice_rx_template,
+ 				   __entry->desc = desc;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc)
+ );
+ DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
+@@ -182,7 +182,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->skb)
+ );
+ 
+@@ -205,7 +205,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname),
++		    TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname),
+ 			      __entry->skb, __entry->ring)
+ );
+ 
+@@ -228,7 +228,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template,
+ 		    TP_fast_assign(__entry->skb = skb;
+ 				   __entry->idx = idx;),
+ 
+-		    TP_printk("skb %pK idx %d",
++		    TP_printk("skb %p idx %d",
+ 			      __entry->skb, __entry->idx)
+ );
+ #define DEFINE_TX_TSTAMP_OP_EVENT(name) \
+-- 
+2.51.0
+
diff --git a/queue-6.12/idpf-do-not-linearize-big-tso-packets.patch b/queue-6.12/idpf-do-not-linearize-big-tso-packets.patch
new file mode 100644
index 0000000000..0ebfb7b65b
--- /dev/null
+++ b/queue-6.12/idpf-do-not-linearize-big-tso-packets.patch
@@ -0,0 +1,345 @@
+From 653492522b187276182dfb4bab09b0e46156be4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 19:59:34 +0000
+Subject: idpf: do not linearize big TSO packets
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 02614eee26fbdfd73b944769001cefeff6ed008c ]
+
+idpf has a limit on number of scatter-gather frags
+that can be used per segment.
+
+Currently, idpf_tx_start() checks if the limit is hit
+and forces a linearization of the whole packet.
+
+This requires high order allocations that can fail
+under memory pressure. A full size BIG-TCP packet
+would require order-7 alocation on x86_64 :/
+
+We can move the check earlier from idpf_features_check()
+for TSO packets, to force GSO in this case, removing the
+cost of a big copy.
+
+This means that a linearization will eventually happen
+with sizes smaller than one MSS.
+
+__idpf_chk_linearize() is renamed to idpf_chk_tso_segment()
+and moved to idpf_lib.c
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Cc: Jacob Keller <jacob.e.keller@intel.com>
+Cc: Madhu Chittim <madhu.chittim@intel.com>
+Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: Andrew Lunn <andrew+netdev@lunn.ch>
+Reviewed-by: Joshua Hay <joshua.a.hay@intel.com>
+Tested-by: Brian Vazquez <brianvv@google.com>
+Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://patch.msgid.link/20250818195934.757936-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h      |   2 +
+ drivers/net/ethernet/intel/idpf/idpf_lib.c  | 102 +++++++++++++++-
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 129 ++++----------------
+ 3 files changed, 120 insertions(+), 113 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index a2b346d91879e..f4d51c885f335 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -144,6 +144,7 @@ enum idpf_vport_state {
+  * @link_speed_mbps: Link speed in mbps
+  * @vport_idx: Relative vport index
+  * @max_tx_hdr_size: Max header length hardware can support
++ * @tx_max_bufs: Max buffers that can be transmitted with scatter-gather
+  * @state: See enum idpf_vport_state
+  * @netstats: Packet and byte stats
+  * @stats_lock: Lock to protect stats update
+@@ -155,6 +156,7 @@ struct idpf_netdev_priv {
+ 	u32 link_speed_mbps;
+ 	u16 vport_idx;
+ 	u16 max_tx_hdr_size;
++	u16 tx_max_bufs;
+ 	enum idpf_vport_state state;
+ 	struct rtnl_link_stats64 netstats;
+ 	spinlock_t stats_lock;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 52d9caab2fcb2..371fc5052420d 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -742,6 +742,7 @@ static int idpf_cfg_netdev(struct idpf_vport *vport)
+ 	np->vport_idx = vport->idx;
+ 	np->vport_id = vport->vport_id;
+ 	np->max_tx_hdr_size = idpf_get_max_tx_hdr_size(adapter);
++	np->tx_max_bufs = idpf_get_max_tx_bufs(adapter);
+ 
+ 	spin_lock_init(&np->stats_lock);
+ 
+@@ -2205,6 +2206,92 @@ static int idpf_change_mtu(struct net_device *netdev, int new_mtu)
+ 	return err;
+ }
+ 
++/**
++ * idpf_chk_tso_segment - Check skb is not using too many buffers
++ * @skb: send buffer
++ * @max_bufs: maximum number of buffers
++ *
++ * For TSO we need to count the TSO header and segment payload separately.  As
++ * such we need to check cases where we have max_bufs-1 fragments or more as we
++ * can potentially require max_bufs+1 DMA transactions, 1 for the TSO header, 1
++ * for the segment payload in the first descriptor, and another max_buf-1 for
++ * the fragments.
++ *
++ * Returns true if the packet needs to be software segmented by core stack.
++ */
++static bool idpf_chk_tso_segment(const struct sk_buff *skb,
++				 unsigned int max_bufs)
++{
++	const struct skb_shared_info *shinfo = skb_shinfo(skb);
++	const skb_frag_t *frag, *stale;
++	int nr_frags, sum;
++
++	/* no need to check if number of frags is less than max_bufs - 1 */
++	nr_frags = shinfo->nr_frags;
++	if (nr_frags < (max_bufs - 1))
++		return false;
++
++	/* We need to walk through the list and validate that each group
++	 * of max_bufs-2 fragments totals at least gso_size.
++	 */
++	nr_frags -= max_bufs - 2;
++	frag = &shinfo->frags[0];
++
++	/* Initialize size to the negative value of gso_size minus 1.  We use
++	 * this as the worst case scenario in which the frag ahead of us only
++	 * provides one byte which is why we are limited to max_bufs-2
++	 * descriptors for a single transmit as the header and previous
++	 * fragment are already consuming 2 descriptors.
++	 */
++	sum = 1 - shinfo->gso_size;
++
++	/* Add size of frags 0 through 4 to create our initial sum */
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++
++	/* Walk through fragments adding latest fragment, testing it, and
++	 * then removing stale fragments from the sum.
++	 */
++	for (stale = &shinfo->frags[0];; stale++) {
++		int stale_size = skb_frag_size(stale);
++
++		sum += skb_frag_size(frag++);
++
++		/* The stale fragment may present us with a smaller
++		 * descriptor than the actual fragment size. To account
++		 * for that we need to remove all the data on the front and
++		 * figure out what the remainder would be in the last
++		 * descriptor associated with the fragment.
++		 */
++		if (stale_size > IDPF_TX_MAX_DESC_DATA) {
++			int align_pad = -(skb_frag_off(stale)) &
++					(IDPF_TX_MAX_READ_REQ_SIZE - 1);
++
++			sum -= align_pad;
++			stale_size -= align_pad;
++
++			do {
++				sum -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
++				stale_size -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
++			} while (stale_size > IDPF_TX_MAX_DESC_DATA);
++		}
++
++		/* if sum is negative we failed to make sufficient progress */
++		if (sum < 0)
++			return true;
++
++		if (!nr_frags--)
++			break;
++
++		sum -= stale_size;
++	}
++
++	return false;
++}
++
+ /**
+  * idpf_features_check - Validate packet conforms to limits
+  * @skb: skb buffer
+@@ -2226,12 +2313,15 @@ static netdev_features_t idpf_features_check(struct sk_buff *skb,
+ 	if (skb->ip_summed != CHECKSUM_PARTIAL)
+ 		return features;
+ 
+-	/* We cannot support GSO if the MSS is going to be less than
+-	 * 88 bytes. If it is then we need to drop support for GSO.
+-	 */
+-	if (skb_is_gso(skb) &&
+-	    (skb_shinfo(skb)->gso_size < IDPF_TX_TSO_MIN_MSS))
+-		features &= ~NETIF_F_GSO_MASK;
++	if (skb_is_gso(skb)) {
++		/* We cannot support GSO if the MSS is going to be less than
++		 * 88 bytes. If it is then we need to drop support for GSO.
++		 */
++		if (skb_shinfo(skb)->gso_size < IDPF_TX_TSO_MIN_MSS)
++			features &= ~NETIF_F_GSO_MASK;
++		else if (idpf_chk_tso_segment(skb, np->tx_max_bufs))
++			features &= ~NETIF_F_GSO_MASK;
++	}
+ 
+ 	/* Ensure MACLEN is <= 126 bytes (63 words) and not an odd size */
+ 	len = skb_network_offset(skb);
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 087a3077d5481..11bb61c123754 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -15,8 +15,28 @@ struct idpf_tx_stash {
+ #define idpf_tx_buf_compl_tag(buf)	(*(u32 *)&(buf)->priv)
+ LIBETH_SQE_CHECK_PRIV(u32);
+ 
+-static bool idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs,
+-			       unsigned int count);
++/**
++ * idpf_chk_linearize - Check if skb exceeds max descriptors per packet
++ * @skb: send buffer
++ * @max_bufs: maximum scatter gather buffers for single packet
++ * @count: number of buffers this packet needs
++ *
++ * Make sure we don't exceed maximum scatter gather buffers for a single
++ * packet.
++ * TSO case has been handled earlier from idpf_features_check().
++ */
++static bool idpf_chk_linearize(const struct sk_buff *skb,
++			       unsigned int max_bufs,
++			       unsigned int count)
++{
++	if (likely(count <= max_bufs))
++		return false;
++
++	if (skb_is_gso(skb))
++		return false;
++
++	return true;
++}
+ 
+ /**
+  * idpf_buf_lifo_push - push a buffer pointer onto stack
+@@ -2575,111 +2595,6 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
+ 	return 1;
+ }
+ 
+-/**
+- * __idpf_chk_linearize - Check skb is not using too many buffers
+- * @skb: send buffer
+- * @max_bufs: maximum number of buffers
+- *
+- * For TSO we need to count the TSO header and segment payload separately.  As
+- * such we need to check cases where we have max_bufs-1 fragments or more as we
+- * can potentially require max_bufs+1 DMA transactions, 1 for the TSO header, 1
+- * for the segment payload in the first descriptor, and another max_buf-1 for
+- * the fragments.
+- */
+-static bool __idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs)
+-{
+-	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	const skb_frag_t *frag, *stale;
+-	int nr_frags, sum;
+-
+-	/* no need to check if number of frags is less than max_bufs - 1 */
+-	nr_frags = shinfo->nr_frags;
+-	if (nr_frags < (max_bufs - 1))
+-		return false;
+-
+-	/* We need to walk through the list and validate that each group
+-	 * of max_bufs-2 fragments totals at least gso_size.
+-	 */
+-	nr_frags -= max_bufs - 2;
+-	frag = &shinfo->frags[0];
+-
+-	/* Initialize size to the negative value of gso_size minus 1.  We use
+-	 * this as the worst case scenario in which the frag ahead of us only
+-	 * provides one byte which is why we are limited to max_bufs-2
+-	 * descriptors for a single transmit as the header and previous
+-	 * fragment are already consuming 2 descriptors.
+-	 */
+-	sum = 1 - shinfo->gso_size;
+-
+-	/* Add size of frags 0 through 4 to create our initial sum */
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-
+-	/* Walk through fragments adding latest fragment, testing it, and
+-	 * then removing stale fragments from the sum.
+-	 */
+-	for (stale = &shinfo->frags[0];; stale++) {
+-		int stale_size = skb_frag_size(stale);
+-
+-		sum += skb_frag_size(frag++);
+-
+-		/* The stale fragment may present us with a smaller
+-		 * descriptor than the actual fragment size. To account
+-		 * for that we need to remove all the data on the front and
+-		 * figure out what the remainder would be in the last
+-		 * descriptor associated with the fragment.
+-		 */
+-		if (stale_size > IDPF_TX_MAX_DESC_DATA) {
+-			int align_pad = -(skb_frag_off(stale)) &
+-					(IDPF_TX_MAX_READ_REQ_SIZE - 1);
+-
+-			sum -= align_pad;
+-			stale_size -= align_pad;
+-
+-			do {
+-				sum -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
+-				stale_size -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
+-			} while (stale_size > IDPF_TX_MAX_DESC_DATA);
+-		}
+-
+-		/* if sum is negative we failed to make sufficient progress */
+-		if (sum < 0)
+-			return true;
+-
+-		if (!nr_frags--)
+-			break;
+-
+-		sum -= stale_size;
+-	}
+-
+-	return false;
+-}
+-
+-/**
+- * idpf_chk_linearize - Check if skb exceeds max descriptors per packet
+- * @skb: send buffer
+- * @max_bufs: maximum scatter gather buffers for single packet
+- * @count: number of buffers this packet needs
+- *
+- * Make sure we don't exceed maximum scatter gather buffers for a single
+- * packet. We have to do some special checking around the boundary (max_bufs-1)
+- * if TSO is on since we need count the TSO header and payload separately.
+- * E.g.: a packet with 7 fragments can require 9 DMA transactions; 1 for TSO
+- * header, 1 for segment payload, and then 7 for the fragments.
+- */
+-static bool idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs,
+-			       unsigned int count)
+-{
+-	if (likely(count < max_bufs))
+-		return false;
+-	if (skb_is_gso(skb))
+-		return __idpf_chk_linearize(skb, max_bufs);
+-
+-	return count > max_bufs;
+-}
+ 
+ /**
+  * idpf_tx_splitq_get_ctx_desc - grab next desc and update buffer ring
+-- 
+2.51.0
+
diff --git a/queue-6.12/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch b/queue-6.12/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
new file mode 100644
index 0000000000..ac55ec7e34
--- /dev/null
+++ b/queue-6.12/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
@@ -0,0 +1,88 @@
+From 03f9e2fa8ec8abbb28abf6e2b79816754fd0b561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:04:23 +0800
+Subject: iio: adc: imx93_adc: load calibrated values even calibration failed
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 12c9b09e981ab14ebec8e4eefa946cbd26dd306b ]
+
+ADC calibration might fail because of the noise on reference voltage.
+To avoid calibration fail, need to meet the following requirement:
+    ADC reference voltage Noise < 1.8V * 1/2^ENOB
+
+For the case which the ADC reference voltage on board do not meet
+the requirement, still load the calibrated values, so ADC can also
+work but maybe not that accurate.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250812-adc-v2-2-0260833f13b8@nxp.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/imx93_adc.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c
+index 4ccf4819f1f13..75cf2f93d5edd 100644
+--- a/drivers/iio/adc/imx93_adc.c
++++ b/drivers/iio/adc/imx93_adc.c
+@@ -38,6 +38,7 @@
+ #define IMX93_ADC_PCDR6		0x118
+ #define IMX93_ADC_PCDR7		0x11c
+ #define IMX93_ADC_CALSTAT	0x39C
++#define IMX93_ADC_CALCFG0	0x3A0
+ 
+ /* ADC bit shift */
+ #define IMX93_ADC_MCR_MODE_MASK			BIT(29)
+@@ -58,6 +59,8 @@
+ #define IMX93_ADC_IMR_ECH_MASK			BIT(0)
+ #define IMX93_ADC_PCDR_CDATA_MASK		GENMASK(11, 0)
+ 
++#define IMX93_ADC_CALCFG0_LDFAIL_MASK		BIT(4)
++
+ /* ADC status */
+ #define IMX93_ADC_MSR_ADCSTATUS_IDLE			0
+ #define IMX93_ADC_MSR_ADCSTATUS_POWER_DOWN		1
+@@ -145,7 +148,7 @@ static void imx93_adc_config_ad_clk(struct imx93_adc *adc)
+ 
+ static int imx93_adc_calibration(struct imx93_adc *adc)
+ {
+-	u32 mcr, msr;
++	u32 mcr, msr, calcfg;
+ 	int ret;
+ 
+ 	/* make sure ADC in power down mode */
+@@ -158,6 +161,11 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 
+ 	imx93_adc_power_up(adc);
+ 
++	/* Enable loading of calibrated values even in fail condition */
++	calcfg = readl(adc->regs + IMX93_ADC_CALCFG0);
++	calcfg |= IMX93_ADC_CALCFG0_LDFAIL_MASK;
++	writel(calcfg, adc->regs + IMX93_ADC_CALCFG0);
++
+ 	/*
+ 	 * TODO: we use the default TSAMP/NRSMPL/AVGEN in MCR,
+ 	 * can add the setting of these bit if need in future.
+@@ -180,9 +188,13 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 	/* check whether calbration is success or not */
+ 	msr = readl(adc->regs + IMX93_ADC_MSR);
+ 	if (msr & IMX93_ADC_MSR_CALFAIL_MASK) {
++		/*
++		 * Only give warning here, this means the noise of the
++		 * reference voltage do not meet the requirement:
++		 *     ADC reference voltage Noise < 1.8V * 1/2^ENOB
++		 * And the resault of ADC is not that accurate.
++		 */
+ 		dev_warn(adc->dev, "ADC calibration failed!\n");
+-		imx93_adc_power_down(adc);
+-		return -EAGAIN;
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-6.12/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..09073887c6
--- /dev/null
+++ b/queue-6.12/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From 5da451efb753d28c9e64015b8a95d7d93878b26e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index b6dd096391c11..39c383631a595 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -14,6 +14,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&st->lock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-6.12/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch b/queue-6.12/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
new file mode 100644
index 0000000000..d193d389a9
--- /dev/null
+++ b/queue-6.12/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
@@ -0,0 +1,156 @@
+From 439e42080db3c9ca9b9eb7231fb9925b992d4f07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 13:55:23 +0800
+Subject: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA
+ xattr
+
+From: Coiby Xu <coxu@redhat.com>
+
+[ Upstream commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd ]
+
+Currently when both IMA and EVM are in fix mode, the IMA signature will
+be reset to IMA hash if a program first stores IMA signature in
+security.ima and then writes/removes some other security xattr for the
+file.
+
+For example, on Fedora, after booting the kernel with "ima_appraise=fix
+evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,
+installing/reinstalling a package will not make good reference IMA
+signature generated. Instead IMA hash is generated,
+
+    # getfattr -m - -d -e hex /usr/bin/bash
+    # file: usr/bin/bash
+    security.ima=0x0404...
+
+This happens because when setting security.selinux, the IMA_DIGSIG flag
+that had been set early was cleared. As a result, IMA hash is generated
+when the file is closed.
+
+Similarly, IMA signature can be cleared on file close after removing
+security xattr like security.evm or setting/removing ACL.
+
+Prevent replacing the IMA file signature with a file hash, by preventing
+the IMA_DIGSIG flag from being reset.
+
+Here's a minimal C reproducer which sets security.selinux as the last
+step which can also replaced by removing security.evm or setting ACL,
+
+    #include <stdio.h>
+    #include <sys/xattr.h>
+    #include <fcntl.h>
+    #include <unistd.h>
+    #include <string.h>
+    #include <stdlib.h>
+
+    int main() {
+        const char* file_path = "/usr/sbin/test_binary";
+        const char* hex_string = "030204d33204490066306402304";
+        int length = strlen(hex_string);
+        char* ima_attr_value;
+        int fd;
+
+        fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
+        if (fd == -1) {
+            perror("Error opening file");
+            return 1;
+        }
+
+        ima_attr_value = (char*)malloc(length / 2 );
+        for (int i = 0, j = 0; i < length; i += 2, j++) {
+            sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
+        }
+
+        if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        const char* selinux_value= "system_u:object_r:bin_t:s0";
+        if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        close(fd);
+
+        return 0;
+    }
+
+Signed-off-by: Coiby Xu <coxu@redhat.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_appraise.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index 656c709b974fd..f7770c24995b7 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -671,6 +671,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
+ 	return 0;
+ }
+ 
++/*
++ * ima_reset_appraise_flags - reset ima_iint_cache flags
++ *
++ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values
++ *          0: clear IMA_DIGSIG
++ *          1: set IMA_DIGSIG
++ *         -1: don't change IMA_DIGSIG
++ *
++ */
+ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ {
+ 	struct ima_iint_cache *iint;
+@@ -683,9 +692,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ 		return;
+ 	iint->measured_pcrs = 0;
+ 	set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
+-	if (digsig)
++	if (digsig == 1)
+ 		set_bit(IMA_DIGSIG, &iint->atomic_flags);
+-	else
++	else if (digsig == 0)
+ 		clear_bit(IMA_DIGSIG, &iint->atomic_flags);
+ }
+ 
+@@ -771,6 +780,8 @@ static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ 		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
+ 	} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
+ 		digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
++	} else {
++		digsig = -1;
+ 	}
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+ 		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+@@ -784,7 +795,7 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ 			     const char *acl_name, struct posix_acl *kacl)
+ {
+ 	if (evm_revalidate_status(acl_name))
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		ima_reset_appraise_flags(d_backing_inode(dentry), -1);
+ 
+ 	return 0;
+ }
+@@ -792,11 +803,13 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ 				 const char *xattr_name)
+ {
+-	int result;
++	int result, digsig = -1;
+ 
+ 	result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		if (!strcmp(xattr_name, XATTR_NAME_IMA))
++			digsig = 0;
++		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+ 		if (result == 1)
+ 			result = 0;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch b/queue-6.12/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
new file mode 100644
index 0000000000..56b0aab899
--- /dev/null
+++ b/queue-6.12/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
@@ -0,0 +1,62 @@
+From 4372fbee9b5d473234e6a2d1b82ba60616f2ecdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:27:36 +0000
+Subject: inet_diag: annotate data-races in inet_diag_bc_sk()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4fd84a0aaf2ba125b441aa09d415022385e66bf2 ]
+
+inet_diag_bc_sk() runs with an unlocked socket,
+annotate potential races with READ_ONCE().
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250828102738.2065992-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_diag.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 67639309163d0..f2de2f2962595 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -783,7 +783,7 @@ static void entry_fill_addrs(struct inet_diag_entry *entry,
+ 			     const struct sock *sk)
+ {
+ #if IS_ENABLED(CONFIG_IPV6)
+-	if (sk->sk_family == AF_INET6) {
++	if (entry->family == AF_INET6) {
+ 		entry->saddr = sk->sk_v6_rcv_saddr.s6_addr32;
+ 		entry->daddr = sk->sk_v6_daddr.s6_addr32;
+ 	} else
+@@ -796,18 +796,18 @@ static void entry_fill_addrs(struct inet_diag_entry *entry,
+ 
+ int inet_diag_bc_sk(const struct nlattr *bc, struct sock *sk)
+ {
+-	struct inet_sock *inet = inet_sk(sk);
++	const struct inet_sock *inet = inet_sk(sk);
+ 	struct inet_diag_entry entry;
+ 
+ 	if (!bc)
+ 		return 1;
+ 
+-	entry.family = sk->sk_family;
++	entry.family = READ_ONCE(sk->sk_family);
+ 	entry_fill_addrs(&entry, sk);
+-	entry.sport = inet->inet_num;
+-	entry.dport = ntohs(inet->inet_dport);
+-	entry.ifindex = sk->sk_bound_dev_if;
+-	entry.userlocks = sk_fullsock(sk) ? sk->sk_userlocks : 0;
++	entry.sport = READ_ONCE(inet->inet_num);
++	entry.dport = ntohs(READ_ONCE(inet->inet_dport));
++	entry.ifindex = READ_ONCE(sk->sk_bound_dev_if);
++	entry.userlocks = sk_fullsock(sk) ? READ_ONCE(sk->sk_userlocks) : 0;
+ 	if (sk_fullsock(sk))
+ 		entry.mark = READ_ONCE(sk->sk_mark);
+ 	else if (sk->sk_state == TCP_NEW_SYN_RECV)
+-- 
+2.51.0
+
diff --git a/queue-6.12/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-6.12/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..bcdd00bb68
--- /dev/null
+++ b/queue-6.12/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From e5794779cb98a1306170049b031a87bff4cd0d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index f5b544e0f230b..af147d279a294 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -816,11 +816,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -869,10 +874,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-6.12/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch b/queue-6.12/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
new file mode 100644
index 0000000000..6223524fb5
--- /dev/null
+++ b/queue-6.12/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
@@ -0,0 +1,49 @@
+From 1a36d1ba59f32c455c5bbcdf1ddc80674bb19655 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 12:57:18 +0200
+Subject: iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit ecf6508923f87e4597228f70cc838af3d37f6662 ]
+
+These registers exist and at least on the t602x variant the IRQ only
+clears when theses are cleared.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Link: https://lore.kernel.org/r/20250826-dart-t8110-stream-error-v1-1-e33395112014@jannau.net
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/apple-dart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c
+index eb1e62cd499a5..e8d7bcbee1a22 100644
+--- a/drivers/iommu/apple-dart.c
++++ b/drivers/iommu/apple-dart.c
+@@ -122,6 +122,8 @@
+ #define DART_T8110_ERROR_ADDR_LO 0x170
+ #define DART_T8110_ERROR_ADDR_HI 0x174
+ 
++#define DART_T8110_ERROR_STREAMS 0x1c0
++
+ #define DART_T8110_PROTECT 0x200
+ #define DART_T8110_UNPROTECT 0x204
+ #define DART_T8110_PROTECT_LOCK 0x208
+@@ -1073,6 +1075,9 @@ static irqreturn_t apple_dart_t8110_irq(int irq, void *dev)
+ 		error, stream_idx, error_code, fault_name, addr);
+ 
+ 	writel(error, dart->regs + DART_T8110_ERROR);
++	for (int i = 0; i < BITS_TO_U32(dart->num_streams); i++)
++		writel(U32_MAX, dart->regs + DART_T8110_ERROR_STREAMS + 4 * i);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch b/queue-6.12/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
new file mode 100644
index 0000000000..13f3cde71a
--- /dev/null
+++ b/queue-6.12/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
@@ -0,0 +1,131 @@
+From 51ec3ffab8fda20aaafa554b920ef6151eba165f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:58 +0800
+Subject: iommu/vt-d: Replace snprintf with scnprintf in
+ dmar_latency_snapshot()
+
+From: Seyediman Seyedarab <ImanDevel@gmail.com>
+
+[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
+
+snprintf() returns the number of bytes that would have been written, not
+the number actually written. Using this for offset tracking can cause
+buffer overruns if truncation occurs.
+
+Replace snprintf() with scnprintf() to ensure the offset stays within
+bounds.
+
+Since scnprintf() never returns a negative value, and zero is not possible
+in this context because 'bytes' starts at 0 and 'size - bytes' is
+DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
+string literals used, the return value is always positive. An integer
+overflow is also completely out of reach here due to the small and fixed
+buffer size. The error check in latency_show_one() is therefore
+unnecessary. Remove it and make dmar_latency_snapshot() return void.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 10 ++--------
+ drivers/iommu/intel/perf.c    | 10 ++++------
+ drivers/iommu/intel/perf.h    |  5 ++---
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index 5aa7f46a420b5..38790ff50977c 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -661,17 +661,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
+ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
+ 			     struct dmar_drhd_unit *drhd)
+ {
+-	int ret;
+-
+ 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
+ 		   iommu->name, drhd->reg_base_addr);
+ 
+-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+-	if (ret < 0)
+-		seq_puts(m, "Failed to get latency snapshot");
+-	else
+-		seq_puts(m, debug_buf);
+-	seq_puts(m, "\n");
++	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
++	seq_printf(m, "%s\n", debug_buf);
+ }
+ 
+ static int latency_show(struct seq_file *m, void *v)
+diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
+index adc4de6bbd88e..dceeadc3ee7cd 100644
+--- a/drivers/iommu/intel/perf.c
++++ b/drivers/iommu/intel/perf.c
+@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
+ 	"     svm_prq"
+ };
+ 
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+ 	struct latency_statistic *lstat = iommu->perf_statistic;
+ 	unsigned long flags;
+@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 	memset(str, 0, size);
+ 
+ 	for (i = 0; i < COUNTS_NUM; i++)
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "%s", latency_counter_names[i]);
+ 
+ 	spin_lock_irqsave(&latency_lock, flags);
+@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 		if (!dmar_latency_enabled(iommu, i))
+ 			continue;
+ 
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "\n%s", latency_type_names[i]);
+ 
+ 		for (j = 0; j < COUNTS_NUM; j++) {
+@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 				break;
+ 			}
+ 
+-			bytes += snprintf(str + bytes, size - bytes,
++			bytes += scnprintf(str + bytes, size - bytes,
+ 					  "%12lld", val);
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&latency_lock, flags);
+-
+-	return bytes;
+ }
+diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
+index df9a36942d643..1d4baad7e852e 100644
+--- a/drivers/iommu/intel/perf.h
++++ b/drivers/iommu/intel/perf.h
+@@ -40,7 +40,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
+ bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
+ void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
+ 			 u64 latency);
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+ #else
+ static inline int
+ dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
+@@ -64,9 +64,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
+ {
+ }
+ 
+-static inline int
++static inline void
+ dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+-	return 0;
+ }
+ #endif /* CONFIG_DMAR_PERF */
+-- 
+2.51.0
+
diff --git a/queue-6.12/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-6.12/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..0ee610fcd1
--- /dev/null
+++ b/queue-6.12/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From 06a68487f932afb340766f0440a960bbe109ee07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 49ec223f2eda4..228cf72e52503 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -7176,7 +7176,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		.procname	= "ioam6_enabled",
+-- 
+2.51.0
+
diff --git a/queue-6.12/ipv6-np-rxpmtu-race-annotation.patch b/queue-6.12/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..d8e2d98e39
--- /dev/null
+++ b/queue-6.12/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From 607a111ffe4a96bbc36e6385a80bf26ec90b2102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 328419e05c815..d148f1b03c5d0 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -445,7 +445,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 57e38e5e4be92..9b93df668025d 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -394,7 +394,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-6.12/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-6.12/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..9e4ab8b99d
--- /dev/null
+++ b/queue-6.12/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From 54e4e40b72602f559462ccb0f89a743387c8d313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index be17e3c43582f..7840a03e5bcb7 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-6.12/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-6.12/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..c955d04f27
--- /dev/null
+++ b/queue-6.12/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From 79e273c0f36d507470847beb82fe623beaebceae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 5fe8cb4742c21..8ee653aa07ced 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-6.12/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch b/queue-6.12/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
new file mode 100644
index 0000000000..cb3adfb8d4
--- /dev/null
+++ b/queue-6.12/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
@@ -0,0 +1,42 @@
+From eba99ea2aa50c61d499ae8d16caf33eeef12adfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:12:05 +0900
+Subject: ksmbd: use sock_create_kern interface to create kernel socket
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
+
+we should use sock_create_kern() if the socket resides in kernel space.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_tcp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
+index b51ccc16abe11..169e3013e48b5 100644
+--- a/fs/smb/server/transport_tcp.c
++++ b/fs/smb/server/transport_tcp.c
+@@ -475,12 +475,13 @@ static int create_socket(struct interface *iface)
+ 	struct socket *ksmbd_socket;
+ 	bool ipv4 = false;
+ 
+-	ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
++	ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM,
++			IPPROTO_TCP, &ksmbd_socket);
+ 	if (ret) {
+ 		if (ret != -EAFNOSUPPORT)
+ 			pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret);
+-		ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
+-				  &ksmbd_socket);
++		ret = sock_create_kern(current->nsproxy->net_ns, PF_INET,
++				SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+ 		if (ret) {
+ 			pr_err("Can't create socket for ipv4: %d\n", ret);
+ 			goto out_clear;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-adv7180-add-missing-lock-in-suspend-callback.patch b/queue-6.12/media-adv7180-add-missing-lock-in-suspend-callback.patch
new file mode 100644
index 0000000000..c9f95ca8b8
--- /dev/null
+++ b/queue-6.12/media-adv7180-add-missing-lock-in-suspend-callback.patch
@@ -0,0 +1,57 @@
+From f3f9b9549d7fb43e04e7b5fb3b30d39444c82c12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:45 +0200
+Subject: media: adv7180: Add missing lock in suspend callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
+
+The adv7180_set_power() utilizes adv7180_write() which in turn requires
+the state mutex to be held, take it before calling adv7180_set_power()
+to avoid tripping a lockdep_assert_held().
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 2a20a4fad796c..684a9bba3c5d2 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -813,6 +813,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		if (state->field != format->format.field) {
++			guard(mutex)(&state->mutex);
++
+ 			state->field = format->format.field;
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+@@ -1564,6 +1566,8 @@ static int adv7180_suspend(struct device *dev)
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	guard(mutex)(&state->mutex);
++
+ 	return adv7180_set_power(state, false);
+ }
+ 
+@@ -1577,6 +1581,8 @@ static int adv7180_resume(struct device *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	guard(mutex)(&state->mutex);
++
+ 	ret = adv7180_set_power(state, state->powered);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-adv7180-do-not-write-format-to-device-in-set_f.patch b/queue-6.12/media-adv7180-do-not-write-format-to-device-in-set_f.patch
new file mode 100644
index 0000000000..fbb76ffa1e
--- /dev/null
+++ b/queue-6.12/media-adv7180-do-not-write-format-to-device-in-set_f.patch
@@ -0,0 +1,50 @@
+From 8fe518a64bd772d34eefd3991d0be2b78693120d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:52 +0200
+Subject: media: adv7180: Do not write format to device in set_fmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
+
+The .set_fmt callback should not write the new format directly do the
+device, it should only store it and have it applied by .s_stream.
+
+The .s_stream callback already calls adv7180_set_field_mode() so it's
+safe to remove programming of the device and just store the format and
+have .s_stream apply it.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 684a9bba3c5d2..6eb55f0d89dc9 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -812,14 +812,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 	ret = adv7180_mbus_fmt(sd,  &format->format);
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+-		if (state->field != format->format.field) {
+-			guard(mutex)(&state->mutex);
+-
+-			state->field = format->format.field;
+-			adv7180_set_power(state, false);
+-			adv7180_set_field_mode(state);
+-			adv7180_set_power(state, true);
+-		}
++		state->field = format->format.field;
+ 	} else {
+ 		framefmt = v4l2_subdev_state_get_format(sd_state, 0);
+ 		*framefmt = format->format;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-adv7180-only-validate-format-in-querystd.patch b/queue-6.12/media-adv7180-only-validate-format-in-querystd.patch
new file mode 100644
index 0000000000..0b01c99bf7
--- /dev/null
+++ b/queue-6.12/media-adv7180-only-validate-format-in-querystd.patch
@@ -0,0 +1,85 @@
+From 5428423e459d7a7a834bf8f1809d644f1fcb1018 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:54 +0200
+Subject: media: adv7180: Only validate format in querystd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
+
+The .querystd callback should not program the device with the detected
+standard, it should only report the standard to user-space. User-space
+may then use .s_std to set the standard, if it wants to use it.
+
+All that is required of .querystd is to setup the auto detection of
+standards and report its findings.
+
+While at it add some documentation on why this can't happen while
+streaming and improve the error handling using a scoped guard.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 6eb55f0d89dc9..f3f47beff76bb 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -357,32 +357,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
+ static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int err = mutex_lock_interruptible(&state->mutex);
+-	if (err)
+-		return err;
+-
+-	if (state->streaming) {
+-		err = -EBUSY;
+-		goto unlock;
+-	}
++	int ret;
+ 
+-	err = adv7180_set_video_standard(state,
+-			ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+-	if (err)
+-		goto unlock;
++	guard(mutex)(&state->mutex);
+ 
+-	msleep(100);
+-	__adv7180_status(state, NULL, std);
++	/*
++	 * We can't sample the standard if the device is streaming as that would
++	 * interfere with the capture session as the VID_SEL reg is touched.
++	 */
++	if (state->streaming)
++		return -EBUSY;
+ 
+-	err = v4l2_std_to_adv7180(state->curr_norm);
+-	if (err < 0)
+-		goto unlock;
++	/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
++	ret = adv7180_set_video_standard(state,
++					 ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
++	if (ret)
++		return ret;
+ 
+-	err = adv7180_set_video_standard(state, err);
++	/* Allow some time for the autodetection to run. */
++	msleep(100);
+ 
+-unlock:
+-	mutex_unlock(&state->mutex);
+-	return err;
++	return __adv7180_status(state, NULL, std);
+ }
+ 
+ static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch b/queue-6.12/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
new file mode 100644
index 0000000000..200d17c4a1
--- /dev/null
+++ b/queue-6.12/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
@@ -0,0 +1,91 @@
+From 0264f87ffb41f5ffc2410cebe216f8537d4914da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:56 +0300
+Subject: media: amphion: Delete v4l2_fh synchronously in .release()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
+
+The v4l2_fh initialized and added in vpu_v4l2_open() is delete and
+cleaned up when the last reference to the vpu_inst is released. This may
+happen later than at vpu_v4l2_close() time.
+
+Not deleting and cleaning up the v4l2_fh when closing the file handle to
+the video device is not ideal, as the v4l2_fh will still be present in
+the video device's fh_list, and will store a copy of events queued to
+the video device. There may also be other side effects of keeping alive
+an object that represents an open file handle after the file handle is
+closed.
+
+The v4l2_fh instance is embedded in the vpu_inst structure, and is
+accessed in two different ways:
+
+- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2
+  events to the file handle ; and
+
+- through the driver to access the v4l2_fh.m2m_ctx pointer.
+
+The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and
+v4l2_fh_exit(). It is set to NULL by the driver when closing the file
+handle, in vpu_v4l2_close().
+
+The vpu_notify_eos() and vpu_notify_source_change() functions are called
+in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change()
+respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is
+therefore a guarantee that no new event will be queued to the v4l2_fh
+after vpu_v4l2_close() destroys the m2m_ctx.
+
+The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(),
+which is guaranteed to be called for all queued buffers when
+vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called
+later.
+
+It is therefore safe to assume that the driver will not touch the
+v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close()
+destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh
+synchronously in vpu_v4l2_close().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index f0b1ec79d2961..7f66bfef2abbe 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -709,8 +709,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)
+ 
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ 	mutex_destroy(&inst->lock);
+-	v4l2_fh_del(&inst->fh);
+-	v4l2_fh_exit(&inst->fh);
+ 
+ 	call_void_vop(inst, cleanup);
+ 
+@@ -779,6 +777,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
+ 
+ 	return 0;
+ error:
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
+ 	vpu_inst_put(inst);
+ 	return ret;
+ }
+@@ -798,6 +798,9 @@ int vpu_v4l2_close(struct file *file)
+ 	call_void_vop(inst, release);
+ 	vpu_inst_unlock(inst);
+ 
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
++
+ 	vpu_inst_unregister(inst);
+ 	vpu_inst_put(inst);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-fix-uninitialized-symbol-warnings.patch b/queue-6.12/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..6f39fbadc5
--- /dev/null
+++ b/queue-6.12/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 89fc73b8e0f5432bf946fde33f689f8f94b85430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index c84e1e0e6109a..5588cdd7ec20d 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 3cf54d776d36c..b44c97e4e5ec6 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch b/queue-6.12/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
new file mode 100644
index 0000000000..32715c5128
--- /dev/null
+++ b/queue-6.12/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
@@ -0,0 +1,42 @@
+From 851ae5785e85533cac29719c4fec7d5c033f543b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 15:23:56 +0200
+Subject: media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for
+ VIDEO_CAMERA_SENSOR
+
+From: Mehdi Djait <mehdi.djait@linux.intel.com>
+
+[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
+
+Both ACPI and DT-based systems are required to obtain the external
+camera sensor clock using the new devm_v4l2_sensor_clk_get() helper
+function.
+
+Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is
+enabled.
+
+Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 85ecb2aeefdbf..5cb596f38de33 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -27,7 +27,7 @@ config VIDEO_IR_I2C
+ 
+ menuconfig VIDEO_CAMERA_SENSOR
+ 	bool "Camera sensor devices"
+-	depends on MEDIA_CAMERA_SUPPORT && I2C
++	depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK
+ 	select MEDIA_CONTROLLER
+ 	select V4L2_FWNODE
+ 	select VIDEO_V4L2_SUBDEV_API
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch b/queue-6.12/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
new file mode 100644
index 0000000000..c401742868
--- /dev/null
+++ b/queue-6.12/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
@@ -0,0 +1,59 @@
+From 29758735b81ea80f3f4dca88036225e329dbb8e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 16:22:06 +0300
+Subject: media: i2c: og01a1b: Specify monochrome media bus format instead of
+ Bayer
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
+
+The OmniVision OG01A1B image sensor is a monochrome sensor, it supports
+8-bit and 10-bit RAW output formats only.
+
+That said the planar greyscale Y8/Y10 media formats are more appropriate
+for the sensor instead of the originally and arbitrary selected SGRBG one,
+since there is no red, green or blue color components.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/og01a1b.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
+index 78d5d406e4b72..b7d0b677975d5 100644
+--- a/drivers/media/i2c/og01a1b.c
++++ b/drivers/media/i2c/og01a1b.c
+@@ -682,7 +682,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode,
+ {
+ 	fmt->width = mode->width;
+ 	fmt->height = mode->height;
+-	fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->code = MEDIA_BUS_FMT_Y10_1X10;
+ 	fmt->field = V4L2_FIELD_NONE;
+ }
+ 
+@@ -828,7 +828,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = MEDIA_BUS_FMT_Y10_1X10;
+ 
+ 	return 0;
+ }
+@@ -840,7 +840,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,
+ 	if (fse->index >= ARRAY_SIZE(supported_modes))
+ 		return -EINVAL;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = supported_modes[fse->index].width;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-imon-make-send_packet-more-robust.patch b/queue-6.12/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..91603e8014
--- /dev/null
+++ b/queue-6.12/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 8102fdde13cc7f4776935cc18d8814e0bf0e39c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index 1e7f800701331..ddb1304cb77b8 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-ipu6-isys-set-embedded-data-type-correctly-for.patch b/queue-6.12/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
new file mode 100644
index 0000000000..e8f9a69eec
--- /dev/null
+++ b/queue-6.12/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
@@ -0,0 +1,40 @@
+From 99af84f2fdd53648bfbb18eb104a34eb16dc2b3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 11:06:16 +0300
+Subject: media: ipu6: isys: Set embedded data type correctly for metadata
+ formats
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit f5a2826cd50c6fd1af803812d1d910a64ae8e0a1 ]
+
+The IPU6 ISYS driver supported metadata formats but was missing correct
+embedded data type in the receiver configuration. Add it now.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c b/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
+index 0a06de5c739c7..463a0adf9e131 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
+@@ -81,6 +81,12 @@ unsigned int ipu6_isys_mbus_code_to_mipi(u32 code)
+ 	case MEDIA_BUS_FMT_SGRBG8_1X8:
+ 	case MEDIA_BUS_FMT_SRGGB8_1X8:
+ 		return MIPI_CSI2_DT_RAW8;
++	case MEDIA_BUS_FMT_META_8:
++	case MEDIA_BUS_FMT_META_10:
++	case MEDIA_BUS_FMT_META_12:
++	case MEDIA_BUS_FMT_META_16:
++	case MEDIA_BUS_FMT_META_24:
++		return MIPI_CSI2_DT_EMBEDDED_8B;
+ 	default:
+ 		/* return unavailable MIPI data type - 0x3f */
+ 		WARN_ON(1);
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-ov08x40-fix-the-horizontal-flip-control.patch b/queue-6.12/media-ov08x40-fix-the-horizontal-flip-control.patch
new file mode 100644
index 0000000000..85bc25b995
--- /dev/null
+++ b/queue-6.12/media-ov08x40-fix-the-horizontal-flip-control.patch
@@ -0,0 +1,39 @@
+From 7923d31912eabb87d1c0b0d70524dbdc927cdeb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:33:25 +0800
+Subject: media: ov08x40: Fix the horizontal flip control
+
+From: Hao Yao <hao.yao@intel.com>
+
+[ Upstream commit c7df6f339af94689fdc433887f9fbb480bf8a4ed ]
+
+The datasheet of ov08x40 doesn't match the hardware behavior.
+0x3821[2] == 1 is the original state and 0 the horizontal flip enabled.
+
+Signed-off-by: Hao Yao <hao.yao@intel.com>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Tested-by: Hans de Goede <hansg@kernel.org> # ThinkPad X1 Carbon Gen 12 & Gen 13
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov08x40.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov08x40.c b/drivers/media/i2c/ov08x40.c
+index 1fe8e9b584f80..83a957182cb5f 100644
+--- a/drivers/media/i2c/ov08x40.c
++++ b/drivers/media/i2c/ov08x40.c
+@@ -1564,7 +1564,7 @@ static int ov08x40_set_ctrl_hflip(struct ov08x40 *ov08x, u32 ctrl_val)
+ 
+ 	return ov08x40_write_reg(ov08x, OV08X40_REG_MIRROR,
+ 				 OV08X40_REG_VALUE_08BIT,
+-				 ctrl_val ? val | BIT(2) : val & ~BIT(2));
++				 ctrl_val ? val & ~BIT(2) : val | BIT(2));
+ }
+ 
+ static int ov08x40_set_ctrl_vflip(struct ov08x40 *ov08x, u32 ctrl_val)
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-6.12/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..08ac238d86
--- /dev/null
+++ b/queue-6.12/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From 0b6498d781982b6071d16bc202ba7d5ee935a592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index a6ffa99e16bc6..83818048f7fe4 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -322,6 +322,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -331,7 +332,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index cfa28d0355863..1ac8d691df5cd 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -39,16 +39,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -56,7 +56,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -94,7 +94,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -126,7 +126,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -359,7 +359,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -831,7 +831,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -915,7 +915,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch b/queue-6.12/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
new file mode 100644
index 0000000000..3d7dbadf6d
--- /dev/null
+++ b/queue-6.12/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
@@ -0,0 +1,40 @@
+From 9018690870b58425e64673cac0679741a25cab93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:29 +0200
+Subject: media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Tůma <martin.tuma@digiteqautomotive.com>
+
+[ Upstream commit 0750649b528ff18d1d68aecb45b34ec22d5ab778 ]
+
+Compare the whole v4l2_bt_timings struct, not just the width/height when
+setting new timings. Timings with the same resolution and different
+pixelclock can now be properly set.
+
+Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/mgb4/mgb4_vin.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/mgb4/mgb4_vin.c b/drivers/media/pci/mgb4/mgb4_vin.c
+index e9332abb31729..cfb6be8a81669 100644
+--- a/drivers/media/pci/mgb4/mgb4_vin.c
++++ b/drivers/media/pci/mgb4/mgb4_vin.c
+@@ -624,8 +624,7 @@ static int vidioc_s_dv_timings(struct file *file, void *fh,
+ 	    timings->bt.height < video_timings_cap.bt.min_height ||
+ 	    timings->bt.height > video_timings_cap.bt.max_height)
+ 		return -EINVAL;
+-	if (timings->bt.width == vindev->timings.bt.width &&
+-	    timings->bt.height == vindev->timings.bt.height)
++	if (v4l2_match_dv_timings(timings, &vindev->timings, 0, false))
+ 		return 0;
+ 	if (vb2_is_busy(&vindev->queue))
+ 		return -EBUSY;
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-6.12/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..07f369ab18
--- /dev/null
+++ b/queue-6.12/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From deb790d01acc639731c44bfcf2b2ab2c4407e45b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index d89a4cfe3c895..a49173f54a4d0 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-6.12/media-verisilicon-explicitly-disable-selection-api-i.patch b/queue-6.12/media-verisilicon-explicitly-disable-selection-api-i.patch
new file mode 100644
index 0000000000..ffc0eebc9d
--- /dev/null
+++ b/queue-6.12/media-verisilicon-explicitly-disable-selection-api-i.patch
@@ -0,0 +1,64 @@
+From d2f360af59da365de4c85adefdb7b8740f2b18f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:49:18 +0200
+Subject: media: verisilicon: Explicitly disable selection api ioctls for
+ decoders
+
+From: Paul Kocialkowski <paulk@sys-base.io>
+
+[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
+
+Call the dedicated v4l2_disable_ioctl helper instead of manually
+checking whether the current context is an encoder for the selection
+api ioctls.
+
+Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index 05bbac853c4fd..137ca13eeed7c 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -918,6 +918,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+ 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION);
+ 	}
+ 
+ 	video_set_drvdata(vfd, vpu);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index 62d3962c18d99..c847c8284ab54 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -633,8 +633,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
+ 	struct hantro_ctx *ctx = fh_to_ctx(priv);
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	switch (sel->target) {
+@@ -666,8 +665,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
+ 	struct vb2_queue *vq;
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	/* Change not allowed if the queue is streaming. */
+-- 
+2.51.0
+
diff --git a/queue-6.12/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch b/queue-6.12/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
new file mode 100644
index 0000000000..09f65e0881
--- /dev/null
+++ b/queue-6.12/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
@@ -0,0 +1,44 @@
+From b4597d9dbed6e68f28cb02bfc50a6634ee1f5150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:15:49 +0530
+Subject: microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl
+ support
+
+From: Parthiban Veerasooran <parthiban.veerasooran@microchip.com>
+
+[ Upstream commit 34c21e91192aa1ff66f9d6cef8132717840d04e6 ]
+
+Introduce support for standard MII ioctl operations in the LAN865x
+Ethernet driver by implementing the .ndo_eth_ioctl callback. This allows
+PHY-related ioctl commands to be handled via phy_do_ioctl_running() and
+enables support for ethtool and other user-space tools that rely on ioctl
+interface to perform PHY register access using commands like SIOCGMIIREG
+and SIOCSMIIREG.
+
+This feature enables improved diagnostics and PHY configuration
+capabilities from userspace.
+
+Signed-off-by: Parthiban Veerasooran <parthiban.veerasooran@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250828114549.46116-1-parthiban.veerasooran@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan865x/lan865x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/microchip/lan865x/lan865x.c b/drivers/net/ethernet/microchip/lan865x/lan865x.c
+index 79b800d2b72c2..b428ad6516c5e 100644
+--- a/drivers/net/ethernet/microchip/lan865x/lan865x.c
++++ b/drivers/net/ethernet/microchip/lan865x/lan865x.c
+@@ -326,6 +326,7 @@ static const struct net_device_ops lan865x_netdev_ops = {
+ 	.ndo_start_xmit		= lan865x_send_packet,
+ 	.ndo_set_rx_mode	= lan865x_set_multicast_list,
+ 	.ndo_set_mac_address	= lan865x_set_mac_address,
++	.ndo_eth_ioctl          = phy_do_ioctl_running,
+ };
+ 
+ static int lan865x_probe(struct spi_device *spi)
+-- 
+2.51.0
+
diff --git a/queue-6.12/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-6.12/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..101cd1867e
--- /dev/null
+++ b/queue-6.12/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From 0dfa7a96dbe7f9274c162cb5dde2ec8a944c6143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 0a942bc091436..650400bd5725f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -104,6 +104,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.12/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-6.12/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..0aa1bd2de8
--- /dev/null
+++ b/queue-6.12/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From 5f03cd2c60257fca94cb71da96fa0dce00561ecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 7a7ba66aa5349..0a942bc091436 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/mips-lantiq-danube-add-model-to-easy50712-dts.patch b/queue-6.12/mips-lantiq-danube-add-model-to-easy50712-dts.patch
new file mode 100644
index 0000000000..c8bcb28dd5
--- /dev/null
+++ b/queue-6.12/mips-lantiq-danube-add-model-to-easy50712-dts.patch
@@ -0,0 +1,36 @@
+From 3bde6216a1d5cd556acc0e81d747f3f9e00555ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:06:04 +0200
+Subject: mips: lantiq: danube: add model to EASY50712 dts
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
+	from schema $id: http://devicetree.org/schemas/root-node.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index c4d7aa5753b04..ab70028dbefcf 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -4,6 +4,8 @@
+ /include/ "danube.dtsi"
+ 
+ / {
++	model = "Intel EASY50712";
++
+ 	chosen {
+ 		bootargs = "console=ttyLTQ0,115200 init=/etc/preinit";
+ 	};
+-- 
+2.51.0
+
diff --git a/queue-6.12/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch b/queue-6.12/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
new file mode 100644
index 0000000000..aadabdb88b
--- /dev/null
+++ b/queue-6.12/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
@@ -0,0 +1,36 @@
+From bca0f121dfe6eb49aada0e788f663569cc743cfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:24 +0200
+Subject: mips: lantiq: danube: rename stp node on EASY50712 reference board
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
+	from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index ab70028dbefcf..c9f7886f57b8c 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -96,7 +96,7 @@
+ 			lantiq,tx-burst-length = <4>;
+ 		};
+ 
+-		stp0: stp@e100bb0 {
++		stp0: gpio@e100bb0 {
+ 			#gpio-cells = <2>;
+ 			compatible = "lantiq,gpio-stp-xway";
+ 			gpio-controller;
+-- 
+2.51.0
+
diff --git a/queue-6.12/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-6.12/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..daacfe44ad
--- /dev/null
+++ b/queue-6.12/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From c2b3215c808dda0d31dccc5d2c380b2b315c9447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 6031a0272d874..d9aa80afdf9d6 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -485,7 +485,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch b/queue-6.12/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
new file mode 100644
index 0000000000..8d8b07e1f5
--- /dev/null
+++ b/queue-6.12/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
@@ -0,0 +1,82 @@
+From 36dd30fcb29c3e59ac54f32b143a48e5579ae8d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:14:48 +0200
+Subject: net: bridge: Install FDB for bridge MAC on VLAN 0
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
+
+Currently, after the bridge is created, the FDB does not hold an FDB entry
+for the bridge MAC on VLAN 0:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb show | grep 92:19:8c:4e:01:ed
+ 92:19:8c:4e:01:ed dev br vlan 1 master br permanent
+
+Later when the bridge MAC is changed, or in fact when the address is given
+during netdevice creation, the entry appears:
+
+ # ip link add name br up address 00:11:22:33:44:55 type bridge
+ # bridge fdb show | grep 00:11:22:33:44:55
+ 00:11:22:33:44:55 dev br vlan 1 master br permanent
+ 00:11:22:33:44:55 dev br master br permanent
+
+However when the bridge address is set by the user to the current bridge
+address before the first port is enslaved, none of the address handlers
+gets invoked, because the address is not actually changed. The address is
+however marked as NET_ADDR_SET. Then when a port is enslaved, the address
+is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not
+added, and it has not been added previously either:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # ip link set dev br addr 7e:f0:a8:1a:be:c2
+ # ip link add name v up type veth
+ # ip link set dev v master br
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb | grep 7e:f0:a8:1a:be:c2
+ 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
+
+Then when the bridge MAC is used as DMAC, and br_handle_frame_finish()
+looks up an FDB entry with VLAN=0, it doesn't find any, and floods the
+traffic instead of passing it up.
+
+Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always
+on netdevice creation. This also makes the behavior consistent with how
+ports are treated: ports always have an FDB entry for each member VLAN as
+well as VLAN 0.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index ed08717541fe7..35e9842f4203c 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
+ 	int err;
+ 
+ 	if (netif_is_bridge_master(dev)) {
++		struct net_bridge *br = netdev_priv(dev);
++
++		if (event == NETDEV_REGISTER)
++			br_fdb_change_mac_address(br, dev->dev_addr);
++
+ 		err = br_vlan_bridge_event(dev, event, ptr);
+ 		if (err)
+ 			return notifier_from_errno(err);
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-6.12/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..757cf4acbd
--- /dev/null
+++ b/queue-6.12/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From 0c4d4ea5627d9e93e0fb7cf196f1a4305ba2c32a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index bf31b19045243..1781f3a642b46 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3093,23 +3093,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-6.12/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..26fd12ec5f
--- /dev/null
+++ b/queue-6.12/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From 84b8aea9e1c6acc23dbed98977635dcab51f9303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index a5f248a914042..bf31b19045243 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3267,8 +3267,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 		}
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-6.12/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..cbba3e4f30
--- /dev/null
+++ b/queue-6.12/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From 6a1b0c0cd5a557822dedea949bfa54e27faf1e22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-devmem-expose-tcp_recvmsg_locked-errors.patch b/queue-6.12/net-devmem-expose-tcp_recvmsg_locked-errors.patch
new file mode 100644
index 0000000000..1880ce076c
--- /dev/null
+++ b/queue-6.12/net-devmem-expose-tcp_recvmsg_locked-errors.patch
@@ -0,0 +1,52 @@
+From d112053741bbd6e8c44e6da914cb324f60d315a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 09:24:29 -0700
+Subject: net: devmem: expose tcp_recvmsg_locked errors
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 18282100d7040614b553f1cad737cb689c04e2b9 ]
+
+tcp_recvmsg_dmabuf can export the following errors:
+- EFAULT when linear copy fails
+- ETOOSMALL when cmsg put fails
+- ENODEV if one of the frags is readable
+- ENOMEM on xarray failures
+
+But they are all ignored and replaced by EFAULT in the caller
+(tcp_recvmsg_locked). Expose real error to the userspace to
+add more transparency on what specifically fails.
+
+In non-devmem case (skb_copy_datagram_msg) doing `if (!copied)
+copied=-EFAULT` is ok because skb_copy_datagram_msg can return only EFAULT.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250910162429.4127997-1-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 795ffa62cc0e6..ad5f30cefdf96 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2780,9 +2780,9 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len,
+ 
+ 				err = tcp_recvmsg_dmabuf(sk, skb, offset, msg,
+ 							 used);
+-				if (err <= 0) {
++				if (err < 0) {
+ 					if (!copied)
+-						copied = -EFAULT;
++						copied = err;
+ 
+ 					break;
+ 				}
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-dsa-felix-support-phy-mode-10g-qxgmii.patch b/queue-6.12/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
new file mode 100644
index 0000000000..9317e7dcca
--- /dev/null
+++ b/queue-6.12/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
@@ -0,0 +1,98 @@
+From 3fcf0b8904ab810fed72ff5ca10007c4c3c1353d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 16:07:26 +0300
+Subject: net: dsa: felix: support phy-mode = "10g-qxgmii"
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6f616757dd306fce4b55131df23737732e347d8f ]
+
+The "usxgmii" phy-mode that the Felix switch ports support on LS1028A is
+not quite USXGMII, it is defined by the USXGMII multiport specification
+document as 10G-QXGMII. It uses the same signaling as USXGMII, but it
+multiplexes 4 ports over the link, resulting in a maximum speed of 2.5G
+per port.
+
+This change is needed in preparation for the lynx-10g SerDes driver on
+LS1028A, which will make a more clear distinction between usxgmii
+(supported on lane 0) and 10g-qxgmii (supported on lane 1). These
+protocols have their configuration in different PCCR registers (PCCRB vs
+PCCR9).
+
+Continue parsing and supporting single-port-per-lane USXGMII when found
+in the device tree as usual (because it works), but add support for
+10G-QXGMII too. Using phy-mode = "10g-qxgmii" will be required when
+modifying the device trees to specify a "phys" phandle to the SerDes
+lane. The result when the "phys" phandle is present but the phy-mode is
+wrong is undefined.
+
+The only PHY driver in known use with this phy-mode, AQR412C, will gain
+logic to transition from "usxgmii" to "10g-qxgmii" in a future change.
+Prepare the driver by also setting PHY_INTERFACE_MODE_10G_QXGMII in
+supported_interfaces when PHY_INTERFACE_MODE_USXGMII is there, to
+prevent breakage with existing device trees.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250903130730.2836022-3-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c         | 4 ++++
+ drivers/net/dsa/ocelot/felix.h         | 3 ++-
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 3 ++-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 3aa9c997018a5..72fb6594331e9 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -1153,6 +1153,9 @@ static void felix_phylink_get_caps(struct dsa_switch *ds, int port,
+ 
+ 	__set_bit(ocelot->ports[port]->phy_mode,
+ 		  config->supported_interfaces);
++	if (ocelot->ports[port]->phy_mode == PHY_INTERFACE_MODE_USXGMII)
++		__set_bit(PHY_INTERFACE_MODE_10G_QXGMII,
++			  config->supported_interfaces);
+ }
+ 
+ static void felix_phylink_mac_config(struct phylink_config *config,
+@@ -1351,6 +1354,7 @@ static const u32 felix_phy_match_table[PHY_INTERFACE_MODE_MAX] = {
+ 	[PHY_INTERFACE_MODE_SGMII] = OCELOT_PORT_MODE_SGMII,
+ 	[PHY_INTERFACE_MODE_QSGMII] = OCELOT_PORT_MODE_QSGMII,
+ 	[PHY_INTERFACE_MODE_USXGMII] = OCELOT_PORT_MODE_USXGMII,
++	[PHY_INTERFACE_MODE_10G_QXGMII] = OCELOT_PORT_MODE_10G_QXGMII,
+ 	[PHY_INTERFACE_MODE_1000BASEX] = OCELOT_PORT_MODE_1000BASEX,
+ 	[PHY_INTERFACE_MODE_2500BASEX] = OCELOT_PORT_MODE_2500BASEX,
+ };
+diff --git a/drivers/net/dsa/ocelot/felix.h b/drivers/net/dsa/ocelot/felix.h
+index 211991f494e35..a657b190c5d7b 100644
+--- a/drivers/net/dsa/ocelot/felix.h
++++ b/drivers/net/dsa/ocelot/felix.h
+@@ -12,8 +12,9 @@
+ #define OCELOT_PORT_MODE_SGMII		BIT(1)
+ #define OCELOT_PORT_MODE_QSGMII		BIT(2)
+ #define OCELOT_PORT_MODE_2500BASEX	BIT(3)
+-#define OCELOT_PORT_MODE_USXGMII	BIT(4)
++#define OCELOT_PORT_MODE_USXGMII	BIT(4) /* compatibility */
+ #define OCELOT_PORT_MODE_1000BASEX	BIT(5)
++#define OCELOT_PORT_MODE_10G_QXGMII	BIT(6)
+ 
+ struct device_node;
+ 
+diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
+index 7b35d24c38d76..8cf4c89865876 100644
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -34,7 +34,8 @@
+ 					 OCELOT_PORT_MODE_QSGMII | \
+ 					 OCELOT_PORT_MODE_1000BASEX | \
+ 					 OCELOT_PORT_MODE_2500BASEX | \
+-					 OCELOT_PORT_MODE_USXGMII)
++					 OCELOT_PORT_MODE_USXGMII | \
++					 OCELOT_PORT_MODE_10G_QXGMII)
+ 
+ static const u32 vsc9959_port_modes[VSC9959_NUM_PORTS] = {
+ 	VSC9959_PORT_MODE_SERDES,
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch b/queue-6.12/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
new file mode 100644
index 0000000000..5dfcd54c33
--- /dev/null
+++ b/queue-6.12/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
@@ -0,0 +1,106 @@
+From 124a5d482c861ec1f7c71108fe609992de17a8ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:33:52 +0200
+Subject: net: dsa: microchip: Set SPI as bus interface during reset for
+ KSZ8463
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit a0b977a3d19368b235f2a6c06e800fb25452029b ]
+
+At reset, the KSZ8463 uses a strap-based configuration to set SPI as
+bus interface. SPI is the only bus supported by the driver. If the
+required pull-ups/pull-downs are missing (by mistake or by design to
+save power) the pins may float and the configuration can go wrong
+preventing any communication with the switch.
+
+Introduce a ksz8463_configure_straps_spi() function called during the
+device reset. It relies on the 'straps-rxd-gpios' OF property and the
+'reset' pinmux configuration to enforce SPI as bus interface.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-3-16662e881728@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 45 ++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 0a34fd6887fc0..1da2310442fc5 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -23,6 +23,7 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/micrel_phy.h>
++#include <linux/pinctrl/consumer.h>
+ #include <net/dsa.h>
+ #include <net/ieee8021q.h>
+ #include <net/pkt_cls.h>
+@@ -4715,6 +4716,38 @@ static int ksz_parse_drive_strength(struct ksz_device *dev)
+ 	return 0;
+ }
+ 
++static int ksz8463_configure_straps_spi(struct ksz_device *dev)
++{
++	struct pinctrl *pinctrl;
++	struct gpio_desc *rxd0;
++	struct gpio_desc *rxd1;
++
++	rxd0 = devm_gpiod_get_index_optional(dev->dev, "straps-rxd", 0, GPIOD_OUT_LOW);
++	if (IS_ERR(rxd0))
++		return PTR_ERR(rxd0);
++
++	rxd1 = devm_gpiod_get_index_optional(dev->dev, "straps-rxd", 1, GPIOD_OUT_HIGH);
++	if (IS_ERR(rxd1))
++		return PTR_ERR(rxd1);
++
++	if (!rxd0 && !rxd1)
++		return 0;
++
++	if ((rxd0 && !rxd1) || (rxd1 && !rxd0))
++		return -EINVAL;
++
++	pinctrl = devm_pinctrl_get_select(dev->dev, "reset");
++	if (IS_ERR(pinctrl))
++		return PTR_ERR(pinctrl);
++
++	return 0;
++}
++
++static int ksz8463_release_straps_spi(struct ksz_device *dev)
++{
++	return pinctrl_select_default_state(dev->dev);
++}
++
+ int ksz_switch_register(struct ksz_device *dev)
+ {
+ 	const struct ksz_chip_data *info;
+@@ -4730,10 +4763,22 @@ int ksz_switch_register(struct ksz_device *dev)
+ 		return PTR_ERR(dev->reset_gpio);
+ 
+ 	if (dev->reset_gpio) {
++		if (of_device_is_compatible(dev->dev->of_node, "microchip,ksz8463")) {
++			ret = ksz8463_configure_straps_spi(dev);
++			if (ret)
++				return ret;
++		}
++
+ 		gpiod_set_value_cansleep(dev->reset_gpio, 1);
+ 		usleep_range(10000, 12000);
+ 		gpiod_set_value_cansleep(dev->reset_gpio, 0);
+ 		msleep(100);
++
++		if (of_device_is_compatible(dev->dev->of_node, "microchip,ksz8463")) {
++			ret = ksz8463_release_straps_spi(dev);
++			if (ret)
++				return ret;
++		}
+ 	}
+ 
+ 	mutex_init(&dev->dev_mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-ethernet-microchip-sparx5-make-it-selectable-for.patch b/queue-6.12/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
new file mode 100644
index 0000000000..b5295f0c61
--- /dev/null
+++ b/queue-6.12/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
@@ -0,0 +1,37 @@
+From 500246e2fdb04447dff5f5e64e820eec0d433f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 13:00:24 +0200
+Subject: net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
+
+LAN969x switchdev support depends on the SparX-5 core,so make it selectable
+for ARCH_LAN969X.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index 3f04992eace6a..64d774f64b12c 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -3,7 +3,7 @@ config SPARX5_SWITCH
+ 	depends on NET_SWITCHDEV
+ 	depends on HAS_IOMEM
+ 	depends on OF
+-	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
+ 	depends on PTP_1588_CLOCK_OPTIONAL
+ 	depends on BRIDGE || BRIDGE=n
+ 	select PHYLINK
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-6.12/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..a287195a69
--- /dev/null
+++ b/queue-6.12/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From 687869678b34f92882d5d5b737ce03f151710f45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index 98861cc6df7cc..797b99af0c453 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index 7fb1961f29210..6861a0bdc14e1 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch b/queue-6.12/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
new file mode 100644
index 0000000000..d70783edc1
--- /dev/null
+++ b/queue-6.12/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
@@ -0,0 +1,75 @@
+From 9928608db0ce7ef2ec04349d18c90c1f45272f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 19:46:41 +0200
+Subject: net: ipv4: allow directed broadcast routes to use dst hint
+
+From: Oscar Maes <oscmaes92@gmail.com>
+
+[ Upstream commit 1b8c5fa0cb35efd08f07f700e6d78a541ebabe26 ]
+
+Currently, ip_extract_route_hint uses RTN_BROADCAST to decide
+whether to use the route dst hint mechanism.
+
+This check is too strict, as it prevents directed broadcast
+routes from using the hint, resulting in poor performance
+during bursts of directed broadcast traffic.
+
+Fix this in ip_extract_route_hint and modify ip_route_use_hint
+to preserve the intended behaviour.
+
+Signed-off-by: Oscar Maes <oscmaes92@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250819174642.5148-2-oscmaes92@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_input.c | 11 +++++++----
+ net/ipv4/route.c    |  2 +-
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index b6e7d49213097..7b092ba6f5779 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -582,9 +582,13 @@ static void ip_sublist_rcv_finish(struct list_head *head)
+ }
+ 
+ static struct sk_buff *ip_extract_route_hint(const struct net *net,
+-					     struct sk_buff *skb, int rt_type)
++					     struct sk_buff *skb)
+ {
+-	if (fib4_has_custom_rules(net) || rt_type == RTN_BROADCAST ||
++	const struct iphdr *iph = ip_hdr(skb);
++
++	if (fib4_has_custom_rules(net) ||
++	    ipv4_is_lbcast(iph->daddr) ||
++	    ipv4_is_zeronet(iph->daddr) ||
+ 	    IPCB(skb)->flags & IPSKB_MULTIPATH)
+ 		return NULL;
+ 
+@@ -614,8 +618,7 @@ static void ip_list_rcv_finish(struct net *net, struct sock *sk,
+ 
+ 		dst = skb_dst(skb);
+ 		if (curr_dst != dst) {
+-			hint = ip_extract_route_hint(net, skb,
+-						     dst_rtable(dst)->rt_type);
++			hint = ip_extract_route_hint(net, skb);
+ 
+ 			/* dispatch old sublist */
+ 			if (!list_empty(&sublist))
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 7d04df4fc6608..96a01eb33653f 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2187,7 +2187,7 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ 	if (ipv4_is_loopback(saddr) && !IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
+ 		goto martian_source;
+ 
+-	if (rt->rt_type != RTN_LOCAL)
++	if (!(rt->rt_flags & RTCF_LOCAL))
+ 		goto skip_validate_source;
+ 
+ 	tos &= INET_DSCP_MASK;
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-6.12/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..ebc9f194b3
--- /dev/null
+++ b/queue-6.12/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From e447cdeca1f37fd49555f024358a8cfb3912c765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index eb474f0987ae0..95372e0f1d216 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -301,13 +329,7 @@ static void ah6_output_done(void *data, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -378,12 +400,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -434,13 +452,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-6.12/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..9e15414e2e
--- /dev/null
+++ b/queue-6.12/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From f90096687e73051df59036f137905a926abc543b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index f7e8c08d84415..8a53c9538b842 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -281,9 +281,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	if (gem_has_ptp(bp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch b/queue-6.12/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
new file mode 100644
index 0000000000..bce150c6bb
--- /dev/null
+++ b/queue-6.12/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
@@ -0,0 +1,66 @@
+From 599f712ce9162453361f3d45d9b3dd1ff12f7696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 12:40:34 +0000
+Subject: net/mlx5e: Don't query FEC statistics when FEC is disabled
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
+
+Update mlx5e_stats_fec_get() to check the active FEC mode and skip
+statistics collection when FEC is disabled.
+
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Yael Chemla <ychemla@nvidia.com>
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 611ec4b6f3709..2f077ad1e810b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -1413,16 +1413,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt)
+ }
+ 
+ static void fec_set_block_stats(struct mlx5e_priv *priv,
++				int mode,
+ 				struct ethtool_fec_stats *fec_stats)
+ {
+ 	struct mlx5_core_dev *mdev = priv->mdev;
+ 	u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+-	int mode = fec_active_mode(mdev);
+-
+-	if (mode == MLX5E_FEC_NOFEC)
+-		return;
+ 
+ 	MLX5_SET(ppcnt_reg, in, local_port, 1);
+ 	MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP);
+@@ -1463,11 +1460,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,
+ void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
+ 			 struct ethtool_fec_stats *fec_stats)
+ {
+-	if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
++	int mode = fec_active_mode(priv->mdev);
++
++	if (mode == MLX5E_FEC_NOFEC ||
++	    !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
+ 		return;
+ 
+ 	fec_set_corrected_bits_total(priv, fec_stats);
+-	fec_set_block_stats(priv, fec_stats);
++	fec_set_block_stats(priv, mode, fec_stats);
+ }
+ 
+ #define PPORT_ETH_EXT_OFF(c) \
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-6.12/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..9fbcd0a1b1
--- /dev/null
+++ b/queue-6.12/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From afe5309ba6dc991c95217db0b1e1f511df330a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index ea8595651c384..e066bdbc807be 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-phy-clear-link-parameters-on-admin-link-down.patch b/queue-6.12/net-phy-clear-link-parameters-on-admin-link-down.patch
new file mode 100644
index 0000000000..3e3801b89b
--- /dev/null
+++ b/queue-6.12/net-phy-clear-link-parameters-on-admin-link-down.patch
@@ -0,0 +1,62 @@
+From c7502c468a67b282221737afed2f705f7c21cd9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:47:51 +0200
+Subject: net: phy: clear link parameters on admin link down
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 60f887b1290b43a4f5a3497982a725687b193fa4 ]
+
+When a PHY is halted (e.g. `ip link set dev lan2 down`), several
+fields in struct phy_device may still reflect the last active
+connection. This leads to ethtool showing stale values even though
+the link is down.
+
+Reset selected fields in _phy_state_machine() when transitioning
+to PHY_HALTED and the link was previously up:
+
+- speed/duplex -> UNKNOWN, but only in autoneg mode (in forced mode
+  these fields carry configuration, not status)
+- master_slave_state -> UNKNOWN if previously supported
+- mdix -> INVALID (state only, same meaning as "unknown")
+- lp_advertising -> always cleared
+
+The cleanup is skipped if the PHY is in PHY_ERROR state, so the
+last values remain available for diagnostics.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250917094751.2101285-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index c9cfdc33fc5f1..707a6ff5242bd 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1477,6 +1477,19 @@ static enum phy_state_work _phy_state_machine(struct phy_device *phydev)
+ 		}
+ 		break;
+ 	case PHY_HALTED:
++		if (phydev->link) {
++			if (phydev->autoneg == AUTONEG_ENABLE) {
++				phydev->speed = SPEED_UNKNOWN;
++				phydev->duplex = DUPLEX_UNKNOWN;
++			}
++			if (phydev->master_slave_state !=
++						MASTER_SLAVE_STATE_UNSUPPORTED)
++				phydev->master_slave_state =
++						MASTER_SLAVE_STATE_UNKNOWN;
++			phydev->mdix = ETH_TP_MDI_INVALID;
++			linkmode_zero(phydev->lp_advertising);
++		}
++		fallthrough;
+ 	case PHY_ERROR:
+ 		if (phydev->link) {
+ 			phydev->link = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch b/queue-6.12/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
new file mode 100644
index 0000000000..62cf6c9744
--- /dev/null
+++ b/queue-6.12/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
@@ -0,0 +1,74 @@
+From 99610c32021e44d14d8c298c4a622dc988fcfff0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 23:25:05 +0200
+Subject: net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
+
+fixed_phy_register() creates and registers the phy_device. To be
+symmetric, we should not only unregister, but also free the phy_device
+in fixed_phy_unregister(). This allows to simplify code in users.
+
+Note wrt of_phy_deregister_fixed_link():
+put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/dsa_loop.c  | 9 +++------
+ drivers/net/mdio/of_mdio.c  | 1 -
+ drivers/net/phy/fixed_phy.c | 1 +
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index c70ed67cc1888..5c7f40acfa391 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -387,13 +387,10 @@ static struct mdio_driver dsa_loop_drv = {
+ 
+ static void dsa_loop_phydevs_unregister(void)
+ {
+-	unsigned int i;
+-
+-	for (i = 0; i < NUM_FIXED_PHYS; i++)
+-		if (!IS_ERR(phydevs[i])) {
++	for (int i = 0; i < NUM_FIXED_PHYS; i++) {
++		if (!IS_ERR(phydevs[i]))
+ 			fixed_phy_unregister(phydevs[i]);
+-			phy_device_free(phydevs[i]);
+-		}
++	}
+ }
+ 
+ static int __init dsa_loop_init(void)
+diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
+index 2f4fc664d2e12..cc6ae8f35b1c2 100644
+--- a/drivers/net/mdio/of_mdio.c
++++ b/drivers/net/mdio/of_mdio.c
+@@ -473,6 +473,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)
+ 	fixed_phy_unregister(phydev);
+ 
+ 	put_device(&phydev->mdio.dev);	/* of_phy_find_device() */
+-	phy_device_free(phydev);	/* fixed_phy_register() */
+ }
+ EXPORT_SYMBOL(of_phy_deregister_fixed_link);
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index aef739c20ac4d..4694fb3eaa2ff 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy)
+ 	phy_device_remove(phy);
+ 	of_node_put(phy->mdio.dev.of_node);
+ 	fixed_phy_del(phy->mdio.addr);
++	phy_device_free(phy);
+ }
+ EXPORT_SYMBOL_GPL(fixed_phy_unregister);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-6.12/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..9100b63933
--- /dev/null
+++ b/queue-6.12/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From 42380d635f5fc751c56cd6bb85778af6c27aa668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 9964bf3dea2fb..2b64a11fe9b36 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1848,6 +1848,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -3887,7 +3924,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.handle_interrupt = marvell_handle_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-6.12/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..11bf8cfa91
--- /dev/null
+++ b/queue-6.12/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From 05d4f834ac150b26c61be9960d010caed0e4d6bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index bc12c0c7347f6..b7adbd4f357e5 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2360,6 +2360,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2386,6 +2387,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2401,8 +2403,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-6.12/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..e4efde72e1
--- /dev/null
+++ b/queue-6.12/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From 357b989a41adfaf0396215569e35230b57b83b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 40d56ff66b6a8..16f76a89cb0d0 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -8030,7 +8030,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv, &priv->dma_conf);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	stmmac_set_rx_mode(ndev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch b/queue-6.12/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
new file mode 100644
index 0000000000..e500e76e7c
--- /dev/null
+++ b/queue-6.12/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
@@ -0,0 +1,49 @@
+From 87dbb9d0beeca3681f8c7626ae2f45d82dd208e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:02:15 +0200
+Subject: net: stmmac: Correctly handle Rx checksum offload errors
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit ee0aace5f844ef59335148875d05bec8764e71e8 ]
+
+The stmmac_rx function would previously set skb->ip_summed to
+CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
+and the packet was of a known IP ethertype.
+
+However, this logic failed to check if the hardware had actually
+reported a checksum error. The hardware status, indicating a header or
+payload checksum failure, was being ignored at this stage. This could
+cause corrupt packets to be passed up the network stack as valid.
+
+This patch corrects the logic by checking the `csum_none` status flag,
+which is set when the hardware reports a checksum error. If this flag
+is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
+ensuring the kernel's network stack will perform its own validation and
+properly handle the corrupt packet.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20250818090217.2789521-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 16f76a89cb0d0..04bacb04770fa 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5658,7 +5658,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 
+ 		skb->protocol = eth_type_trans(skb, priv->dev);
+ 
+-		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb))
++		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb) ||
++		    (status & csum_none))
+ 			skb_checksum_none_assert(skb);
+ 		else
+ 			skb->ip_summed = CHECKSUM_UNNECESSARY;
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-stmmac-est-drop-frames-causing-hlbs-error.patch b/queue-6.12/net-stmmac-est-drop-frames-causing-hlbs-error.patch
new file mode 100644
index 0000000000..aee24803fa
--- /dev/null
+++ b/queue-6.12/net-stmmac-est-drop-frames-causing-hlbs-error.patch
@@ -0,0 +1,92 @@
+From 1e72a96639d45d090ad78ce22967c31ce52c33ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:06:13 +0800
+Subject: net: stmmac: est: Drop frames causing HLBS error
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit 7ce48d497475d7222bd8258c5c055eb7d928793c ]
+
+Drop those frames causing Head-of-Line Blocking due to Scheduling
+(HLBS) error to avoid HLBS interrupt flooding and netdev watchdog
+timeouts due to blocked packets. Tx queues can be configured to drop
+those blocked packets by setting Drop Frames causing Scheduling Error
+(DFBS) bit of EST_CONTROL register.
+
+Also, add per queue HLBS drop count.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Furong Xu <0x1207@gmail.com>
+Link: https://patch.msgid.link/20250925-hlbs_2-v3-1-3b39472776c2@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h     | 1 +
+ drivers/net/ethernet/stmicro/stmmac/stmmac_est.c | 9 ++++++---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_est.h | 1 +
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index 684489156dcee..517e997a585b5 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -228,6 +228,7 @@ struct stmmac_extra_stats {
+ 	unsigned long mtl_est_btrlm;
+ 	unsigned long max_sdu_txq_drop[MTL_MAX_TX_QUEUES];
+ 	unsigned long mtl_est_txq_hlbf[MTL_MAX_TX_QUEUES];
++	unsigned long mtl_est_txq_hlbs[MTL_MAX_TX_QUEUES];
+ 	/* per queue statistics */
+ 	struct stmmac_txq_stats txq_stats[MTL_MAX_TX_QUEUES];
+ 	struct stmmac_rxq_stats rxq_stats[MTL_MAX_RX_QUEUES];
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+index ac6f2e3a3fcd2..4b513d27a9889 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+@@ -63,7 +63,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
+ 			 EST_GMAC5_PTOV_SHIFT;
+ 	}
+ 	if (cfg->enable)
+-		ctrl |= EST_EEST | EST_SSWL;
++		ctrl |= EST_EEST | EST_SSWL | EST_DFBS;
+ 	else
+ 		ctrl &= ~EST_EEST;
+ 
+@@ -109,6 +109,10 @@ static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,
+ 
+ 		x->mtl_est_hlbs++;
+ 
++		for (i = 0; i < txqcnt; i++)
++			if (value & BIT(i))
++				x->mtl_est_txq_hlbs[i]++;
++
+ 		/* Clear Interrupt */
+ 		writel(value, est_addr + EST_SCH_ERR);
+ 
+@@ -131,10 +135,9 @@ static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,
+ 
+ 		x->mtl_est_hlbf++;
+ 
+-		for (i = 0; i < txqcnt; i++) {
++		for (i = 0; i < txqcnt; i++)
+ 			if (feqn & BIT(i))
+ 				x->mtl_est_txq_hlbf[i]++;
+-		}
+ 
+ 		/* Clear Interrupt */
+ 		writel(feqn, est_addr + EST_FRM_SZ_ERR);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
+index 7a858c566e7e5..d71544278e1e7 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
+@@ -16,6 +16,7 @@
+ #define EST_XGMAC_PTOV_MUL		9
+ #define EST_SSWL			BIT(1)
+ #define EST_EEST			BIT(0)
++#define EST_DFBS			BIT(5)
+ 
+ #define EST_STATUS			0x00000008
+ #define EST_GMAC5_BTRL			GENMASK(11, 8)
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-wangxun-limit-tx_max_coalesced_frames_irq.patch b/queue-6.12/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
new file mode 100644
index 0000000000..4d84771ad7
--- /dev/null
+++ b/queue-6.12/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
@@ -0,0 +1,42 @@
+From 5a0d9f2ba3d326b97349ac098d63006e9fc05f01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 10:34:06 +0800
+Subject: net: wangxun: limit tx_max_coalesced_frames_irq
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+[ Upstream commit fd4aa243f154a80bbeb3dd311d2114eeb538f479 ]
+
+Add limitation on tx_max_coalesced_frames_irq as 0 ~ 65535, because
+'wx->tx_work_limit' is declared as a member of type u16.
+
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250821023408.53472-3-jiawenwu@trustnetic.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_ethtool.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
+index abe5921dde020..87c0af203dc4d 100644
+--- a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
+@@ -319,8 +319,11 @@ int wx_set_coalesce(struct net_device *netdev,
+ 			return -EOPNOTSUPP;
+ 	}
+ 
+-	if (ec->tx_max_coalesced_frames_irq)
+-		wx->tx_work_limit = ec->tx_max_coalesced_frames_irq;
++	if (ec->tx_max_coalesced_frames_irq > U16_MAX  ||
++	    !ec->tx_max_coalesced_frames_irq)
++		return -EINVAL;
++
++	wx->tx_work_limit = ec->tx_max_coalesced_frames_irq;
+ 
+ 	if (wx->mac.type == wx_mac_sp)
+ 		max_eitr = WX_SP_MAX_EITR;
+-- 
+2.51.0
+
diff --git a/queue-6.12/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-6.12/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..024aa25835
--- /dev/null
+++ b/queue-6.12/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From a3111a30ff56efd50f355ec2d711ffa1322ec4d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index c52ff9364ae8d..ee2e62ac0dcfe 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -2074,6 +2074,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch b/queue-6.12/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
new file mode 100644
index 0000000000..3b817a5b05
--- /dev/null
+++ b/queue-6.12/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
@@ -0,0 +1,129 @@
+From 918893214a8944ef0462eadcf08b6c7f44315e51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:01:02 +0200
+Subject: netfilter: nf_reject: don't reply to icmp error messages
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
+
+tcp reject code won't reply to a tcp reset.
+
+But the icmp reject 'netdev' family versions will reply to icmp
+dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
+by the inet family implementation (and internally by the REJECT target).
+
+Check for the icmp(6) type and do not respond if its an unreachable error.
+
+Without this, something like 'ip protocol icmp reject', when used
+in a netdev chain attached to 'lo', cause a packet loop.
+
+Same for two hosts that both use such a rule: each error packet
+will be replied to.
+
+Such situation persist until the (bogus) rule is amended to ratelimit or
+checks the icmp type before the reject statement.
+
+As the inet versions don't do this make the netdev ones follow along.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
+ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index 0d3cb2ba6fc84..a7a3439fe7800 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+ 
++static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
++{
++	const struct iphdr *iph = ip_hdr(skb);
++	u8 *tp, _type;
++	int thoff;
++
++	if (iph->protocol != IPPROTO_ICMP)
++		return false;
++
++	thoff = skb_network_offset(skb) + sizeof(*iph);
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmphdr, type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMP_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+ 		return NULL;
+ 
++	/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
++	if (nf_skb_is_icmp_unreach(oldskb))
++		return NULL;
++
+ 	/* RFC says return as much as we can without exceeding 576 bytes. */
+ 	len = min_t(unsigned int, 536, oldskb->len);
+ 
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index c3d64c4b69d7d..84afa0cbc9021 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+ 
++static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
++{
++	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
++	u8 proto = ip6h->nexthdr;
++	u8 _type, *tp;
++	int thoff;
++	__be16 fo;
++
++	thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
++
++	if (thoff < 0 || thoff >= skb->len || fo != 0)
++		return false;
++
++	if (proto != IPPROTO_ICMPV6)
++		return false;
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmp6hdr, icmp6_type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMPV6_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 	if (!nf_reject_ip6hdr_validate(oldskb))
+ 		return NULL;
+ 
++	/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
++	if (nf_skb_is_icmp6_unreach(oldskb))
++		return NULL;
++
+ 	/* Include "As much of invoking packet as possible without the ICMPv6
+ 	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.12/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-6.12/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..3a4efffd51
--- /dev/null
+++ b/queue-6.12/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From 635ae0b48ae4cb13fc1567c7b243cb611b30b61a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 2b71d39fe8c01..b0ba9f2bef56b 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -374,7 +374,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-6.12/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-6.12/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..7a84e67802
--- /dev/null
+++ b/queue-6.12/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From 1fbade4d82e17669077e87194438c1e051185855 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c21e63027fc0e..2b71d39fe8c01 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7823,10 +7823,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-6.12/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..f7b89015d6
--- /dev/null
+++ b/queue-6.12/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From bb4f199f8a58b6cf03fec720c7cfb5326c50fb92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 397a86011878f..946acdeaf85ad 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2745,6 +2745,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.12/ntfs3-pretend-extend-records-as-regular-files.patch b/queue-6.12/ntfs3-pretend-extend-records-as-regular-files.patch
new file mode 100644
index 0000000000..1315a2e42f
--- /dev/null
+++ b/queue-6.12/ntfs3-pretend-extend-records-as-regular-files.patch
@@ -0,0 +1,37 @@
+From 9c3cca88812e4fbe93bc3aa8dc076c3cee12c92b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:43:24 +0900
+Subject: ntfs3: pretend $Extend records as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 9077c7b627336..4e2629d020b75 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -471,6 +471,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ 		   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
+ 		/* Records in $Extend are not a files or general directories. */
+ 		inode->i_op = &ntfs_file_inode_operations;
++		mode = S_IFREG;
+ 	} else {
+ 		err = -EINVAL;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-6.12/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch b/queue-6.12/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
new file mode 100644
index 0000000000..a359a46c06
--- /dev/null
+++ b/queue-6.12/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
@@ -0,0 +1,40 @@
+From c414bb16bddf45a3f85596f7ffc3934381baa004 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 18:12:56 +0000
+Subject: openrisc: Add R_OR1K_32_PCREL relocation type module support
+
+From: chenmiao <chenmiao.ku@gmail.com>
+
+[ Upstream commit 9d0cb6d00be891586261a35da7f8c3c956825c39 ]
+
+To ensure the proper functioning of the jump_label test module, this patch
+adds support for the R_OR1K_32_PCREL relocation type for any modules. The
+implementation calculates the PC-relative offset by subtracting the
+instruction location from the target value and stores the result at the
+specified location.
+
+Signed-off-by: chenmiao <chenmiao.ku@gmail.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/module.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/openrisc/kernel/module.c b/arch/openrisc/kernel/module.c
+index c9ff4c4a0b29b..4ac4fbaa827c1 100644
+--- a/arch/openrisc/kernel/module.c
++++ b/arch/openrisc/kernel/module.c
+@@ -55,6 +55,10 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
+ 			value |= *location & 0xfc000000;
+ 			*location = value;
+ 			break;
++		case R_OR1K_32_PCREL:
++			value -= (uint32_t)location;
++			*location = value;
++			break;
+ 		case R_OR1K_AHI16:
+ 			/* Adjust the operand to match with a signed LO16.  */
+ 			value += 0x8000;
+-- 
+2.51.0
+
diff --git a/queue-6.12/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-6.12/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..7ecbab92d5
--- /dev/null
+++ b/queue-6.12/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From 8315954ad0af44ef62c0c0e7c6224bf3dfd987d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index 74ef75586f384..eee3c5ed1bbbb 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch b/queue-6.12/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
new file mode 100644
index 0000000000..ef4bd465f1
--- /dev/null
+++ b/queue-6.12/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
@@ -0,0 +1,43 @@
+From fcaa933f83c731ceef63c0c72524175b60d6188e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:17:03 -0700
+Subject: page_pool: always add GFP_NOWARN for ATOMIC allocations
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
+
+Driver authors often forget to add GFP_NOWARN for page allocation
+from the datapath. This is annoying to users as OOMs are a fact
+of life, and we pretty much expect network Rx to hit page allocation
+failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
+by default.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 6a7d740b396f6..cc0dce5246a2b 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -586,6 +586,12 @@ static noinline netmem_ref __page_pool_alloc_pages_slow(struct page_pool *pool,
+ 	netmem_ref netmem;
+ 	int i, nr_pages;
+ 
++	/* Unconditionally set NOWARN if allocating from NAPI.
++	 * Drivers forget to set it, and OOM reports on packet Rx are useless.
++	 */
++	if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
++		gfp |= __GFP_NOWARN;
++
+ 	/* Don't support bulk alloc for high-order pages */
+ 	if (unlikely(pp_order))
+ 		return page_to_netmem(__page_pool_alloc_page_order(pool, gfp));
+-- 
+2.51.0
+
diff --git a/queue-6.12/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-6.12/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..75d61d9964
--- /dev/null
+++ b/queue-6.12/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 44d055a85aa19ee3336a9012fa31c9c798f22e91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index cc0dce5246a2b..458b040a8655d 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -208,11 +208,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-6.12/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..fbc85d760d
--- /dev/null
+++ b/queue-6.12/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From 506b1a2e7bdaa0a60de6b47380d64478d999f7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 741e10a575ec7..675b7ea6ff784 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 4251fac5e3106..a1b66dbfc10f8 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -90,7 +90,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -120,7 +120,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 39ee9945c903e..c267566fa76ec 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -499,7 +499,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -507,13 +507,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-6.12/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..a8ba5a1350
--- /dev/null
+++ b/queue-6.12/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 8c7adce00e339b40d561cfd22581033beb5c91f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index db609d26811ba..aa4733787cd7e 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2719,6 +2719,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch b/queue-6.12/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
new file mode 100644
index 0000000000..1e6e80fa03
--- /dev/null
+++ b/queue-6.12/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
@@ -0,0 +1,53 @@
+From 9b92cc1253d32a5232989efce8d1712499fc8411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 18:59:15 +0200
+Subject: PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 09fefb24ed5e15f3b112f6c04b21a90ea23eaf8b ]
+
+dw_pcie_edma_irq_verify() is supposed to verify the eDMA IRQs in devicetree
+by fetching them using either 'dma' or 'dmaX' IRQ names. Former is used
+when the platform uses a single IRQ for all eDMA channels and latter is
+used when the platform uses separate IRQ per channel. But currently,
+dw_pcie_edma_irq_verify() bails out early if edma::nr_irqs is 1, i.e., when
+a single IRQ is used. This gives an impression that the driver could work
+with any single IRQ in devicetree, not necessarily with name 'dma'.
+
+But dw_pcie_edma_irq_vector(), which actually requests the IRQ, does
+require the single IRQ to be named as 'dma'. So this creates inconsistency
+between dw_pcie_edma_irq_verify() and dw_pcie_edma_irq_vector().
+
+Thus, to fix this inconsistency, make sure dw_pcie_edma_irq_verify() also
+verifies the single IRQ name by removing the bail out code.
+
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: fix typos]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250908165914.547002-3-cassel@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
+index f9473b8160778..f7d10cb788e0e 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.c
++++ b/drivers/pci/controller/dwc/pcie-designware.c
+@@ -978,9 +978,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)
+ 	char name[6];
+ 	int ret;
+ 
+-	if (pci->edma.nr_irqs == 1)
+-		return 0;
+-	else if (pci->edma.nr_irqs > 1)
++	if (pci->edma.nr_irqs > 1)
+ 		return pci->edma.nr_irqs != ch_cnt ? -EINVAL : 0;
+ 
+ 	ret = platform_get_irq_byname_optional(pdev, "dma");
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch b/queue-6.12/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
new file mode 100644
index 0000000000..4d74d6c0d2
--- /dev/null
+++ b/queue-6.12/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
@@ -0,0 +1,58 @@
+From 55089107c4aacf70d286a9116b2e1d69ab77537d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 20:42:10 +0200
+Subject: PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit d5f6bd3ee3f5048f272182dc91675c082773999e ]
+
+Currently, the test allocates BAR sizes according to fixed table bar_size.
+This does not work with controllers which have fixed size BARs that are
+smaller than the requested BAR size. One such controller is Renesas R-Car
+V4H PCIe controller, which has BAR4 size limited to 256 bytes, which is
+much less than one of the BAR size, 131072 currently requested by this
+test. A lot of controllers drivers in-tree have fixed size BARs, and they
+do work perfectly fine, but it is only because their fixed size is larger
+than the size requested by pci-epf-test.c
+
+Adjust the test such that in case a fixed size BAR is detected, the fixed
+BAR size is used, as that is the only possible option.
+
+This helps with test failures reported as follows:
+
+  pci_epf_test pci_epf_test.0: requested BAR size is larger than fixed size
+  pci_epf_test pci_epf_test.0: Failed to allocate space for BAR4
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250905184240.144431-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index eeb7fbc2d67a5..a1aa54e97ca39 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -860,7 +860,12 @@ static int pci_epf_test_alloc_space(struct pci_epf *epf)
+ 		if (bar == test_reg_bar)
+ 			continue;
+ 
+-		base = pci_epf_alloc_space(epf, bar_size[bar], bar,
++		if (epc_features->bar[bar].type == BAR_FIXED)
++			test_reg_size = epc_features->bar[bar].fixed_size;
++		else
++			test_reg_size = bar_size[bar];
++
++		base = pci_epf_alloc_space(epf, test_reg_size, bar,
+ 					   epc_features, PRIMARY_INTERFACE);
+ 		if (!base)
+ 			dev_err(dev, "Failed to allocate space for BAR%d\n",
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-err-update-device-error_state-already-after-rese.patch b/queue-6.12/pci-err-update-device-error_state-already-after-rese.patch
new file mode 100644
index 0000000000..5c75a78b5a
--- /dev/null
+++ b/queue-6.12/pci-err-update-device-error_state-already-after-rese.patch
@@ -0,0 +1,107 @@
+From 92680417cada8652de6dbc8c0cb55e00e6ef7247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 07:11:04 +0200
+Subject: PCI/ERR: Update device error_state already after reset
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 45bc82563d5505327d97963bc54d3709939fa8f8 ]
+
+After a Fatal Error has been reported by a device and has been recovered
+through a Secondary Bus Reset, AER updates the device's error_state to
+pci_channel_io_normal before invoking its driver's ->resume() callback.
+
+By contrast, EEH updates the error_state earlier, namely after resetting
+the device and before invoking its driver's ->slot_reset() callback.
+Commit c58dc575f3c8 ("powerpc/pseries: Set error_state to
+pci_channel_io_normal in eeh_report_reset()") explains in great detail
+that the earlier invocation is necessitated by various drivers checking
+accessibility of the device with pci_channel_offline() and avoiding
+accesses if it returns true.  It returns true for any other error_state
+than pci_channel_io_normal.
+
+The device should be accessible already after reset, hence the reasoning
+is that it's safe to update the error_state immediately afterwards.
+
+This deviation between AER and EEH seems problematic because drivers
+behave differently depending on which error recovery mechanism the
+platform uses.  Three drivers have gone so far as to update the
+error_state themselves, presumably to work around AER's behavior.
+
+For consistency, amend AER to update the error_state at the same recovery
+steps as EEH.  Drop the now unnecessary workaround from the three drivers.
+
+Keep updating the error_state before ->resume() in case ->error_detected()
+or ->mmio_enabled() return PCI_ERS_RESULT_RECOVERED, which causes
+->slot_reset() to be skipped.  There are drivers doing this even for Fatal
+Errors, e.g. mhi_pci_error_detected().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/4517af6359ffb9d66152b827a5d2833459144e3f.1755008151.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 1 -
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c    | 2 --
+ drivers/pci/pcie/err.c                              | 3 ++-
+ drivers/scsi/qla2xxx/qla_os.c                       | 5 -----
+ 4 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index d7cdea8f604d0..91e7b38143ead 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -4215,7 +4215,6 @@ static pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *pdev)
+ 	struct qlcnic_adapter *adapter = pci_get_drvdata(pdev);
+ 	int err = 0;
+ 
+-	pdev->error_state = pci_channel_io_normal;
+ 	err = pci_enable_device(pdev);
+ 	if (err)
+ 		goto disconnect;
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index b3588a1ebc25f..5e170400c61b9 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -3767,8 +3767,6 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
+ 	struct qlcnic_adapter *adapter = pci_get_drvdata(pdev);
+ 	struct net_device *netdev = adapter->netdev;
+ 
+-	pdev->error_state = pci_channel_io_normal;
+-
+ 	err = pci_enable_device(pdev);
+ 	if (err)
+ 		return err;
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index 628d192de90b2..e277f3735fe65 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -141,7 +141,8 @@ static int report_slot_reset(struct pci_dev *dev, void *data)
+ 
+ 	device_lock(&dev->dev);
+ 	pdrv = dev->driver;
+-	if (!pdrv || !pdrv->err_handler || !pdrv->err_handler->slot_reset)
++	if (!pci_dev_set_io_state(dev, pci_channel_io_normal) ||
++	    !pdrv || !pdrv->err_handler || !pdrv->err_handler->slot_reset)
+ 		goto out;
+ 
+ 	err_handler = pdrv->err_handler;
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 31535beaaa161..81c76678f25a8 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -7895,11 +7895,6 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
+ 	       "Slot Reset.\n");
+ 
+ 	ha->pci_error_state = QLA_PCI_SLOT_RESET;
+-	/* Workaround: qla2xxx driver which access hardware earlier
+-	 * needs error state to be pci_channel_io_online.
+-	 * Otherwise mailbox command timesout.
+-	 */
+-	pdev->error_state = pci_channel_io_normal;
+ 
+ 	pci_restore_state(pdev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-imx6-enable-the-vaux-supply-if-available.patch b/queue-6.12/pci-imx6-enable-the-vaux-supply-if-available.patch
new file mode 100644
index 0000000000..a19a7230d3
--- /dev/null
+++ b/queue-6.12/pci-imx6-enable-the-vaux-supply-if-available.patch
@@ -0,0 +1,42 @@
+From 3cfd00b55a0e23a09f39cfa7649c0e0a52cbe720 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:23:28 +0800
+Subject: PCI: imx6: Enable the Vaux supply if available
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit c221cbf8dc547eb8489152ac62ef103fede99545 ]
+
+When the 3.3Vaux supply is present, fetch it at the probe time and keep it
+enabled for the entire PCIe controller lifecycle so that the link can enter
+L2 state and the devices can signal wakeup using either Beacon or WAKE#
+mechanisms.
+
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[mani: reworded the subject, description and error message]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250820022328.2143374-1-hongxing.zhu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index c5254241942d3..8877d327867ee 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1487,6 +1487,10 @@ static int imx_pcie_probe(struct platform_device *pdev)
+ 	pci->max_link_speed = 1;
+ 	of_property_read_u32(node, "fsl,max-link-speed", &pci->max_link_speed);
+ 
++	ret = devm_regulator_get_enable_optional(&pdev->dev, "vpcie3v3aux");
++	if (ret < 0 && ret != -ENODEV)
++		return dev_err_probe(dev, ret, "failed to enable Vaux supply\n");
++
+ 	imx_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
+ 	if (IS_ERR(imx_pcie->vpcie)) {
+ 		if (PTR_ERR(imx_pcie->vpcie) != -ENODEV)
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-6.12/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..9d6605c91a
--- /dev/null
+++ b/queue-6.12/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From de066f5500348a427047e3e613195475ac9156fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 4f47a13cb500f..52e1564eadd0b 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -351,7 +351,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-6.12/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch b/queue-6.12/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
new file mode 100644
index 0000000000..9ecfb02d77
--- /dev/null
+++ b/queue-6.12/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
@@ -0,0 +1,60 @@
+From 3347ea70fa8463e6f81f370edde0b8f5d4bb73af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 22:19:15 -0500
+Subject: PCI/PM: Skip resuming to D0 if device is disconnected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
+
+When a device is surprise-removed (e.g., due to a dock unplug), the PCI
+core unconfigures all downstream devices and sets their error state to
+pci_channel_io_perm_failure. This marks them as disconnected via
+pci_dev_is_disconnected().
+
+During device removal, the runtime PM framework may attempt to resume the
+device to D0 via pm_runtime_get_sync(), which calls into pci_power_up().
+Since the device is already disconnected, this resume attempt is
+unnecessary and results in a predictable errors like this, typically when
+undocking from a TBT3 or USB4 dock with PCIe tunneling:
+
+  pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
+
+Avoid powering up disconnected devices by checking their status early in
+pci_power_up() and returning -EIO.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+[bhelgaas: add typical message]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 0dd548e2b3676..5e5326031eb72 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1403,6 +1403,11 @@ int pci_power_up(struct pci_dev *dev)
+ 		return -EIO;
+ 	}
+ 
++	if (pci_dev_is_disconnected(dev)) {
++		dev->current_state = PCI_D3cold;
++		return -EIO;
++	}
++
+ 	pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+ 	if (PCI_POSSIBLE_ERROR(pmcsr)) {
+ 		pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
+-- 
+2.51.0
+
diff --git a/queue-6.12/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-6.12/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..eb080a8d56
--- /dev/null
+++ b/queue-6.12/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 2ca2b382974bc9d1bbe2acfcafbc94d82d244098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index 8d93a830ab8bf..a24df36e5c376 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -145,7 +145,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -155,6 +155,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-6.12/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch b/queue-6.12/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
new file mode 100644
index 0000000000..417d40f768
--- /dev/null
+++ b/queue-6.12/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
@@ -0,0 +1,77 @@
+From 02b5f8e302d3bfceb3e678e6c74c787bd6e0052b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:07:24 +0200
+Subject: phy: renesas: r8a779f0-ether-serdes: add new step added to latest
+ datasheet
+
+From: Michael Dege <michael.dege@renesas.com>
+
+[ Upstream commit e4a8db93b5ec9bca1cc66b295544899e3afd5e86 ]
+
+R-Car S4-8 datasheet Rev.1.20 describes some additional register
+settings at the end of the initialization.
+
+Signed-off-by: Michael Dege <michael.dege@renesas.com>
+Link: https://lore.kernel.org/r/20250703-renesas-serdes-update-v4-2-1db5629cac2b@renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 +++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/phy/renesas/r8a779f0-ether-serdes.c b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+index f1f1da4a0b1fe..737672113e304 100644
+--- a/drivers/phy/renesas/r8a779f0-ether-serdes.c
++++ b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+@@ -49,6 +49,13 @@ static void r8a779f0_eth_serdes_write32(void __iomem *addr, u32 offs, u32 bank,
+ 	iowrite32(data, addr + offs);
+ }
+ 
++static u32 r8a779f0_eth_serdes_read32(void __iomem *addr, u32 offs,  u32 bank)
++{
++	iowrite32(bank, addr + R8A779F0_ETH_SERDES_BANK_SELECT);
++
++	return ioread32(addr + offs);
++}
++
+ static int
+ r8a779f0_eth_serdes_reg_wait(struct r8a779f0_eth_serdes_channel *channel,
+ 			     u32 offs, u32 bank, u32 mask, u32 expected)
+@@ -274,6 +281,7 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ *channel)
+ {
+ 	int ret;
++	u32 val;
+ 
+ 	ret = r8a779f0_eth_serdes_chan_setting(channel);
+ 	if (ret)
+@@ -287,6 +295,26 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ 
+ 	r8a779f0_eth_serdes_write32(channel->addr, 0x03d0, 0x380, 0x0000);
+ 
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x00c0, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val | BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val & ~BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x0144, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val | BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val & ~BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
+ 	return r8a779f0_eth_serdes_monitor_linkup(channel);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch b/queue-6.12/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
new file mode 100644
index 0000000000..f9fff80b04
--- /dev/null
+++ b/queue-6.12/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
@@ -0,0 +1,55 @@
+From 7ec650526751b6d7e094397d4987f18602744609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:04:52 +0200
+Subject: phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
+ register 0
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
+
+The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
+value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
+this offset is perfectly fine (in fact, register 0 is the only one in
+this register file).
+Introduce a boolean variable to indicate valid registers and allow writes
+to register 0.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+index 98c92d6c482fe..279e19e7546b6 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+@@ -87,10 +87,11 @@ struct dphy_reg {
+ 	u32 offset;
+ 	u32 mask;
+ 	u32 shift;
++	u8 valid;
+ };
+ 
+ #define PHY_REG(_offset, _width, _shift) \
+-	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
++	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
+ 
+ static const struct dphy_reg rk1808_grf_dphy_regs[] = {
+ 	[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
+@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
+ 	const struct dphy_drv_data *drv_data = priv->drv_data;
+ 	const struct dphy_reg *reg = &drv_data->grf_regs[index];
+ 
+-	if (reg->offset)
++	if (reg->valid)
+ 		regmap_write(priv->grf, reg->offset,
+ 			     HIWORD_UPDATE(value, reg->mask, reg->shift));
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch b/queue-6.12/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
new file mode 100644
index 0000000000..14e7b78613
--- /dev/null
+++ b/queue-6.12/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
@@ -0,0 +1,54 @@
+From 06fb6887b0403e26125025cbb91746ab196636eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 14:10:34 -0700
+Subject: platform/x86/intel-uncore-freq: Fix warning in partitioned system
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 6d47b4f08436cb682fb2644e6265a3897fd42a77 ]
+
+A partitioned system configured with only one package and one compute
+die, warning will be generated for duplicate sysfs entry. This typically
+occurs during the platform bring-up phase.
+
+Partitioned systems expose dies, equivalent to TPMI compute domains,
+through the CPUID. Each partitioned system must contains at least one
+compute die per partition, resulting in a minimum of two dies per
+package. Hence the function topology_max_dies_per_package() returns at
+least two, and the condition "topology_max_dies_per_package() > 1"
+prevents the creation of a root domain.
+
+In this case topology_max_dies_per_package() will return 1 and root
+domain will be created for partition 0 and a duplicate sysfs warning
+for partition 1 as both partitions have same package ID.
+
+To address this also check for non zero partition in addition to
+topology_max_dies_per_package() > 1.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20250819211034.3776284-1-srinivas.pandruvada@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+index 9a5ff9163988d..e36ae804e21e6 100644
+--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+@@ -589,7 +589,7 @@ static int uncore_probe(struct auxiliary_device *auxdev, const struct auxiliary_
+ 
+ 	auxiliary_set_drvdata(auxdev, tpmi_uncore);
+ 
+-	if (topology_max_dies_per_package() > 1)
++	if (topology_max_dies_per_package() > 1 || plat_info->partition)
+ 		return 0;
+ 
+ 	tpmi_uncore->root_cluster.root_domain = true;
+-- 
+2.51.0
+
diff --git a/queue-6.12/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-6.12/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..3b900ebbdc
--- /dev/null
+++ b/queue-6.12/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From b529a0c9261dbda367807141b3f9c02efad0f91e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index dd50de91c4383..c73e4225e84a5 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/ptp-limit-time-setting-of-ptp-clocks.patch b/queue-6.12/ptp-limit-time-setting-of-ptp-clocks.patch
new file mode 100644
index 0000000000..32b44ff738
--- /dev/null
+++ b/queue-6.12/ptp-limit-time-setting-of-ptp-clocks.patch
@@ -0,0 +1,81 @@
+From 9b9d955b2ee625ed001332f8fc16918c2080b693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:32:53 +0200
+Subject: ptp: Limit time setting of PTP clocks
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
+
+Networking drivers implementing PTP clocks and kernel socket code
+handling hardware timestamps use the 64-bit signed ktime_t type counting
+nanoseconds. When a PTP clock reaches the maximum value in year 2262,
+the timestamps returned to applications will overflow into year 1667.
+The same thing happens when injecting a large offset with
+clock_adjtime(ADJ_SETOFFSET).
+
+The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
+CLOCK_REALTIME") limited the maximum accepted value setting the system
+clock to 30 years before the maximum representable value (i.e. year
+2232) to avoid the overflow, assuming the system will not run for more
+than 30 years.
+
+Enforce the same limit for PTP clocks. Don't allow negative values and
+values closer than 30 years to the maximum value. Drivers may implement
+an even lower limit if the hardware registers cannot represent the whole
+interval between years 1970 and 2262 in the required resolution.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <jstultz@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 642a540861d43..03c17b1db7aac 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -100,6 +100,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ 		return -EBUSY;
+ 	}
+ 
++	if (!timespec64_valid_settod(tp))
++		return -EINVAL;
++
+ 	return  ptp->info->settime64(ptp->info, tp);
+ }
+ 
+@@ -130,7 +133,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 	ops = ptp->info;
+ 
+ 	if (tx->modes & ADJ_SETOFFSET) {
+-		struct timespec64 ts;
++		struct timespec64 ts, ts2;
+ 		ktime_t kt;
+ 		s64 delta;
+ 
+@@ -143,6 +146,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 		if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
+ 			return -EINVAL;
+ 
++		/* Make sure the offset is valid */
++		err = ptp_clock_gettime(pc, &ts2);
++		if (err)
++			return err;
++		ts2 = timespec64_add(ts2, ts);
++		if (!timespec64_valid_settod(&ts2))
++			return -EINVAL;
++
+ 		kt = timespec64_to_ktime(ts);
+ 		delta = ktime_to_ns(kt);
+ 		err = ops->adjtime(ops, delta);
+-- 
+2.51.0
+
diff --git a/queue-6.12/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-6.12/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..52b575576d
--- /dev/null
+++ b/queue-6.12/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From 76677b5aea83f03b477c6e659568ec58ddd49c0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 80b5262d0d572..bec5f68237753 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3467,7 +3467,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3572,7 +3572,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3772,7 +3772,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-- 
+2.51.0
+
diff --git a/queue-6.12/rdma-irdma-update-kconfig.patch b/queue-6.12/rdma-irdma-update-kconfig.patch
new file mode 100644
index 0000000000..8035438009
--- /dev/null
+++ b/queue-6.12/rdma-irdma-update-kconfig.patch
@@ -0,0 +1,42 @@
+From ae93a8808fc93029dc8eb969b17d2f572cdb9cf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:25:45 -0500
+Subject: RDMA/irdma: Update Kconfig
+
+From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+
+[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
+
+Update Kconfig to add dependency on idpf module and
+add IPU E2000 to the list of supported devices.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com
+Tested-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/Kconfig b/drivers/infiniband/hw/irdma/Kconfig
+index b6f9c41bca51d..41660203e0049 100644
+--- a/drivers/infiniband/hw/irdma/Kconfig
++++ b/drivers/infiniband/hw/irdma/Kconfig
+@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA
+ 	depends on INET
+ 	depends on IPV6 || !IPV6
+ 	depends on PCI
+-	depends on ICE && I40E
++	depends on IDPF && ICE && I40E
+ 	select GENERIC_ALLOCATOR
+ 	select AUXILIARY_BUS
+ 	help
+-	  This is an Intel(R) Ethernet Protocol Driver for RDMA driver
+-	  that support E810 (iWARP/RoCE) and X722 (iWARP) network devices.
++	  This is an Intel(R) Ethernet Protocol Driver for RDMA that
++	  supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP)
++	  network devices.
+-- 
+2.51.0
+
diff --git a/queue-6.12/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-6.12/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..20a98c5bdb
--- /dev/null
+++ b/queue-6.12/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 6bf62e543ae929b33bf39812361d45a7cbaa3f40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index dc360252c5157..5b1c072e2e7ff 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-6.12/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-6.12/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..7a7bc101a9
--- /dev/null
+++ b/queue-6.12/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From b5b343d4adfdd1589a2a5393dc87746e54a319b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 769c6d6d6a731..58d5b85e58cda 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -164,6 +164,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch b/queue-6.12/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
new file mode 100644
index 0000000000..fc5bc23c2b
--- /dev/null
+++ b/queue-6.12/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
@@ -0,0 +1,54 @@
+From e490c59c4c9a2fa7915ae445a7d83631849e4c62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 10:39:37 -0500
+Subject: remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 461edcf73eec57bc0006fbb5209f5012c514c58b ]
+
+Use device life-cycle managed runtime enable function to simplify probe
+and exit paths.
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20250814153940.670564-1-afd@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/wkup_m3_rproc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/remoteproc/wkup_m3_rproc.c b/drivers/remoteproc/wkup_m3_rproc.c
+index 36a55f7ffa64d..c39bd2bf2c1e7 100644
+--- a/drivers/remoteproc/wkup_m3_rproc.c
++++ b/drivers/remoteproc/wkup_m3_rproc.c
+@@ -148,7 +148,9 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
++	ret = devm_pm_runtime_enable(dev);
++	if (ret < 0)
++		return dev_err_probe(dev, ret, "Failed to enable runtime PM\n");
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+@@ -219,7 +221,6 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 	rproc_free(rproc);
+ err:
+ 	pm_runtime_put_noidle(dev);
+-	pm_runtime_disable(dev);
+ 	return ret;
+ }
+ 
+@@ -230,7 +231,6 @@ static void wkup_m3_rproc_remove(struct platform_device *pdev)
+ 	rproc_del(rproc);
+ 	rproc_free(rproc);
+ 	pm_runtime_put_sync(&pdev->dev);
+-	pm_runtime_disable(&pdev->dev);
+ }
+ 
+ #ifdef CONFIG_PM
+-- 
+2.51.0
+
diff --git a/queue-6.12/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch b/queue-6.12/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
new file mode 100644
index 0000000000..26893a676e
--- /dev/null
+++ b/queue-6.12/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
@@ -0,0 +1,56 @@
+From d5511cafb4161cbdbec4c55fd5baa591628836b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jun 2025 15:57:22 -0500
+Subject: rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 6e29c30d8ddea6109ea7e0b9f17e7841df0794ea ]
+
+Module aliases are used by userspace to identify the correct module to
+load for a detected hardware. The currently supported RPMSG device IDs for
+this module include "rpmsg-raw", but the module alias is "rpmsg_chrdev".
+
+Use the helper macro MODULE_DEVICE_TABLE(rpmsg) to export the correct
+supported IDs. And while here, to keep backwards compatibility we also add
+the other ID "rpmsg_chrdev" so that it is also still exported as an alias.
+
+This has the side benefit of adding support for some legacy firmware
+which still uses the original "rpmsg_chrdev" ID. This was the ID used for
+this driver before it was upstreamed (as reflected by the module alias).
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Acked-by: Hari Nagalla <hnagalla@ti.com>
+Tested-by: Hari Nagalla <hnagalla@ti.com>
+Link: https://lore.kernel.org/r/20250619205722.133827-1-afd@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/rpmsg_char.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
+index eec7642d26863..96fcdd2d7093c 100644
+--- a/drivers/rpmsg/rpmsg_char.c
++++ b/drivers/rpmsg/rpmsg_char.c
+@@ -522,8 +522,10 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
+ 
+ static struct rpmsg_device_id rpmsg_chrdev_id_table[] = {
+ 	{ .name	= "rpmsg-raw" },
++	{ .name	= "rpmsg_chrdev" },
+ 	{ },
+ };
++MODULE_DEVICE_TABLE(rpmsg, rpmsg_chrdev_id_table);
+ 
+ static struct rpmsg_driver rpmsg_chrdev_driver = {
+ 	.probe = rpmsg_chrdev_probe,
+@@ -565,6 +567,5 @@ static void rpmsg_chrdev_exit(void)
+ }
+ module_exit(rpmsg_chrdev_exit);
+ 
+-MODULE_ALIAS("rpmsg:rpmsg_chrdev");
+ MODULE_DESCRIPTION("RPMSG device interface");
+ MODULE_LICENSE("GPL v2");
+-- 
+2.51.0
+
diff --git a/queue-6.12/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch b/queue-6.12/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
new file mode 100644
index 0000000000..7badc06543
--- /dev/null
+++ b/queue-6.12/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
@@ -0,0 +1,80 @@
+From 4ab1afbc8e7a71dc1b3437606e6c0429ac2e2781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:39 +0200
+Subject: s390/pci: Use pci_uevent_ers() in PCI recovery
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
+
+Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by
+EEH and AER PCIe recovery routines.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_event.c | 3 +++
+ drivers/pci/pci-driver.c  | 2 +-
+ include/linux/pci.h       | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
+index ef44feb1a9daa..2c82e1afec3b3 100644
+--- a/arch/s390/pci/pci_event.c
++++ b/arch/s390/pci/pci_event.c
+@@ -90,6 +90,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev,
+ 	pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT;
+ 
+ 	ers_res = driver->err_handler->error_detected(pdev,  pdev->error_state);
++	pci_uevent_ers(pdev, ers_res);
+ 	if (ers_result_indicates_abort(ers_res))
+ 		pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev));
+ 	else if (ers_res == PCI_ERS_RESULT_NEED_RESET)
+@@ -219,6 +220,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 		ers_res = zpci_event_do_reset(pdev, driver);
+ 
+ 	if (ers_res != PCI_ERS_RESULT_RECOVERED) {
++		pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT);
+ 		pr_err("%s: Automatic recovery failed; operator intervention is required\n",
+ 		       pci_name(pdev));
+ 		goto out_unlock;
+@@ -227,6 +229,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 	pr_info("%s: The device is ready to resume operations\n", pci_name(pdev));
+ 	if (driver->err_handler->resume)
+ 		driver->err_handler->resume(pdev);
++	pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
+ out_unlock:
+ 	pci_dev_unlock(pdev);
+ 
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 0c3aa91d1aee0..7e9b6e4d46950 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1586,7 +1586,7 @@ static int pci_uevent(const struct device *dev, struct kobj_uevent_env *env)
+ 	return 0;
+ }
+ 
+-#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ /**
+  * pci_uevent_ers - emit a uevent during recovery path of PCI device
+  * @pdev: PCI device undergoing error recovery
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 452a3dca28eaa..242ee3843e10e 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2707,7 +2707,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ 	return false;
+ }
+ 
+-#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch b/queue-6.12/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
new file mode 100644
index 0000000000..8d215251ae
--- /dev/null
+++ b/queue-6.12/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
@@ -0,0 +1,70 @@
+From 12347bee4fe61b0b4703eafc33d07c9445c63b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:37:57 -0700
+Subject: scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
+
+The fc_ct_ms_fill() helper currently formats the OS name and version
+into entry->value using "%s v%s". Since init_utsname()->sysname and
+->release are unbounded strings, snprintf() may attempt to write more
+than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
+-Wformat-truncation warning with W=1.
+
+In file included from drivers/scsi/libfc/fc_elsct.c:18:
+drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
+drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
+be truncated writing up to 64 bytes into a region of size between 62
+and 126 [-Werror=format-truncation=]
+  359 |                         "%s v%s",
+      |                              ^~
+  360 |                         init_utsname()->sysname,
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
+3 and 131 bytes into a destination of size 128
+  357 |                 snprintf((char *)&entry->value,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  358 |                         FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  359 |                         "%s v%s",
+      |                         ~~~~~~~~~
+  360 |                         init_utsname()->sysname,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by using "%.62s v%.62s", which ensures sysname and release are
+truncated to fit within the 128-byte field defined by
+FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
+
+[mkp: clarified commit description]
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_encode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
+index 02e31db31d68e..e046091a549ae 100644
+--- a/drivers/scsi/libfc/fc_encode.h
++++ b/drivers/scsi/libfc/fc_encode.h
+@@ -356,7 +356,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
+ 		put_unaligned_be16(len, &entry->len);
+ 		snprintf((char *)&entry->value,
+ 			FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+-			"%s v%s",
++			"%.62s v%.62s",
+ 			init_utsname()->sysname,
+ 			init_utsname()->release);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-6.12/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..4e74c2f571
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From 41cb0f93ab4fe2a2c87a1ee033d728cc78b14b1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 67e0898811817..778f8e2310569 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -5929,7 +5929,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -6103,8 +6103,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irqrestore(&pnode->lock, flags);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -6200,7 +6206,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch b/queue-6.12/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
new file mode 100644
index 0000000000..59642e7a06
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
@@ -0,0 +1,49 @@
+From ecb88f3c138f5486bdb11ac815da88e1b93052ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:00 -0700
+Subject: scsi: lpfc: Clean up allocated queues when queue setup mbox commands
+ fail
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 803dfd83df33b7565f23aef597d5dd036adfa792 ]
+
+lpfc_sli4_queue_setup() does not allocate memory and is used for
+submitting CREATE_QUEUE mailbox commands.  Thus, if such mailbox
+commands fail we should clean up by also freeing the memory allocated
+for the queues with lpfc_sli4_queue_destroy().  Change the intended
+clean up label for the lpfc_sli4_queue_setup() error case to
+out_destroy_queue.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-4-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index c4acf594286e5..2a1f2b2017159 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -8811,7 +8811,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ 	if (unlikely(rc)) {
+ 		lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
+ 				"0381 Error %d during queue setup.\n", rc);
+-		goto out_stop_timers;
++		goto out_destroy_queue;
+ 	}
+ 	/* Initialize the driver internal SLI layer lists. */
+ 	lpfc_sli4_setup(phba);
+@@ -9094,7 +9094,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ 	lpfc_free_iocb_list(phba);
+ out_destroy_queue:
+ 	lpfc_sli4_queue_destroy(phba);
+-out_stop_timers:
+ 	lpfc_stop_hba_timers(phba);
+ out_free_mbox:
+ 	mempool_free(mboxq, phba->mbox_mem_pool);
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch b/queue-6.12/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
new file mode 100644
index 0000000000..acdab78cea
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
@@ -0,0 +1,43 @@
+From f58e4b823568d54d9f845e07721d1a04812f19a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:02 -0700
+Subject: scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit b5bf6d681fce69cd1a57bfc0f1bdbbb348035117 ]
+
+The kref for Fabric_DID ndlps is not decremented after repeated FDISC
+failures and exhausting maximum allowed retries.  This can leave the
+ndlp lingering unnecessarily.  Add a test and set bit operation for the
+NLP_DROPPED flag. If not previously set, then a kref is decremented. The
+ndlp is freed when the remaining reference for the completing ELS is
+put.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-6-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index b5fa5054e952e..ac2fa05cc89c1 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -11237,6 +11237,11 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+ 			      "0126 FDISC cmpl status: x%x/x%x)\n",
+ 			      ulp_status, ulp_word4);
++
++		/* drop initial reference */
++		if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag))
++			lpfc_nlp_put(ndlp);
++
+ 		goto fdisc_failed;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-6.12/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..0ae927e7dc
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From b612a104575a2841b3726dffdb3b21f4c1719776 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 8d2e8d05bbc05..52b14671eaa94 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch b/queue-6.12/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
new file mode 100644
index 0000000000..2bdef03fff
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
@@ -0,0 +1,100 @@
+From fd11f9c7af091480a856ed6a45884ce627d71149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:04 -0700
+Subject: scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
+ topology
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 2bf81856a403c92a4ce375288f33fba82ca2ccc6 ]
+
+There is a timing race condition when a PRLI may be sent on the wire
+before PLOGI_ACC in Point to Point topology.  Fix by deferring REG_RPI
+mbox completion handling to after PLOGI_ACC's CQE completion.  Because
+the discovery state machine only sends PRLI after REG_RPI mbox
+completion, PRLI is now guaranteed to be sent after PLOGI_ACC.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-8-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c       | 10 +++++++---
+ drivers/scsi/lpfc/lpfc_nportdisc.c | 23 ++++++++++++++++++-----
+ 2 files changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 9309c42487ca8..36ee9f51a8fa2 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5329,12 +5329,12 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		ulp_status, ulp_word4, did);
+ 	/* ELS response tag <ulpIoTag> completes */
+ 	lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+-			 "0110 ELS response tag x%x completes "
++			 "0110 ELS response tag x%x completes fc_flag x%lx"
+ 			 "Data: x%x x%x x%x x%x x%lx x%x x%x x%x %p %p\n",
+-			 iotag, ulp_status, ulp_word4, tmo,
++			 iotag, vport->fc_flag, ulp_status, ulp_word4, tmo,
+ 			 ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state,
+ 			 ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox, ndlp);
+-	if (mbox) {
++	if (mbox && !test_bit(FC_PT2PT, &vport->fc_flag)) {
+ 		if (ulp_status == 0 &&
+ 		    test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) {
+ 			if (!lpfc_unreg_rpi(vport, ndlp) &&
+@@ -5393,6 +5393,10 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		}
+ out_free_mbox:
+ 		lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
++	} else if (mbox && test_bit(FC_PT2PT, &vport->fc_flag) &&
++		   test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) {
++		lpfc_mbx_cmpl_reg_login(phba, mbox);
++		clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
+ 	}
+ out:
+ 	if (ndlp && shost) {
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index 4d88cfe71caed..2897674b78d4c 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -329,8 +329,14 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
+ 		/* Now that REG_RPI completed successfully,
+ 		 * we can now proceed with sending the PLOGI ACC.
+ 		 */
+-		rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
+-				      save_iocb, ndlp, NULL);
++		if (test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) {
++			rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
++					      save_iocb, ndlp, login_mbox);
++		} else {
++			rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
++					      save_iocb, ndlp, NULL);
++		}
++
+ 		if (rc) {
+ 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
+ 					"4576 PLOGI ACC fails pt2pt discovery: "
+@@ -338,9 +344,16 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
+ 		}
+ 	}
+ 
+-	/* Now process the REG_RPI cmpl */
+-	lpfc_mbx_cmpl_reg_login(phba, login_mbox);
+-	clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
++	/* If this is a fabric topology, complete the reg_rpi and prli now.
++	 * For Pt2Pt, the reg_rpi and PRLI are deferred until after the LS_ACC
++	 * completes.  This ensures, in Pt2Pt, that the PLOGI LS_ACC is sent
++	 * before the PRLI.
++	 */
++	if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) {
++		/* Now process the REG_RPI cmpl */
++		lpfc_mbx_cmpl_reg_login(phba, login_mbox);
++		clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
++	}
+ 	kfree(save_iocb);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch b/queue-6.12/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
new file mode 100644
index 0000000000..cde6c19348
--- /dev/null
+++ b/queue-6.12/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
@@ -0,0 +1,64 @@
+From e5660767d58b5abe4300e5e4b5a7decafd475f28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:01 -0700
+Subject: scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
+ lpfc_cleanup
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
+
+In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
+F_Port_Ctrl ndlp object.  In cases when an ABTS is issued, the
+outstanding kref is needed for when a second XRI_ABORTED CQE is
+received.  The final kref for the ndlp is designed to be decremented in
+lpfc_sli4_els_xri_aborted instead.  Also, add a new log message to allow
+for future diagnostics when debugging related issues.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c  | 6 +++++-
+ drivers/scsi/lpfc/lpfc_init.c | 7 -------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ac2fa05cc89c1..9309c42487ca8 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -11992,7 +11992,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 			sglq_entry->state = SGL_FREED;
+ 			spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+ 					       iflag);
+-
++			lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
++					LOG_DISCOVERY | LOG_NODE,
++					"0732 ELS XRI ABORT on Node: ndlp=x%px "
++					"xri=x%x\n",
++					ndlp, xri);
+ 			if (ndlp) {
+ 				lpfc_set_rrq_active(phba, ndlp,
+ 					sglq_entry->sli4_lxritag,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 3ddcaa864f075..08e6b8ed601c4 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -3036,13 +3036,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
+ 		lpfc_vmid_vport_cleanup(vport);
+ 
+ 	list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
+-		if (vport->port_type != LPFC_PHYSICAL_PORT &&
+-		    ndlp->nlp_DID == Fabric_DID) {
+-			/* Just free up ndlp with Fabric_DID for vports */
+-			lpfc_nlp_put(ndlp);
+-			continue;
+-		}
+-
+ 		if (ndlp->nlp_DID == Fabric_Cntl_DID &&
+ 		    ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
+ 			lpfc_nlp_put(ndlp);
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch b/queue-6.12/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
new file mode 100644
index 0000000000..bcc6496431
--- /dev/null
+++ b/queue-6.12/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
@@ -0,0 +1,56 @@
+From 9b96e1f65add95b5332ba53832a942f7a393db6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:34 +0530
+Subject: scsi: mpi3mr: Fix controller init failure on fault during queue
+ creation
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
+
+Firmware can enter a transient fault while creating operational queues.
+The driver fails the load immediately.
+
+Add a retry loop that checks controller status and history bit after
+queue creation. If either indicates a fault, retry init up to a set
+limit before failing.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index 82cbe98e8a044..acb2f7b04fb8f 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -2337,6 +2337,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ {
+ 	int retval = 0;
+ 	u16 num_queues = 0, i = 0, msix_count_op_q = 1;
++	u32 ioc_status;
++	enum mpi3mr_iocstate ioc_state;
+ 
+ 	num_queues = min_t(int, mrioc->facts.max_op_reply_q,
+ 	    mrioc->facts.max_op_req_q);
+@@ -2392,6 +2394,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ 		retval = -1;
+ 		goto out_failed;
+ 	}
++	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
++	ioc_state = mpi3mr_get_iocstate(mrioc);
++	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
++	    ioc_state != MRIOC_STATE_READY) {
++		mpi3mr_print_fault_info(mrioc);
++		retval = -1;
++		goto out_failed;
++	}
+ 	mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
+ 	ioc_info(mrioc,
+ 	    "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch b/queue-6.12/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
new file mode 100644
index 0000000000..b8af9edc81
--- /dev/null
+++ b/queue-6.12/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
@@ -0,0 +1,74 @@
+From 395516bc2d42cd317ceaacf1852d23aaceb6bde4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:35 +0530
+Subject: scsi: mpi3mr: Fix I/O failures during controller reset
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit b7b2176e30fc8e57664e5a8a23387af66eb7f72b ]
+
+I/Os can race with controller reset and fail.
+
+Block requests at the mid layer when reset starts using
+scsi_host_block(), and resume with scsi_host_unblock() after reset
+completes.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-4-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 +++
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 2 ++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index 08c751884b327..82cbe98e8a044 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -5372,6 +5372,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 	    mpi3mr_reset_rc_name(reset_reason));
+ 
+ 	mrioc->device_refresh_on = 0;
++	scsi_block_requests(mrioc->shost);
+ 	mrioc->reset_in_progress = 1;
+ 	mrioc->stop_bsgs = 1;
+ 	mrioc->prev_reset_result = -1;
+@@ -5480,6 +5481,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 	if (!retval) {
+ 		mrioc->diagsave_timeout = 0;
+ 		mrioc->reset_in_progress = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->pel_abort_requested = 0;
+ 		if (mrioc->pel_enabled) {
+ 			mrioc->pel_cmds.retry_count = 0;
+@@ -5504,6 +5506,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 		mrioc->device_refresh_on = 0;
+ 		mrioc->unrecoverable = 1;
+ 		mrioc->reset_in_progress = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->stop_bsgs = 0;
+ 		retval = -1;
+ 		mpi3mr_flush_cmds_for_unrecovered_controller(mrioc);
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index 1930e47cbf7bd..894d358ade75b 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -2839,12 +2839,14 @@ static void mpi3mr_preparereset_evt_th(struct mpi3mr_ioc *mrioc,
+ 		    "prepare for reset event top half with rc=start\n");
+ 		if (mrioc->prepare_for_reset)
+ 			return;
++		scsi_block_requests(mrioc->shost);
+ 		mrioc->prepare_for_reset = 1;
+ 		mrioc->prepare_for_reset_timeout_counter = 0;
+ 	} else if (evtdata->reason_code == MPI3_EVENT_PREPARE_RESET_RC_ABORT) {
+ 		dprint_event_th(mrioc,
+ 		    "prepare for reset top half with rc=abort\n");
+ 		mrioc->prepare_for_reset = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->prepare_for_reset_timeout_counter = 0;
+ 	}
+ 	if ((event_reply->msg_flags & MPI3_EVENT_NOTIFY_MSGFLAGS_ACK_MASK)
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch b/queue-6.12/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
new file mode 100644
index 0000000000..2d94f0ab40
--- /dev/null
+++ b/queue-6.12/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
@@ -0,0 +1,39 @@
+From f2c9fd1593bc13d29ee5853db728ae567b623596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:12 +0530
+Subject: scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
+
+Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in
+_transport_convert_phy_link_rate(). This maps the new 22.5 Gbps
+negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link
+speeds.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index 421db8996927b..7faa971856fbc 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)
+ 	case MPI25_SAS_NEG_LINK_RATE_12_0:
+ 		rc = SAS_LINK_RATE_12_0_GBPS;
+ 		break;
++	case MPI26_SAS_NEG_LINK_RATE_22_5:
++		rc = SAS_LINK_RATE_22_5_GBPS;
++		break;
+ 	case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED:
+ 		rc = SAS_PHY_DISABLED;
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-6.12/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..3cbb49d1da
--- /dev/null
+++ b/queue-6.12/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From 51993a6278705b79ea54e4363cb24c649b035025 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 0e7497e490f40..34cddfdbc22f8 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -682,7 +682,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-6.12/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..1336a8408c
--- /dev/null
+++ b/queue-6.12/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From 7cf254409307f8b36afa5382fe1858040bb38956 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 85ff95c6543a5..0e7497e490f40 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index b53b1ae5b74c3..5317f82c51fd4 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -550,6 +550,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index c46470e0cf63b..efb6dc26bc35b 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -537,6 +537,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-core-disable-timestamp-functionality-if-not.patch b/queue-6.12/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
new file mode 100644
index 0000000000..e31c009541
--- /dev/null
+++ b/queue-6.12/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
@@ -0,0 +1,67 @@
+From aa726fddc8a6d8e29fe85ab3decdff616fdb33cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 12:06:07 -0700
+Subject: scsi: ufs: core: Disable timestamp functionality if not supported
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit fb1f4568346153d2f80fdb4ffcfa0cf4fb257d3c ]
+
+Some Kioxia UFS 4 devices do not support the qTimestamp attribute.  Set
+the UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT for these devices such that no
+error messages appear in the kernel log about failures to set the
+qTimestamp attribute.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Tested-by: Nitin Rawat <quic_nitirawa@quicinc.com> # on SM8650-QRD
+Reviewed-by: Nitin Rawat <quic_nitirawa@quicinc.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Message-ID: <20250909190614.3531435-1-bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +++++-
+ include/ufs/ufs_quirks.h  | 3 +++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index d4dbb6769efa2..fca05834eefc2 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -295,6 +295,9 @@ static const struct ufs_dev_quirk ufs_fixups[] = {
+ 	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
+ 	  .model = "THGLF2G9D8KBADG",
+ 	  .quirk = UFS_DEVICE_QUIRK_PA_TACTIVATE },
++	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
++	  .model = "THGJFJT1E45BATP",
++	  .quirk = UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT },
+ 	{}
+ };
+ 
+@@ -8670,7 +8673,8 @@ static void ufshcd_set_timestamp_attr(struct ufs_hba *hba)
+ 	struct ufs_dev_info *dev_info = &hba->dev_info;
+ 	struct utp_upiu_query_v4_0 *upiu_data;
+ 
+-	if (dev_info->wspecversion < 0x400)
++	if (dev_info->wspecversion < 0x400 ||
++	    hba->dev_quirks & UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT)
+ 		return;
+ 
+ 	ufshcd_dev_man_lock(hba);
+diff --git a/include/ufs/ufs_quirks.h b/include/ufs/ufs_quirks.h
+index f52de5ed1b3b6..83563247c36cb 100644
+--- a/include/ufs/ufs_quirks.h
++++ b/include/ufs/ufs_quirks.h
+@@ -113,4 +113,7 @@ struct ufs_dev_quirk {
+  */
+ #define UFS_DEVICE_QUIRK_PA_HIBER8TIME          (1 << 12)
+ 
++/* Some UFS 4 devices do not support the qTimestamp attribute */
++#define UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT	(1 << 13)
++
+ #endif /* UFS_QUIRKS_H_ */
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch b/queue-6.12/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
new file mode 100644
index 0000000000..ebf6e3576d
--- /dev/null
+++ b/queue-6.12/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
@@ -0,0 +1,57 @@
+From cbb59bc545f4381b1cb088d6046d2d3a8aaeca4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 11:09:23 +0530
+Subject: scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on
+ suspend
+
+From: Bharat Uppal <bharat.uppal@samsung.com>
+
+[ Upstream commit 6d55af0f0740bf3d77943425fdafb77dc0fa6bb9 ]
+
+On FSD platform, gating the reference clock (ref_clk) and putting the
+UFS device in reset by asserting the reset signal during UFS suspend,
+improves the power savings and ensures the PHY is fully turned off.
+
+These operations are added as FSD specific suspend hook to avoid
+unintended side effects on other SoCs supported by this driver.
+
+Co-developed-by: Nimesh Sati <nimesh.sati@samsung.com>
+Signed-off-by: Nimesh Sati <nimesh.sati@samsung.com>
+Signed-off-by: Bharat Uppal <bharat.uppal@samsung.com>
+Link: https://lore.kernel.org/r/20250821053923.69411-1-bharat.uppal@samsung.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-exynos.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
+index 6bd1532bfd1d6..6a337e058e5c4 100644
+--- a/drivers/ufs/host/ufs-exynos.c
++++ b/drivers/ufs/host/ufs-exynos.c
+@@ -1882,6 +1882,13 @@ static int fsd_ufs_pre_pwr_change(struct exynos_ufs *ufs,
+ 	return 0;
+ }
+ 
++static int fsd_ufs_suspend(struct exynos_ufs *ufs)
++{
++	exynos_ufs_gate_clks(ufs);
++	hci_writel(ufs, 0, HCI_GPIO_OUT);
++	return 0;
++}
++
+ static inline u32 get_mclk_period_unipro_18(struct exynos_ufs *ufs)
+ {
+ 	return (16 * 1000 * 1000000UL / ufs->mclk_rate);
+@@ -2162,6 +2169,7 @@ static const struct exynos_ufs_drv_data fsd_ufs_drvs = {
+ 	.pre_link               = fsd_ufs_pre_link,
+ 	.post_link              = fsd_ufs_post_link,
+ 	.pre_pwr_change         = fsd_ufs_pre_pwr_change,
++	.suspend                = fsd_ufs_suspend,
+ };
+ 
+ static const struct exynos_ufs_drv_data gs101_ufs_drvs = {
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch b/queue-6.12/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
new file mode 100644
index 0000000000..ad99b1a9cb
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
@@ -0,0 +1,61 @@
+From 7f508150ed4d9f2b878551225722c65953a2dde3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:22 +0800
+Subject: scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO
+ mode change
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
+
+Assign power mode userdata settings before transitioning to FASTAUTO
+power mode. This ensures that default timeout values are set for various
+parameters, enhancing the reliability and performance of the power mode
+change process.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 8701d2307ad3f..191db60b393d9 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1186,6 +1186,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
+ 			       PA_NO_ADAPT);
+ 
++		if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) {
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2),
++					DL_AFC0ReqTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3),
++					DL_FC1ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4),
++					DL_TC1ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5),
++					DL_AFC1ReqTimeOutVal_Default);
++
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal),
++					DL_AFC0ReqTimeOutVal_Default);
++		}
++
+ 		ret = ufshcd_uic_change_pwr_mode(hba,
+ 					FASTAUTO_MODE << 4 | FASTAUTO_MODE);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch b/queue-6.12/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
new file mode 100644
index 0000000000..f96661fe5b
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
@@ -0,0 +1,44 @@
+From 9f16494c1518733a53c54fc7b1ea60590813e0f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:25 +0800
+Subject: scsi: ufs: host: mediatek: Change reset sequence for improved
+ stability
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
+
+Modify the reset sequence to ensure that the device reset pin is set low
+before the host is disabled. This change enhances the stability of the
+reset process by ensuring the correct order of operations.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 191db60b393d9..c0106fb3792d4 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1340,11 +1340,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba)
+ {
+ 	struct arm_smccc_res res;
+ 
+-	/* disable hba before device reset */
+-	ufshcd_hba_stop(hba);
+-
+ 	ufs_mtk_device_reset_ctrl(0, res);
+ 
++	/* disable hba in middle of device reset */
++	ufshcd_hba_stop(hba);
++
+ 	/*
+ 	 * The reset signal is active low. UFS devices shall detect
+ 	 * more than or equal to 1us of positive or negative RST_n
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-correct-system-pm-flow.patch b/queue-6.12/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
new file mode 100644
index 0000000000..e1f80dce77
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
@@ -0,0 +1,69 @@
+From 5b5e943ea9a64ab6b1860499af6fed13f83ed25a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:39 +0800
+Subject: scsi: ufs: host: mediatek: Correct system PM flow
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 77b96ef70b6ba46e3473e5e3a66095c4bc0e93a4 ]
+
+Refine the system power management (PM) flow by skipping low power mode
+(LPM) and MTCMOS settings if runtime PM is already applied. Prevent
+redundant operations to ensure a more efficient PM process.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 7c13bce03694f..003ca5ad88228 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1989,27 +1989,38 @@ static int ufs_mtk_system_suspend(struct device *dev)
+ 
+ 	ret = ufshcd_system_suspend(dev);
+ 	if (ret)
+-		return ret;
++		goto out;
++
++	if (pm_runtime_suspended(hba->dev))
++		goto out;
+ 
+ 	ufs_mtk_dev_vreg_set_lpm(hba, true);
+ 
+ 	if (ufs_mtk_is_rtff_mtcmos(hba))
+ 		ufs_mtk_mtcmos_ctrl(false, res);
+ 
+-	return 0;
++out:
++	return ret;
+ }
+ 
+ static int ufs_mtk_system_resume(struct device *dev)
+ {
++	int ret = 0;
+ 	struct ufs_hba *hba = dev_get_drvdata(dev);
+ 	struct arm_smccc_res res;
+ 
++	if (pm_runtime_suspended(hba->dev))
++		goto out;
++
+ 	ufs_mtk_dev_vreg_set_lpm(hba, false);
+ 
+ 	if (ufs_mtk_is_rtff_mtcmos(hba))
+ 		ufs_mtk_mtcmos_ctrl(true, res);
+ 
+-	return ufshcd_system_resume(dev);
++out:
++	ret = ufshcd_system_resume(dev);
++
++	return ret;
+ }
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch b/queue-6.12/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
new file mode 100644
index 0000000000..c71e1e884b
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
@@ -0,0 +1,109 @@
+From 2f0a4d49471d02cd796418e0be584929371e03ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:42 +0800
+Subject: scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode
+ changes
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit f5ca8d0c7a6388abd5d8023cc682e1543728cc73 ]
+
+Disable auto-hibern8 during power mode transitions to prevent unintended
+entry into auto-hibern8. Restore the original auto-hibern8 timer value
+after completing the power mode change to maintain system stability and
+prevent potential issues during power state transitions.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 53 +++++++++++++++++++--------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 003ca5ad88228..00ecfe14c1fd9 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1237,19 +1237,49 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 	return ret;
+ }
+ 
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++{
++	int ret;
++
++	/* disable auto-hibern8 */
++	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
++
++	/* wait host return to idle state when auto-hibern8 off */
++	ufs_mtk_wait_idle_state(hba, 5);
++
++	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
++	if (ret) {
++		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
++}
++
+ static int ufs_mtk_pwr_change_notify(struct ufs_hba *hba,
+ 				     enum ufs_notify_change_status stage,
+ 				     struct ufs_pa_layer_attr *dev_max_params,
+ 				     struct ufs_pa_layer_attr *dev_req_params)
+ {
+ 	int ret = 0;
++	static u32 reg;
+ 
+ 	switch (stage) {
+ 	case PRE_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba)) {
++			reg = ufshcd_readl(hba, REG_AUTO_HIBERNATE_IDLE_TIMER);
++			ufs_mtk_auto_hibern8_disable(hba);
++		}
+ 		ret = ufs_mtk_pre_pwr_change(hba, dev_max_params,
+ 					     dev_req_params);
+ 		break;
+ 	case POST_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba))
++			ufshcd_writel(hba, reg, REG_AUTO_HIBERNATE_IDLE_TIMER);
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+@@ -1483,29 +1513,6 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+-{
+-	int ret;
+-
+-	/* disable auto-hibern8 */
+-	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
+-
+-	/* wait host return to idle state when auto-hibern8 off */
+-	ufs_mtk_wait_idle_state(hba, 5);
+-
+-	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret) {
+-		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
+-
+-		ufshcd_force_error_recovery(hba);
+-
+-		/* trigger error handler and break suspend */
+-		ret = -EBUSY;
+-	}
+-
+-	return ret;
+-}
+-
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 	enum ufs_notify_change_status status)
+ {
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch b/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
new file mode 100644
index 0000000000..28bded32ab
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
@@ -0,0 +1,99 @@
+From bdec55a7ce5e4445630af87b5a7d01bcf6cf17f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:37 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on hibernation exit
+ failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit faac32d4ece30609f1a0930ca0ae951cf6dc1786 ]
+
+Improve the recovery process for hibernation exit failures. Trigger the
+error handler and break the suspend operation to ensure effective
+recovery from hibernation errors. Activate the error handling mechanism
+by ufshcd_force_error_recovery and scheduling the error handler work.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c       |  3 ++-
+ drivers/ufs/host/ufs-mediatek.c | 14 +++++++++++---
+ include/ufs/ufshcd.h            |  1 +
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 2d07902ce7f1b..d4dbb6769efa2 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6374,13 +6374,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba)
+ 	}
+ }
+ 
+-static void ufshcd_force_error_recovery(struct ufs_hba *hba)
++void ufshcd_force_error_recovery(struct ufs_hba *hba)
+ {
+ 	spin_lock_irq(hba->host->host_lock);
+ 	hba->force_reset = true;
+ 	ufshcd_schedule_eh_work(hba);
+ 	spin_unlock_irq(hba->host->host_lock);
+ }
++EXPORT_SYMBOL_GPL(ufshcd_force_error_recovery);
+ 
+ static void ufshcd_clk_scaling_allow(struct ufs_hba *hba, bool allow)
+ {
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 5cb3af17aec47..7c13bce03694f 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1483,7 +1483,7 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ {
+ 	int ret;
+ 
+@@ -1494,8 +1494,16 @@ static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ 	ufs_mtk_wait_idle_state(hba, 5);
+ 
+ 	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret)
++	if (ret) {
+ 		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
+ }
+ 
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+@@ -1506,7 +1514,7 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 
+ 	if (status == PRE_CHANGE) {
+ 		if (ufshcd_is_auto_hibern8_supported(hba))
+-			ufs_mtk_auto_hibern8_disable(hba);
++			return ufs_mtk_auto_hibern8_disable(hba);
+ 		return 0;
+ 	}
+ 
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 47cba116f87b8..52ea0ab437fe0 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -1487,5 +1487,6 @@ int __ufshcd_write_ee_control(struct ufs_hba *hba, u32 ee_ctrl_mask);
+ int ufshcd_write_ee_control(struct ufs_hba *hba);
+ int ufshcd_update_ee_control(struct ufs_hba *hba, u16 *mask,
+ 			     const u16 *other_mask, u16 set, u16 clr);
++void ufshcd_force_error_recovery(struct ufs_hba *hba);
+ 
+ #endif /* End of Header */
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch b/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
new file mode 100644
index 0000000000..d39c816dcf
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
@@ -0,0 +1,50 @@
+From 467ba6baf0c260a94dade066fcf5575c83e35b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:38 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on resume failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
+
+Improve the recovery process for failed resume operations. Log the
+device's power status and return 0 if both resume and recovery fail to
+prevent I/O hang.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 2be74662f960b..7d7664f5b72a5 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1564,8 +1564,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ 	}
+ 
+ 	return 0;
++
+ fail:
+-	return ufshcd_link_recovery(hba);
++	/*
++	 * Check if the platform (parent) device has resumed, and ensure that
++	 * power, clock, and MTCMOS are all turned on.
++	 */
++	err = ufshcd_link_recovery(hba);
++	if (err) {
++		dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n",
++			hba->dev->power.request,
++			hba->dev->power.runtime_status,
++			hba->dev->power.runtime_error);
++	}
++
++	return 0; /* Cannot return a failure, otherwise, the I/O will hang. */
+ }
+ 
+ static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba)
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch b/queue-6.12/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
new file mode 100644
index 0000000000..1626b1bef6
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
@@ -0,0 +1,147 @@
+From fceac7a18c7ebf3e249deb5d94d6ce41fd607ef5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:18 +0800
+Subject: scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit aa86602a483ba48f51044fbaefa1ebbf6da194a4 ]
+
+Move the configuration of the Auto-Hibern8 (AHIT) timer from the
+post-link stage to the 'fixup_dev_quirks' function. This change allows
+setting the AHIT based on the vendor requirements:
+
+   (a) Samsung: 3.5 ms
+   (b) Micron: 2 ms
+   (c) Others: 1 ms
+
+Additionally, the clock gating timer is adjusted based on the AHIT
+scale, with a maximum setting of 10 ms. This ensures that the clock
+gating delay is appropriately configured to match the AHIT settings.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-3-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 86 ++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index c834d38921b6c..5841431d98543 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -916,6 +916,69 @@ static void ufs_mtk_vreg_fix_vccqx(struct ufs_hba *hba)
+ 	}
+ }
+ 
++static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
++{
++	unsigned long flags;
++	u32 ah_ms = 10;
++	u32 ah_scale, ah_timer;
++	u32 scale_us[] = {1, 10, 100, 1000, 10000, 100000};
++
++	if (ufshcd_is_clkgating_allowed(hba)) {
++		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit) {
++			ah_scale = FIELD_GET(UFSHCI_AHIBERN8_SCALE_MASK,
++					  hba->ahit);
++			ah_timer = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
++					  hba->ahit);
++			if (ah_scale <= 5)
++				ah_ms = ah_timer * scale_us[ah_scale] / 1000;
++		}
++
++		spin_lock_irqsave(hba->host->host_lock, flags);
++		hba->clk_gating.delay_ms = max(ah_ms, 10U);
++		spin_unlock_irqrestore(hba->host->host_lock, flags);
++	}
++}
++
++/* Convert microseconds to Auto-Hibernate Idle Timer register value */
++static u32 ufs_mtk_us_to_ahit(unsigned int timer)
++{
++	unsigned int scale;
++
++	for (scale = 0; timer > UFSHCI_AHIBERN8_TIMER_MASK; ++scale)
++		timer /= UFSHCI_AHIBERN8_SCALE_FACTOR;
++
++	return FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, timer) |
++	       FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, scale);
++}
++
++static void ufs_mtk_fix_ahit(struct ufs_hba *hba)
++{
++	unsigned int us;
++
++	if (ufshcd_is_auto_hibern8_supported(hba)) {
++		switch (hba->dev_info.wmanufacturerid) {
++		case UFS_VENDOR_SAMSUNG:
++			/* configure auto-hibern8 timer to 3.5 ms */
++			us = 3500;
++			break;
++
++		case UFS_VENDOR_MICRON:
++			/* configure auto-hibern8 timer to 2 ms */
++			us = 2000;
++			break;
++
++		default:
++			/* configure auto-hibern8 timer to 1 ms */
++			us = 1000;
++			break;
++		}
++
++		hba->ahit = ufs_mtk_us_to_ahit(us);
++	}
++
++	ufs_mtk_setup_clk_gating(hba);
++}
++
+ static void ufs_mtk_init_mcq_irq(struct ufs_hba *hba)
+ {
+ 	struct ufs_mtk_host *host = ufshcd_get_variant(hba);
+@@ -1206,32 +1269,10 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba)
+ 
+ 	return ret;
+ }
+-
+-static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
+-{
+-	u32 ah_ms;
+-
+-	if (ufshcd_is_clkgating_allowed(hba)) {
+-		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit)
+-			ah_ms = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
+-					  hba->ahit);
+-		else
+-			ah_ms = 10;
+-		ufshcd_clkgate_delay_set(hba->dev, ah_ms + 5);
+-	}
+-}
+-
+ static void ufs_mtk_post_link(struct ufs_hba *hba)
+ {
+ 	/* enable unipro clock gating feature */
+ 	ufs_mtk_cfg_unipro_cg(hba, true);
+-
+-	/* will be configured during probe hba */
+-	if (ufshcd_is_auto_hibern8_supported(hba))
+-		hba->ahit = FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, 10) |
+-			FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, 3);
+-
+-	ufs_mtk_setup_clk_gating(hba);
+ }
+ 
+ static int ufs_mtk_link_startup_notify(struct ufs_hba *hba,
+@@ -1556,6 +1597,7 @@ static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba)
+ 
+ 	ufs_mtk_vreg_fix_vcc(hba);
+ 	ufs_mtk_vreg_fix_vccqx(hba);
++	ufs_mtk_fix_ahit(hba);
+ }
+ 
+ static void ufs_mtk_event_notify(struct ufs_hba *hba,
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch b/queue-6.12/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
new file mode 100644
index 0000000000..2444cd6bdd
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
@@ -0,0 +1,41 @@
+From 9c6e5e599a780b784a3da0e75f6269dafe0d33b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:26 +0800
+Subject: scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
+
+Add a NULL check before accessing the 'vccqx' pointer to prevent invalid
+memory access. This ensures that the function safely handles cases where
+'vccq' and 'vccq2' are not initialized, improving the robustness of the
+power management code.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index c0106fb3792d4..2be74662f960b 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1426,6 +1426,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm)
+ {
+ 	struct ufs_vreg *vccqx = NULL;
+ 
++	if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2)
++		return;
++
+ 	if (hba->vreg_info.vccq)
+ 		vccqx = hba->vreg_info.vccq;
+ 	else
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch b/queue-6.12/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
new file mode 100644
index 0000000000..8f2cfa22d1
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
@@ -0,0 +1,77 @@
+From ccb90f7e1f02673a93d11b237091ea3c4844a0ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:21 +0800
+Subject: scsi: ufs: host: mediatek: Fix PWM mode switch issue
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 7212d624f8638f8ea8ad1ecbb80622c7987bc7a1 ]
+
+Address a failure in switching to PWM mode by ensuring proper
+configuration of power modes and adaptation settings. The changes
+include checks for SLOW_MODE and adjustments to the desired working mode
+and adaptation configuration based on the device's power mode and
+hardware version.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-6-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 5841431d98543..8701d2307ad3f 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1140,6 +1140,10 @@ static bool ufs_mtk_pmc_via_fastauto(struct ufs_hba *hba,
+ 	    dev_req_params->gear_rx < UFS_HS_G4)
+ 		return false;
+ 
++	if (dev_req_params->pwr_tx == SLOW_MODE ||
++	    dev_req_params->pwr_rx == SLOW_MODE)
++		return false;
++
+ 	return true;
+ }
+ 
+@@ -1155,6 +1159,10 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 	host_params.hs_rx_gear = UFS_HS_G5;
+ 	host_params.hs_tx_gear = UFS_HS_G5;
+ 
++	if (dev_max_params->pwr_rx == SLOW_MODE ||
++	    dev_max_params->pwr_tx == SLOW_MODE)
++		host_params.desired_working_mode = UFS_PWM_MODE;
++
+ 	ret = ufshcd_negotiate_pwr_params(&host_params, dev_max_params, dev_req_params);
+ 	if (ret) {
+ 		pr_info("%s: failed to determine capabilities\n",
+@@ -1187,10 +1195,21 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		}
+ 	}
+ 
+-	if (host->hw_ver.major >= 3) {
++	if (dev_req_params->pwr_rx == FAST_MODE ||
++	    dev_req_params->pwr_rx == FASTAUTO_MODE) {
++		if (host->hw_ver.major >= 3) {
++			ret = ufshcd_dme_configure_adapt(hba,
++						   dev_req_params->gear_tx,
++						   PA_INITIAL_ADAPT);
++		} else {
++			ret = ufshcd_dme_configure_adapt(hba,
++				   dev_req_params->gear_tx,
++				   PA_NO_ADAPT);
++		}
++	} else {
+ 		ret = ufshcd_dme_configure_adapt(hba,
+-					   dev_req_params->gear_tx,
+-					   PA_INITIAL_ADAPT);
++			   dev_req_params->gear_tx,
++			   PA_NO_ADAPT);
+ 	}
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.12/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch b/queue-6.12/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
new file mode 100644
index 0000000000..e8078ae8c2
--- /dev/null
+++ b/queue-6.12/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
@@ -0,0 +1,36 @@
+From e33a5c53a9f25ed39491f86d833bab97af03fdb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:45 +0800
+Subject: scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 91cad911edd1612ed28f5cfb2d4c53a8824951a5 ]
+
+Resolve the issue of unbalanced IRQ enablement by setting the
+'is_mcq_intr_enabled' flag after the first successful IRQ enablement.
+Ensure proper tracking of the IRQ state and prevent potential mismatches
+in IRQ handling.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 7d7664f5b72a5..5cb3af17aec47 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1846,6 +1846,7 @@ static int ufs_mtk_config_mcq_irq(struct ufs_hba *hba)
+ 			return ret;
+ 		}
+ 	}
++	host->is_mcq_intr_enabled = true;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-6.12/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..09f7f6a38a
--- /dev/null
+++ b/queue-6.12/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From e8c04e94466786d10d0acb6fd6dd67dfc52cd79e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 46324e73f5035..a7edf43245c2a 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -424,6 +424,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch b/queue-6.12/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
new file mode 100644
index 0000000000..61c48a7cb7
--- /dev/null
+++ b/queue-6.12/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
@@ -0,0 +1,47 @@
+From cdbdd70408cfec8d2b04d68178cbc6d9437c4e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:35:58 -0700
+Subject: selftests: drv-net: rss_ctx: fix the queue count check
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit c158b5a570a188b990ef10ded172b8b93e737826 ]
+
+Commit 0d6ccfe6b319 ("selftests: drv-net: rss_ctx: check for all-zero keys")
+added a skip exception if NIC has fewer than 3 queues enabled,
+but it's just constructing the object, it's not actually rising
+this exception.
+
+Before:
+
+  # Exception| net.lib.py.utils.CmdExitFailure: Command failed: ethtool -X enp1s0 equal 3 hkey d1:cc:77:47:9d:ea:15:f2:b9:6c:ef:68:62:c0:45:d5:b0:99:7d:cf:29:53:40:06:3d:8e:b9:bc:d4:70:89:b8:8d:59:04:ea:a9:c2:21:b3:55:b8:ab:6b:d9:48:b4:bd:4c:ff:a5:f0:a8:c2
+  not ok 1 rss_ctx.test_rss_key_indir
+
+After:
+
+  ok 1 rss_ctx.test_rss_key_indir # SKIP Device has fewer than 3 queues (or doesn't support queue stats)
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250827173558.3259072-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/rss_ctx.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/rss_ctx.py b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+index 9d7adb3cf33b9..4a986a5524a30 100755
+--- a/tools/testing/selftests/drivers/net/hw/rss_ctx.py
++++ b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+@@ -101,7 +101,7 @@ def test_rss_key_indir(cfg):
+ 
+     qcnt = len(_get_rx_cnts(cfg))
+     if qcnt < 3:
+-        KsftSkipEx("Device has fewer than 3 queues (or doesn't support queue stats)")
++        raise KsftSkipEx("Device has fewer than 3 queues (or doesn't support queue stats)")
+ 
+     data = get_rss(cfg)
+     want_keys = ['rss-hash-key', 'rss-hash-function', 'rss-indirection-table']
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch b/queue-6.12/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
new file mode 100644
index 0000000000..ead29b2f78
--- /dev/null
+++ b/queue-6.12/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
@@ -0,0 +1,45 @@
+From bf579b00853138aa5ed3cdf852458d9cd95045c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 10:31:39 -0700
+Subject: selftests: drv-net: rss_ctx: make the test pass with few queues
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit e2cf2d5baa09248d3d50b73522594b778388e3bc ]
+
+rss_ctx.test_rss_key_indir implicitly expects at least 5 queues,
+as it checks that the traffic on first 2 queues is lower than
+the remaining queues when we use all queues. Special case fewer
+queues.
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250901173139.881070-2-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/rss_ctx.py | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/rss_ctx.py b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+index 4a986a5524a30..e9f3ac7f0b8c8 100755
+--- a/tools/testing/selftests/drivers/net/hw/rss_ctx.py
++++ b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+@@ -161,8 +161,13 @@ def test_rss_key_indir(cfg):
+     cnts = _get_rx_cnts(cfg)
+     GenerateTraffic(cfg).wait_pkts_and_stop(20000)
+     cnts = _get_rx_cnts(cfg, prev=cnts)
+-    # First two queues get less traffic than all the rest
+-    ksft_lt(sum(cnts[:2]), sum(cnts[2:]), "traffic distributed: " + str(cnts))
++    if qcnt > 4:
++        # First two queues get less traffic than all the rest
++        ksft_lt(sum(cnts[:2]), sum(cnts[2:]),
++                "traffic distributed: " + str(cnts))
++    else:
++        # When queue count is low make sure third queue got significant pkts
++        ksft_ge(cnts[2], 3500, "traffic distributed: " + str(cnts))
+ 
+ 
+ def test_rss_queue_reconfigure(cfg, main_ctx=True):
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch b/queue-6.12/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
new file mode 100644
index 0000000000..b274bab0b6
--- /dev/null
+++ b/queue-6.12/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
@@ -0,0 +1,171 @@
+From 2cec0dd5985180ff571b4aaedb9d51f94c8d35f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:35:33 +0800
+Subject: selftests: forwarding: Reorder (ar)ping arguments to obey POSIX
+ getopt
+
+From: David Yang <mmyangfl@gmail.com>
+
+[ Upstream commit 50d51cef555ee42fe47dd51b71366a77895e5f0b ]
+
+Quoted from musl wiki:
+
+  GNU getopt permutes argv to pull options to the front, ahead of
+  non-option arguments. musl and the POSIX standard getopt stop
+  processing options at the first non-option argument with no
+  permutation.
+
+Thus these scripts stop working on musl since non-option arguments for
+tools using getopt() (in this case, (ar)ping) do not always come last.
+Fix it by reordering arguments.
+
+Signed-off-by: David Yang <mmyangfl@gmail.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250919053538.1106753-1-mmyangfl@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/custom_multipath_hash.sh     | 2 +-
+ .../selftests/net/forwarding/gre_custom_multipath_hash.sh | 2 +-
+ .../selftests/net/forwarding/ip6_forward_instats_vrf.sh   | 6 +++---
+ .../net/forwarding/ip6gre_custom_multipath_hash.sh        | 2 +-
+ tools/testing/selftests/net/forwarding/lib.sh             | 8 ++++----
+ .../selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh  | 2 +-
+ .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 4 ++--
+ 7 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
+index 7d531f7091e6f..5dbfab0e23e3d 100755
+--- a/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
+@@ -226,7 +226,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:4::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:4::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
+index dda11a4a9450a..b4f17a5bbc614 100755
+--- a/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
+@@ -321,7 +321,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:2::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:2::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+index 49fa94b53a1ca..25036e38043c8 100755
+--- a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
++++ b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+@@ -95,7 +95,7 @@ ipv6_in_too_big_err()
+ 
+ 	# Send too big packets
+ 	ip vrf exec $vrf_name \
+-		$PING6 -s 1300 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -s 1300 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
+ 	test "$((t1 - t0))" -ne 0
+@@ -131,7 +131,7 @@ ipv6_in_addr_err()
+ 	# Disable forwarding temporary while sending the packet
+ 	sysctl -qw net.ipv6.conf.all.forwarding=0
+ 	ip vrf exec $vrf_name \
+-		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 	sysctl -qw net.ipv6.conf.all.forwarding=1
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
+@@ -150,7 +150,7 @@ ipv6_in_discard()
+ 	# Add a policy to discard
+ 	ip xfrm policy add dst 2001:1:2::2/128 dir fwd action block
+ 	ip vrf exec $vrf_name \
+-		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 	ip xfrm policy del dst 2001:1:2::2/128 dir fwd
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InDiscards)
+diff --git a/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
+index e28b4a079e525..b24acfa52a3a7 100755
+--- a/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
+@@ -323,7 +323,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:2::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:2::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 195360082d949..c61da12d12e4b 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -1360,8 +1360,8 @@ ping_do()
+ 
+ 	vrf_name=$(master_name_get $if_name)
+ 	ip vrf exec $vrf_name \
+-		$PING $args $dip -c $PING_COUNT -i 0.1 \
+-		-w $PING_TIMEOUT &> /dev/null
++		$PING $args -c $PING_COUNT -i 0.1 \
++		-w $PING_TIMEOUT $dip &> /dev/null
+ }
+ 
+ ping_test()
+@@ -1391,8 +1391,8 @@ ping6_do()
+ 
+ 	vrf_name=$(master_name_get $if_name)
+ 	ip vrf exec $vrf_name \
+-		$PING6 $args $dip -c $PING_COUNT -i 0.1 \
+-		-w $PING_TIMEOUT &> /dev/null
++		$PING6 $args -c $PING_COUNT -i 0.1 \
++		-w $PING_TIMEOUT $dip &> /dev/null
+ }
+ 
+ ping6_test()
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
+index fe4d7c906a708..04090f4412acf 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
+@@ -237,7 +237,7 @@ test_lag_slave()
+ 	ip neigh flush dev br1
+ 	setup_wait_dev $up_dev
+ 	setup_wait_dev $host_dev
+-	$ARPING -I br1 192.0.2.130 -qfc 1
++	$ARPING -I br1 -qfc 1 192.0.2.130
+ 	sleep 2
+ 	mirror_test vrf-h1 192.0.2.1 192.0.2.18 $host_dev 1 ">= 10"
+ 
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+index 1b902cc579f62..a21c771908b33 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+@@ -196,7 +196,7 @@ test_span_gre_forbidden_egress()
+ 
+ 	bridge vlan add dev $swp3 vid 555
+ 	# Re-prime FDB
+-	$ARPING -I br1.555 192.0.2.130 -fqc 1
++	$ARPING -I br1.555 -fqc 1 192.0.2.130
+ 	sleep 1
+ 	quick_test_span_gre_dir $tundev
+ 
+@@ -290,7 +290,7 @@ test_span_gre_fdb_roaming()
+ 
+ 	bridge fdb del dev $swp2 $h3mac vlan 555 master 2>/dev/null
+ 	# Re-prime FDB
+-	$ARPING -I br1.555 192.0.2.130 -fqc 1
++	$ARPING -I br1.555 -fqc 1 192.0.2.130
+ 	sleep 1
+ 	quick_test_span_gre_dir $tundev
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-6.12/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..22187e6c22
--- /dev/null
+++ b/queue-6.12/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 8ac02870d2c537c83b3934d385ca0f1e1298aa01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 85c5f39131d34..a9e363b7f489f 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -296,7 +296,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-mptcp-join-allow-more-time-to-send-add_add.patch b/queue-6.12/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
new file mode 100644
index 0000000000..53f72e7d1f
--- /dev/null
+++ b/queue-6.12/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
@@ -0,0 +1,52 @@
+From 29118317cc73f208eafd8414dd3465675f06cf56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 17:32:44 +0200
+Subject: selftests: mptcp: join: allow more time to send ADD_ADDR
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit e2cda6343bfe459c3331db5afcd675ab333112dd ]
+
+When many ADD_ADDR need to be sent, it can take some time to send each
+of them, and create new subflows. Some CIs seem to occasionally have
+issues with these tests, especially with "debug" kernels.
+
+Two subtests will now run for a slightly longer time: the last two where
+3 or more ADD_ADDR are sent during the test.
+
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-3-824cc805772b@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+index ec7547bdda89f..7ac63821a8842 100755
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -2125,7 +2125,8 @@ signal_address_tests()
+ 		pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+ 		pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
+ 		pm_nl_set_limits $ns2 3 3
+-		run_tests $ns1 $ns2 10.0.1.1
++		speed=slow \
++			run_tests $ns1 $ns2 10.0.1.1
+ 		chk_join_nr 3 3 3
+ 		chk_add_nr 3 3
+ 	fi
+@@ -2137,7 +2138,8 @@ signal_address_tests()
+ 		pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+ 		pm_nl_add_endpoint $ns1 10.0.14.1 flags signal
+ 		pm_nl_set_limits $ns2 3 3
+-		run_tests $ns1 $ns2 10.0.1.1
++		speed=slow \
++			run_tests $ns1 $ns2 10.0.1.1
+ 		join_syn_tx=3 \
+ 			chk_join_nr 1 1 1
+ 		chk_add_nr 3 3
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-6.12/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..2435c67869
--- /dev/null
+++ b/queue-6.12/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From 13e970fb49a33316098caf12cfcc30da00c0be29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-6.12/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..91e0673f5a
--- /dev/null
+++ b/queue-6.12/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From 42917fea9ccdde41c277c4b6dc5ab62db010ce39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch b/queue-6.12/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
new file mode 100644
index 0000000000..3d36ce506a
--- /dev/null
+++ b/queue-6.12/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
@@ -0,0 +1,1849 @@
+From f56546c334aa6e24377b944b46842c326278e620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:38:37 -0700
+Subject: selftests: net: replace sleeps in fcnal-test with waits
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
+
+fcnal-test.sh already includes lib.sh, use relevant helpers
+instead of sleeping. Replace sleep after starting nettest
+as a server with wait_local_port_listen.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++-----------
+ 1 file changed, 214 insertions(+), 214 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 899dbad0104bf..46324e73f5035 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -875,7 +875,7 @@ ipv4_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -883,7 +883,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -891,7 +891,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -899,7 +899,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -910,7 +910,7 @@ ipv4_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -918,7 +918,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -926,7 +926,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -943,7 +943,7 @@ ipv4_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -951,7 +951,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -959,7 +959,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -967,7 +967,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -978,7 +978,7 @@ ipv4_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -986,7 +986,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -994,7 +994,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -1005,14 +1005,14 @@ ipv4_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1020,7 +1020,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1028,21 +1028,21 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1050,7 +1050,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1058,7 +1058,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -1082,14 +1082,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
+ 	log_start
+ 	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
+ 
+ 	log_start
+ 	show_hint "Binding both the socket and the key is not required but it works"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
+ }
+@@ -1103,25 +1103,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0()
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
+ 	log_start
+ 
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
+ 
+@@ -1193,7 +1193,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -1201,7 +1201,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1221,13 +1221,13 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1249,7 +1249,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1257,7 +1257,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1266,7 +1266,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1274,7 +1274,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -1283,7 +1283,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -1291,7 +1291,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 
+@@ -1323,19 +1323,19 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1352,7 +1352,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -1374,14 +1374,14 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -1396,7 +1396,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "client socket should be bound to device"
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1406,7 +1406,7 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since client is not bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -1418,13 +1418,13 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1443,7 +1443,7 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -1451,26 +1451,26 @@ ipv4_tcp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+ 	log_start
+ 	show_hint "Should fail 'No route to host' since client is out of VRF scope"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ }
+@@ -1509,7 +1509,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -1522,7 +1522,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1533,31 +1533,31 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
+ 
+@@ -1580,7 +1580,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1588,7 +1588,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1597,7 +1597,7 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1605,25 +1605,25 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1636,28 +1636,28 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 2 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1667,7 +1667,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -1709,19 +1709,19 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Fails because ingress is in a VRF and global server is disabled"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1733,7 +1733,7 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is out of scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
+ 	done
+@@ -1741,26 +1741,26 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
+ 
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1775,19 +1775,19 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1802,13 +1802,13 @@ ipv4_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "VRF client"
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -1829,31 +1829,31 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1861,7 +1861,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 	done
+@@ -1870,7 +1870,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -2093,7 +2093,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2107,7 +2107,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2120,7 +2120,7 @@ ipv4_rt()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest ${varg} -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest ${varg} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2134,7 +2134,7 @@ ipv4_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2145,7 +2145,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2161,7 +2161,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2175,7 +2175,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2189,7 +2189,7 @@ ipv4_rt()
+ 	log_start
+ 
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2200,7 +2200,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2211,7 +2211,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2561,7 +2561,7 @@ ipv6_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -2569,7 +2569,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -2577,7 +2577,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -2585,7 +2585,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -2596,7 +2596,7 @@ ipv6_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -2604,7 +2604,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -2612,7 +2612,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -2629,7 +2629,7 @@ ipv6_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -2637,7 +2637,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -2645,7 +2645,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -2653,7 +2653,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -2664,7 +2664,7 @@ ipv6_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -2672,7 +2672,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -2680,7 +2680,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -2691,14 +2691,14 @@ ipv6_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2706,7 +2706,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2714,21 +2714,21 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2736,7 +2736,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2744,7 +2744,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -2772,7 +2772,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2793,7 +2793,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Client"
+ 	done
+@@ -2802,7 +2802,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -2822,7 +2822,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -2830,7 +2830,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -2839,7 +2839,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -2847,7 +2847,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -2856,7 +2856,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -2865,7 +2865,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 	done
+@@ -2898,7 +2898,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -2907,7 +2907,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2916,7 +2916,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2924,7 +2924,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -2943,7 +2943,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -2964,7 +2964,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2973,7 +2973,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2982,13 +2982,13 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2996,7 +2996,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3016,7 +3016,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Fails 'Connection refused' since client is not in VRF"
+ 		run_cmd nettest -6 -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -3029,7 +3029,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 	done
+@@ -3038,7 +3038,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Fails since VRF device does not allow linklocal addresses"
+ 	run_cmd_nsb nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF}
+ 	log_test_addr ${a} $? 1 "Client, VRF bind"
+ 
+@@ -3046,7 +3046,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -3071,7 +3071,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -3079,7 +3079,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+@@ -3087,13 +3087,13 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail since unbound client is out of VRF scope"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+@@ -3101,7 +3101,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 	done
+@@ -3141,13 +3141,13 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3155,7 +3155,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_LO_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -3165,7 +3165,7 @@ ipv6_udp_novrf()
+ 	#log_start
+ 	#show_hint "Should fail since loopback address is out of scope"
+ 	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	#sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	#run_cmd_nsb nettest -6 -D -r ${a}
+ 	#log_test_addr ${a} $? 1 "Device server"
+ 
+@@ -3185,25 +3185,25 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
+ 
+@@ -3225,7 +3225,7 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -3233,7 +3233,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -3242,7 +3242,7 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -6 -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, local connection"
+ 	done
+@@ -3250,19 +3250,19 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
+ 
+@@ -3271,28 +3271,28 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 	done
+@@ -3300,7 +3300,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3314,7 +3314,7 @@ ipv6_udp_novrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3338,7 +3338,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -3347,7 +3347,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3356,7 +3356,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3378,7 +3378,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
+ 	done
+@@ -3387,7 +3387,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -3396,25 +3396,25 @@ ipv6_udp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server is disabled"
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 1 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -3429,7 +3429,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -3438,7 +3438,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3447,7 +3447,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3465,7 +3465,7 @@ ipv6_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
+ 	log_test $? 0 "VRF client"
+ 
+@@ -3476,7 +3476,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -3491,13 +3491,13 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	#log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3505,13 +3505,13 @@ ipv6_udp_vrf()
+ 	a=${VRF_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3527,25 +3527,25 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3557,7 +3557,7 @@ ipv6_udp_vrf()
+ 	# link local addresses
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Global server, linklocal IP"
+ 
+@@ -3568,7 +3568,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, linklocal IP"
+ 
+@@ -3579,7 +3579,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, local conn - linklocal IP"
+ 
+@@ -3592,7 +3592,7 @@ ipv6_udp_vrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3771,7 +3771,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3785,7 +3785,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3799,7 +3799,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3814,7 +3814,7 @@ ipv6_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3825,7 +3825,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3842,7 +3842,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3856,7 +3856,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3869,7 +3869,7 @@ ipv6_rt()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3880,7 +3880,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3891,7 +3891,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3950,7 +3950,7 @@ netfilter_tcp_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -3968,7 +3968,7 @@ netfilter_icmp()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${arg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4007,7 +4007,7 @@ netfilter_tcp6_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -4025,7 +4025,7 @@ netfilter_icmp6()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s ${arg} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4221,12 +4221,12 @@ use_case_snat_on_vrf()
+ 	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
+ 
+ 	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
+ 	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
+ 
+ 	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
+ 	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-replace-sleep-with-slowwait.patch b/queue-6.12/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..f171a56744
--- /dev/null
+++ b/queue-6.12/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From abaff0842775359804ad818fcd97f498e1bbfae2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index a7edf43245c2a..bb2b789541ff4 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -189,7 +189,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ set_ping_group()
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-traceroute-return-correct-value-on-failure.patch b/queue-6.12/selftests-traceroute-return-correct-value-on-failure.patch
new file mode 100644
index 0000000000..183257e711
--- /dev/null
+++ b/queue-6.12/selftests-traceroute-return-correct-value-on-failure.patch
@@ -0,0 +1,124 @@
+From 0a21e37cd6713f6575845ab1a2892e2438af75a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:34 +0300
+Subject: selftests: traceroute: Return correct value on failure
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit c068ba9d3ded56cb1ba4d5135ee84bf8039bd563 ]
+
+The test always returns success even if some tests were modified to
+fail. Fix by converting the test to use the appropriate library
+functions instead of using its own functions.
+
+Before:
+
+ # ./traceroute.sh
+ TEST: IPV6 traceroute                                               [FAIL]
+ TEST: IPV4 traceroute                                               [ OK ]
+
+ Tests passed:   1
+ Tests failed:   1
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: IPv6 traceroute                                               [FAIL]
+         traceroute6 did not return 2000:102::2
+ TEST: IPv4 traceroute                                               [ OK ]
+ $ echo $?
+ 1
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-5-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 38 ++++++-----------------
+ 1 file changed, 9 insertions(+), 29 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index b50e52afa4f49..1ac91eebd16f5 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -10,28 +10,6 @@ PAUSE_ON_FAIL=no
+ 
+ ################################################################################
+ #
+-log_test()
+-{
+-	local rc=$1
+-	local expected=$2
+-	local msg="$3"
+-
+-	if [ ${rc} -eq ${expected} ]; then
+-		printf "TEST: %-60s  [ OK ]\n" "${msg}"
+-		nsuccess=$((nsuccess+1))
+-	else
+-		ret=1
+-		nfail=$((nfail+1))
+-		printf "TEST: %-60s  [FAIL]\n" "${msg}"
+-		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+-			echo
+-			echo "hit enter to continue, 'q' to quit"
+-			read a
+-			[ "$a" = "q" ] && exit 1
+-		fi
+-	fi
+-}
+-
+ run_cmd()
+ {
+ 	local ns
+@@ -205,9 +183,12 @@ run_traceroute6()
+ {
+ 	setup_traceroute6
+ 
++	RET=0
++
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+ 	run_cmd $h1 "traceroute6 2000:103::4 | grep -q 2000:102::2"
+-	log_test $? 0 "IPV6 traceroute"
++	check_err $? "traceroute6 did not return 2000:102::2"
++	log_test "IPv6 traceroute"
+ 
+ 	cleanup_traceroute6
+ }
+@@ -265,9 +246,12 @@ run_traceroute()
+ {
+ 	setup_traceroute
+ 
++	RET=0
++
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+ 	run_cmd $h1 "traceroute 1.0.2.4 | grep -q 1.0.1.1"
+-	log_test $? 0 "IPV4 traceroute"
++	check_err $? "traceroute did not return 1.0.1.1"
++	log_test "IPv4 traceroute"
+ 
+ 	cleanup_traceroute
+ }
+@@ -284,9 +268,6 @@ run_tests()
+ ################################################################################
+ # main
+ 
+-declare -i nfail=0
+-declare -i nsuccess=0
+-
+ while getopts :pv o
+ do
+ 	case $o in
+@@ -301,5 +282,4 @@ require_command traceroute
+ 
+ run_tests
+ 
+-printf "\nTests passed: %3d\n" ${nsuccess}
+-printf "Tests failed: %3d\n"   ${nfail}
++exit "${EXIT_STATUS}"
+-- 
+2.51.0
+
diff --git a/queue-6.12/selftests-traceroute-use-require_command.patch b/queue-6.12/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..4d7032d29d
--- /dev/null
+++ b/queue-6.12/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From b3ef221bd22c624601f870a07b574e13cd74289e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index 282f14760940d..b50e52afa4f49 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -203,11 +203,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -268,11 +263,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -306,6 +296,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-6.12/series b/queue-6.12/series
index 33d930267e..7fb3b8643d 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -162,3 +162,288 @@ mfd-madera-work-around-false-positive-wininitialized.patch
 mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
 mfd-core-increment-of_node-s-refcount-before-linking.patch
 mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
+drm-amd-display-fix-condition-for-setting-timing_adj.patch
+drm-amd-display-ensure-committing-streams-is-seamles.patch
+drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
+drm-amdgpu-check-vcn-sram-load-return-value.patch
+drm-amd-display-move-setup_stream_attribute.patch
+drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
+drm-xe-guc-add-more-guc-load-error-status-codes.patch
+drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
+drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
+drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
+drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
+drm-amd-display-add-more-cyan-skillfish-devices.patch
+drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
+drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
+drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
+drm-amd-display-wait-until-otg-enable-state-is-clear.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
+wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
+drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
+drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
+media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
+pci-err-update-device-error_state-already-after-rese.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+ice-don-t-use-pk-through-printk-or-tracepoints.patch
+thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
+tty-serial-ip22zilog-use-platform-device-for-probing.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
+scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
+scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
+scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
+scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-panthor-serialize-gpu-cache-flush-operations.patch
+hid-pidff-use-direction-fix-only-for-conditional-eff.patch
+hid-pidff-permissive_control-quirk-autodetection.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
+drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
+wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
+dm-error-mark-as-dm_target_passes_integrity.patch
+char-misc-make-misc_register-reentry-for-miscdevice-.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+bnxt_en-add-hyper-v-vf-id.patch
+tty-serial-modify-the-use-of-dev_err_probe.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+idpf-do-not-linearize-big-tso-packets.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+net-wangxun-limit-tx_max_coalesced_frames_irq.patch
+media-ipu6-isys-set-embedded-data-type-correctly-for.patch
+rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
+net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
+scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
+scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
+net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
+fuse-zero-initialize-inode-private-data.patch
+drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
+drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
+drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
+selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
+media-fix-uninitialized-symbol-warnings.patch
+media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
+asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
+drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
+drm-amd-display-incorrect-conditions-for-failing-dto.patch
+drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
+drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-model-to-easy50712-dts.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
+inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
+microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
+tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
+crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
+ptp-limit-time-setting-of-ptp-clocks.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
+drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
+drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
+drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
+selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
+drm-panel-backlight-quirks-make-edid-match-optional.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+media-adv7180-add-missing-lock-in-suspend-callback.patch
+media-adv7180-do-not-write-format-to-device-in-set_f.patch
+media-adv7180-only-validate-format-in-querystd.patch
+media-verisilicon-explicitly-disable-selection-api-i.patch
+wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+pci-imx6-enable-the-vaux-supply-if-available.patch
+drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
+iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
+drm-amd-add-more-cyan-skillfish-pci-ids.patch
+drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
+drm-amd-display-fix-pbn_div-calculation-error.patch
+net-dsa-felix-support-phy-mode-10g-qxgmii.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+usb-cdns3-gadget-use-after-free-during-failed-initia.patch
+tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
+drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
+char-use-list_del_init-in-misc_deregister-to-reiniti.patch
+pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
+wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
+media-ov08x40-fix-the-horizontal-flip-control.patch
+media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
+f2fs-fix-wrong-layout-information-on-16kb-page.patch
+selftests-mptcp-join-allow-more-time-to-send-add_add.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
+scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+scsi-ufs-host-mediatek-correct-system-pm-flow.patch
+scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
+ntfs3-pretend-extend-records-as-regular-files.patch
+wifi-mac80211-fix-he-capabilities-element-check.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+fix-access-to-video_is_primary_device-when-compiled-.patch
+phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
+phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
+drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-traceroute-use-require_command.patch
+selftests-traceroute-return-correct-value-on-failure.patch
+openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
+netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+selftests-replace-sleep-with-slowwait.patch
+net-devmem-expose-tcp_recvmsg_locked-errors.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
+watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
+crypto-sun8i-ce-remove-channel-timeout-field.patch
+pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
+crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
+crypto-caam-double-the-entropy-delay-interval-for-re.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
+wifi-mt76-mt7996-temporarily-disable-epcs.patch
+wifi-mt76-mt76_eeprom_override-to-int.patch
+alsa-serial-generic-remove-shared-static-buffer.patch
+wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
+drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
+drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
+drm-amd-display-fix-dml-ms-order-of-operations.patch
+drm-amd-avoid-evicting-resources-at-s5.patch
+drm-amd-display-fix-dvi-d-hdmi-adapters.patch
+drm-amd-display-disable-vrr-on-dce-6.patch
+drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
+page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
+ethernet-extend-device_get_mac_address-to-use-nvmem.patch
+hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
+drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
+drm-amdgpu-reject-gang-submissions-under-sriov.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-ufs-core-disable-timestamp-functionality-if-not.patch
+scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
+scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
+wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
+wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
+usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
+ipv6-np-rxpmtu-race-annotation.patch
+rdma-irdma-update-kconfig.patch
+ib-ipoib-ignore-l3-master-device.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
+asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
+net-phy-clear-link-parameters-on-admin-link-down.patch
+net-ethernet-microchip-sparx5-make-it-selectable-for.patch
+bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
+iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+wifi-mac80211-track-nan-interface-start-stop.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+sparc64-fix-prototypes-of-reads-bwl.patch
+vfio-return-enotty-for-unsupported-device-feature.patch
+crypto-hisilicon-qm-invalidate-queues-in-use.patch
+crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
+pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
+selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
+net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
+drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
+drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
+drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
+drm-amd-display-change-dc-stream-color-settings-only.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
+scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
+accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
+scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
+accel-habanalabs-return-enomem-if-less-than-requeste.patch
+accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
+accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+ext4-increase-io-priority-of-fastcommit.patch
+amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
+asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
+asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
+acpi-scan-update-honor-list-for-rpmi-system-msi.patch
+vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
+net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
+net-stmmac-est-drop-frames-causing-hlbs-error.patch
+exfat-limit-log-print-for-io-error.patch
+exfat-validate-cluster-allocation-bits-of-the-alloca.patch
+6pack-drop-redundant-locking-and-refcounting.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+ftrace-fix-softlockup-in-ftrace_module_enable.patch
+ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
+smb-client-transport-avoid-reconnects-triggered-by-p.patch
+ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
+usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
+char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
+drm-amd-display-add-fallback-path-for-ycbcr422.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-6.12/smb-client-transport-avoid-reconnects-triggered-by-p.patch b/queue-6.12/smb-client-transport-avoid-reconnects-triggered-by-p.patch
new file mode 100644
index 0000000000..9283208a16
--- /dev/null
+++ b/queue-6.12/smb-client-transport-avoid-reconnects-triggered-by-p.patch
@@ -0,0 +1,70 @@
+From 51a2b72cd0e4364d5f8c32b0a42434eff30103c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:39 +0200
+Subject: smb: client: transport: avoid reconnects triggered by pending task
+ work
+
+From: Fiona Ebner <f.ebner@proxmox.com>
+
+[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
+
+When io_uring is used in the same task as CIFS, there might be
+unnecessary reconnects, causing issues in user-space applications
+like QEMU with a log like:
+
+> CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
+
+Certain io_uring completions might be added to task_work with
+notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for
+the task.
+
+In __smb_send_rqst(), signals are masked before calling
+smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
+
+If sk_stream_wait_memory() is reached via sock_sendmsg() while
+TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to
+true there, and -EINTR will be propagated all the way from
+sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec().
+Afterwards, __smb_send_rqst() will see that not everything was written
+and reconnect.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/transport.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
+index 35d1871187931..691c9265994fb 100644
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -22,6 +22,7 @@
+ #include <linux/mempool.h>
+ #include <linux/sched/signal.h>
+ #include <linux/task_io_accounting_ops.h>
++#include <linux/task_work.h>
+ #include "cifspdu.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+@@ -212,9 +213,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+ 		 * send a packet.  In most cases if we fail to send
+ 		 * after the retries we will kill the socket and
+ 		 * reconnect which may clear the network problem.
++		 *
++		 * Even if regular signals are masked, EINTR might be
++		 * propagated from sk_stream_wait_memory() to here when
++		 * TIF_NOTIFY_SIGNAL is used for task work. For example,
++		 * certain io_uring completions will use that. Treat
++		 * having EINTR with pending task work the same as EAGAIN
++		 * to avoid unnecessary reconnects.
+ 		 */
+ 		rc = sock_sendmsg(ssocket, smb_msg);
+-		if (rc == -EAGAIN) {
++		if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
+ 			retries++;
+ 			if (retries >= 14 ||
+ 			    (!server->noblocksnd && (retries > 2))) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch b/queue-6.12/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
new file mode 100644
index 0000000000..189973e00f
--- /dev/null
+++ b/queue-6.12/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
@@ -0,0 +1,55 @@
+From 7ba721bb09b3ecce671bbc4d06a09fdb33ac56d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:26:10 -0500
+Subject: smsc911x: add second read of EEPROM mac when possible corruption seen
+
+From: Colin Foster <colin.foster@in-advantage.com>
+
+[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
+
+When the EEPROM MAC is read by way of ADDRH, it can return all 0s the
+first time. Subsequent reads succeed.
+
+This is fully reproduceable on the Phytec PCM049 SOM.
+
+Re-read the ADDRH when this behaviour is observed, in an attempt to
+correctly apply the EEPROM MAC address.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 74f1ccc964599..7e8cad0515e86 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2163,10 +2163,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {
+ static void smsc911x_read_mac_address(struct net_device *dev)
+ {
+ 	struct smsc911x_data *pdata = netdev_priv(dev);
+-	u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+-	u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++	u32 mac_high16, mac_low32;
+ 	u8 addr[ETH_ALEN];
+ 
++	mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++
++	/* The first mac_read in some setups can incorrectly read 0. Re-read it
++	 * to get the full MAC if this is observed.
++	 */
++	if (mac_high16 == 0) {
++		SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n");
++		mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	}
++
+ 	addr[0] = (u8)(mac_low32);
+ 	addr[1] = (u8)(mac_low32 >> 8);
+ 	addr[2] = (u8)(mac_low32 >> 16);
+-- 
+2.51.0
+
diff --git a/queue-6.12/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-6.12/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..1c4e6e4fed
--- /dev/null
+++ b/queue-6.12/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From 2c9bd56ca1e26d33a4b0e6314c507e73722ebd9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 8fb09eec8c3e7..694ed081cf8d9 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -58,6 +58,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index b8c51cc23d969..6e3d4dde4f9ab 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -87,6 +87,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-6.12/sparc64-fix-prototypes-of-reads-bwl.patch b/queue-6.12/sparc64-fix-prototypes-of-reads-bwl.patch
new file mode 100644
index 0000000000..1efc436bb6
--- /dev/null
+++ b/queue-6.12/sparc64-fix-prototypes-of-reads-bwl.patch
@@ -0,0 +1,51 @@
+From 757806704e7e4866289db8d3dd92d720eced00cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:42:08 +0100
+Subject: sparc64: fix prototypes of reads[bwl]()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
+
+Conventions for readsl() are the same as for readl() - any __iomem
+pointer is acceptable, both const and volatile ones being OK.  Same
+for readsb() and readsw().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com> # Making sparc64 subject prefix
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/io_64.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
+index c9528e4719cd2..d8ed296624afd 100644
+--- a/arch/sparc/include/asm/io_64.h
++++ b/arch/sparc/include/asm/io_64.h
+@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);
+ #define insw insw
+ #define insl insl
+ 
+-static inline void readsb(void __iomem *port, void *buf, unsigned long count)
++static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insb((unsigned long __force)port, buf, count);
+ }
+ #define readsb readsb
+ 
+-static inline void readsw(void __iomem *port, void *buf, unsigned long count)
++static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insw((unsigned long __force)port, buf, count);
+ }
+ #define readsw readsw
+ 
+-static inline void readsl(void __iomem *port, void *buf, unsigned long count)
++static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insl((unsigned long __force)port, buf, count);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch b/queue-6.12/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
new file mode 100644
index 0000000000..17c17a04ec
--- /dev/null
+++ b/queue-6.12/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
@@ -0,0 +1,44 @@
+From cce5b00476fb294a654016ef00a5cfb1c0943def Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:22 +0000
+Subject: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b62a59c18b692f892dcb8109c1c2e653b2abc95c ]
+
+Use RCU to avoid a pair of atomic operations and a potential
+UAF on dst_dev()->flags.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_fastopen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index 86c995dc1c5e5..f9460e7531ba7 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -575,11 +575,12 @@ void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
+ 		}
+ 	} else if (tp->syn_fastopen_ch &&
+ 		   atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) {
+-		dst = sk_dst_get(sk);
+-		dev = dst ? dst_dev(dst) : NULL;
++		rcu_read_lock();
++		dst = __sk_dst_get(sk);
++		dev = dst ? dst_dev_rcu(dst) : NULL;
+ 		if (!(dev && (dev->flags & IFF_LOOPBACK)))
+ 			atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0);
+-		dst_release(dst);
++		rcu_read_unlock();
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch b/queue-6.12/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
new file mode 100644
index 0000000000..72d8c34d13
--- /dev/null
+++ b/queue-6.12/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,63 @@
+From f2bbdae5da34b8299e60e71c76da261c759c8a5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:42:29 +0200
+Subject: thunderbolt: Use is_pciehp instead of is_hotplug_bridge
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
+
+The thunderbolt driver sets up device link dependencies from hotplug ports
+to the Host Router (aka Native Host Interface, NHI).  When resuming from
+system sleep, this allows the Host Router to re-establish tunnels to
+attached Thunderbolt devices before the hotplug ports resume.
+
+To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
+flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
+
+Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
+more apt to identify them with the is_pciehp flag.
+
+Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
+support and are quirked to use legacy INTx interrupts instead.  The quirk
+identifies them with is_hotplug_bridge, even though all affected ports are
+also matched by is_pciehp.  So use is_pciehp here as well.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c     | 2 +-
+ drivers/thunderbolt/tb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index aa4733787cd7e..18fa918b4e537 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3832,7 +3832,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+  */
+ static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
+ {
+-	if (pdev->is_hotplug_bridge &&
++	if (pdev->is_pciehp &&
+ 	    (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
+ 	     pdev->revision <= 1))
+ 		pdev->no_msi = 1;
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index e1da433a9e7fb..4ef8e67e9987e 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -3242,7 +3242,7 @@ static bool tb_apple_add_links(struct tb_nhi *nhi)
+ 		if (!pci_is_pcie(pdev))
+ 			continue;
+ 		if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
+-		    !pdev->is_hotplug_bridge)
++		    !pdev->is_pciehp)
+ 			continue;
+ 
+ 		link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+-- 
+2.51.0
+
diff --git a/queue-6.12/tty-serial-ip22zilog-use-platform-device-for-probing.patch b/queue-6.12/tty-serial-ip22zilog-use-platform-device-for-probing.patch
new file mode 100644
index 0000000000..b4d295bafb
--- /dev/null
+++ b/queue-6.12/tty-serial-ip22zilog-use-platform-device-for-probing.patch
@@ -0,0 +1,534 @@
+From 01dd303f0c1d6a174dd3500b26ce5f159c15166f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 15:40:17 +0200
+Subject: tty: serial: ip22zilog: Use platform device for probing
+
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+
+[ Upstream commit 3fc36ae6abd263a5cbf93b2f5539eccc1fc753f7 ]
+
+After commit 84a9582fd203 ("serial: core: Start managing serial controllers
+to enable runtime PM") serial drivers need to provide a device in
+struct uart_port.dev otherwise an oops happens. To fix this issue
+for ip22zilog driver switch driver to a platform driver and setup
+the serial device in sgi-ip22 code.
+
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Link: https://lore.kernel.org/r/20250725134018.136113-1-tsbogend@alpha.franken.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/sgi-ip22/ip22-platform.c |  32 +++
+ drivers/tty/serial/ip22zilog.c     | 352 ++++++++++++-----------------
+ 2 files changed, 175 insertions(+), 209 deletions(-)
+
+diff --git a/arch/mips/sgi-ip22/ip22-platform.c b/arch/mips/sgi-ip22/ip22-platform.c
+index 0b2002e02a477..3a53690b4b333 100644
+--- a/arch/mips/sgi-ip22/ip22-platform.c
++++ b/arch/mips/sgi-ip22/ip22-platform.c
+@@ -221,3 +221,35 @@ static int __init sgi_ds1286_devinit(void)
+ }
+ 
+ device_initcall(sgi_ds1286_devinit);
++
++#define SGI_ZILOG_BASE	(HPC3_CHIP0_BASE + \
++			 offsetof(struct hpc3_regs, pbus_extregs[6]) + \
++			 offsetof(struct sgioc_regs, uart))
++
++static struct resource sgi_zilog_resources[] = {
++	{
++		.start	= SGI_ZILOG_BASE,
++		.end	= SGI_ZILOG_BASE + 15,
++		.flags	= IORESOURCE_MEM
++	},
++	{
++		.start	= SGI_SERIAL_IRQ,
++		.end	= SGI_SERIAL_IRQ,
++		.flags	= IORESOURCE_IRQ
++	}
++};
++
++static struct platform_device zilog_device = {
++	.name		= "ip22zilog",
++	.id		= 0,
++	.num_resources	= ARRAY_SIZE(sgi_zilog_resources),
++	.resource	= sgi_zilog_resources,
++};
++
++
++static int __init sgi_zilog_devinit(void)
++{
++	return platform_device_register(&zilog_device);
++}
++
++device_initcall(sgi_zilog_devinit);
+diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
+index c2cae50f06f33..6e19c6713849a 100644
+--- a/drivers/tty/serial/ip22zilog.c
++++ b/drivers/tty/serial/ip22zilog.c
+@@ -30,6 +30,7 @@
+ #include <linux/console.h>
+ #include <linux/spinlock.h>
+ #include <linux/init.h>
++#include <linux/platform_device.h>
+ 
+ #include <linux/io.h>
+ #include <asm/irq.h>
+@@ -50,8 +51,9 @@
+ #define ZSDELAY_LONG()		udelay(20)
+ #define ZS_WSYNC(channel)	do { } while (0)
+ 
+-#define NUM_IP22ZILOG		1
+-#define NUM_CHANNELS		(NUM_IP22ZILOG * 2)
++#define NUM_CHANNELS		2
++#define CHANNEL_B		0
++#define CHANNEL_A		1
+ 
+ #define ZS_CLOCK		3672000	/* Zilog input clock rate. */
+ #define ZS_CLOCK_DIVISOR	16      /* Divisor this driver uses. */
+@@ -62,9 +64,6 @@
+ struct uart_ip22zilog_port {
+ 	struct uart_port		port;
+ 
+-	/* IRQ servicing chain.  */
+-	struct uart_ip22zilog_port	*next;
+-
+ 	/* Current values of Zilog write registers.  */
+ 	unsigned char			curregs[NUM_ZSREGS];
+ 
+@@ -72,7 +71,6 @@ struct uart_ip22zilog_port {
+ #define IP22ZILOG_FLAG_IS_CONS		0x00000004
+ #define IP22ZILOG_FLAG_IS_KGDB		0x00000008
+ #define IP22ZILOG_FLAG_MODEM_STATUS	0x00000010
+-#define IP22ZILOG_FLAG_IS_CHANNEL_A	0x00000020
+ #define IP22ZILOG_FLAG_REGS_HELD	0x00000040
+ #define IP22ZILOG_FLAG_TX_STOPPED	0x00000080
+ #define IP22ZILOG_FLAG_TX_ACTIVE	0x00000100
+@@ -84,6 +82,8 @@ struct uart_ip22zilog_port {
+ 	unsigned char			prev_status;
+ };
+ 
++static struct uart_ip22zilog_port ip22zilog_port_table[NUM_CHANNELS];
++
+ #define ZILOG_CHANNEL_FROM_PORT(PORT)	((struct zilog_channel *)((PORT)->membase))
+ #define UART_ZILOG(PORT)		((struct uart_ip22zilog_port *)(PORT))
+ #define IP22ZILOG_GET_CURR_REG(PORT, REGNUM)		\
+@@ -93,7 +93,6 @@ struct uart_ip22zilog_port {
+ #define ZS_IS_CONS(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_CONS)
+ #define ZS_IS_KGDB(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_KGDB)
+ #define ZS_WANTS_MODEM_STATUS(UP)	((UP)->flags & IP22ZILOG_FLAG_MODEM_STATUS)
+-#define ZS_IS_CHANNEL_A(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_CHANNEL_A)
+ #define ZS_REGS_HELD(UP)	((UP)->flags & IP22ZILOG_FLAG_REGS_HELD)
+ #define ZS_TX_STOPPED(UP)	((UP)->flags & IP22ZILOG_FLAG_TX_STOPPED)
+ #define ZS_TX_ACTIVE(UP)	((UP)->flags & IP22ZILOG_FLAG_TX_ACTIVE)
+@@ -423,60 +422,57 @@ static void ip22zilog_transmit_chars(struct uart_ip22zilog_port *up,
+ 
+ static irqreturn_t ip22zilog_interrupt(int irq, void *dev_id)
+ {
+-	struct uart_ip22zilog_port *up = dev_id;
+-
+-	while (up) {
+-		struct zilog_channel *channel
+-			= ZILOG_CHANNEL_FROM_PORT(&up->port);
+-		unsigned char r3;
+-		bool push = false;
+-
+-		uart_port_lock(&up->port);
+-		r3 = read_zsreg(channel, R3);
++	struct uart_ip22zilog_port *up;
++	struct zilog_channel *channel;
++	unsigned char r3;
++	bool push = false;
+ 
+-		/* Channel A */
+-		if (r3 & (CHAEXT | CHATxIP | CHARxIP)) {
+-			writeb(RES_H_IUS, &channel->control);
+-			ZSDELAY();
+-			ZS_WSYNC(channel);
++	up = &ip22zilog_port_table[CHANNEL_A];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+ 
+-			if (r3 & CHARxIP)
+-				push = ip22zilog_receive_chars(up, channel);
+-			if (r3 & CHAEXT)
+-				ip22zilog_status_handle(up, channel);
+-			if (r3 & CHATxIP)
+-				ip22zilog_transmit_chars(up, channel);
+-		}
+-		uart_port_unlock(&up->port);
++	uart_port_lock(&up->port);
++	r3 = read_zsreg(channel, R3);
+ 
+-		if (push)
+-			tty_flip_buffer_push(&up->port.state->port);
++	/* Channel A */
++	if (r3 & (CHAEXT | CHATxIP | CHARxIP)) {
++		writeb(RES_H_IUS, &channel->control);
++		ZSDELAY();
++		ZS_WSYNC(channel);
+ 
+-		/* Channel B */
+-		up = up->next;
+-		channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+-		push = false;
++		if (r3 & CHARxIP)
++			push = ip22zilog_receive_chars(up, channel);
++		if (r3 & CHAEXT)
++			ip22zilog_status_handle(up, channel);
++		if (r3 & CHATxIP)
++			ip22zilog_transmit_chars(up, channel);
++	}
++	uart_port_unlock(&up->port);
+ 
+-		uart_port_lock(&up->port);
+-		if (r3 & (CHBEXT | CHBTxIP | CHBRxIP)) {
+-			writeb(RES_H_IUS, &channel->control);
+-			ZSDELAY();
+-			ZS_WSYNC(channel);
++	if (push)
++		tty_flip_buffer_push(&up->port.state->port);
+ 
+-			if (r3 & CHBRxIP)
+-				push = ip22zilog_receive_chars(up, channel);
+-			if (r3 & CHBEXT)
+-				ip22zilog_status_handle(up, channel);
+-			if (r3 & CHBTxIP)
+-				ip22zilog_transmit_chars(up, channel);
+-		}
+-		uart_port_unlock(&up->port);
++	/* Channel B */
++	up = &ip22zilog_port_table[CHANNEL_B];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
++	push = false;
+ 
+-		if (push)
+-			tty_flip_buffer_push(&up->port.state->port);
++	uart_port_lock(&up->port);
++	if (r3 & (CHBEXT | CHBTxIP | CHBRxIP)) {
++		writeb(RES_H_IUS, &channel->control);
++		ZSDELAY();
++		ZS_WSYNC(channel);
+ 
+-		up = up->next;
++		if (r3 & CHBRxIP)
++			push = ip22zilog_receive_chars(up, channel);
++		if (r3 & CHBEXT)
++			ip22zilog_status_handle(up, channel);
++		if (r3 & CHBTxIP)
++			ip22zilog_transmit_chars(up, channel);
+ 	}
++	uart_port_unlock(&up->port);
++
++	if (push)
++		tty_flip_buffer_push(&up->port.state->port);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -692,16 +688,16 @@ static void __ip22zilog_reset(struct uart_ip22zilog_port *up)
+ 		udelay(100);
+ 	}
+ 
+-	if (!ZS_IS_CHANNEL_A(up)) {
+-		up++;
+-		channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+-	}
++	up = &ip22zilog_port_table[CHANNEL_A];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
++
+ 	write_zsreg(channel, R9, FHWRES);
+ 	ZSDELAY_LONG();
+ 	(void) read_zsreg(channel, R0);
+ 
+ 	up->flags |= IP22ZILOG_FLAG_RESET_DONE;
+-	up->next->flags |= IP22ZILOG_FLAG_RESET_DONE;
++	up = &ip22zilog_port_table[CHANNEL_B];
++	up->flags |= IP22ZILOG_FLAG_RESET_DONE;
+ }
+ 
+ static void __ip22zilog_startup(struct uart_ip22zilog_port *up)
+@@ -942,47 +938,6 @@ static const struct uart_ops ip22zilog_pops = {
+ 	.verify_port	=	ip22zilog_verify_port,
+ };
+ 
+-static struct uart_ip22zilog_port *ip22zilog_port_table;
+-static struct zilog_layout **ip22zilog_chip_regs;
+-
+-static struct uart_ip22zilog_port *ip22zilog_irq_chain;
+-static int zilog_irq = -1;
+-
+-static void * __init alloc_one_table(unsigned long size)
+-{
+-	return kzalloc(size, GFP_KERNEL);
+-}
+-
+-static void __init ip22zilog_alloc_tables(void)
+-{
+-	ip22zilog_port_table = (struct uart_ip22zilog_port *)
+-		alloc_one_table(NUM_CHANNELS * sizeof(struct uart_ip22zilog_port));
+-	ip22zilog_chip_regs = (struct zilog_layout **)
+-		alloc_one_table(NUM_IP22ZILOG * sizeof(struct zilog_layout *));
+-
+-	if (ip22zilog_port_table == NULL || ip22zilog_chip_regs == NULL) {
+-		panic("IP22-Zilog: Cannot allocate IP22-Zilog tables.");
+-	}
+-}
+-
+-/* Get the address of the registers for IP22-Zilog instance CHIP.  */
+-static struct zilog_layout * __init get_zs(int chip)
+-{
+-	unsigned long base;
+-
+-	if (chip < 0 || chip >= NUM_IP22ZILOG) {
+-		panic("IP22-Zilog: Illegal chip number %d in get_zs.", chip);
+-	}
+-
+-	/* Not probe-able, hard code it. */
+-	base = (unsigned long) &sgioc->uart;
+-
+-	zilog_irq = SGI_SERIAL_IRQ;
+-	request_mem_region(base, 8, "IP22-Zilog");
+-
+-	return (struct zilog_layout *) base;
+-}
+-
+ #define ZS_PUT_CHAR_MAX_DELAY	2000	/* 10 ms */
+ 
+ #ifdef CONFIG_SERIAL_IP22_ZILOG_CONSOLE
+@@ -1070,144 +1025,123 @@ static struct uart_driver ip22zilog_reg = {
+ #endif
+ };
+ 
+-static void __init ip22zilog_prepare(void)
++static void __init ip22zilog_prepare(struct uart_ip22zilog_port *up)
+ {
+ 	unsigned char sysrq_on = IS_ENABLED(CONFIG_SERIAL_IP22_ZILOG_CONSOLE);
++	int brg;
++
++	spin_lock_init(&up->port.lock);
++
++	up->port.iotype = UPIO_MEM;
++	up->port.uartclk = ZS_CLOCK;
++	up->port.fifosize = 1;
++	up->port.has_sysrq = sysrq_on;
++	up->port.ops = &ip22zilog_pops;
++	up->port.type = PORT_IP22ZILOG;
++
++	/* Normal serial TTY. */
++	up->parity_mask = 0xff;
++	up->curregs[R1] = EXT_INT_ENAB | INT_ALL_Rx | TxINT_ENAB;
++	up->curregs[R4] = PAR_EVEN | X16CLK | SB1;
++	up->curregs[R3] = RxENAB | Rx8;
++	up->curregs[R5] = TxENAB | Tx8;
++	up->curregs[R9] = NV | MIE;
++	up->curregs[R10] = NRZ;
++	up->curregs[R11] = TCBR | RCBR;
++	brg = BPS_TO_BRG(9600, ZS_CLOCK / ZS_CLOCK_DIVISOR);
++	up->curregs[R12] = (brg & 0xff);
++	up->curregs[R13] = (brg >> 8) & 0xff;
++	up->curregs[R14] = BRENAB;
++}
++
++static int ip22zilog_probe(struct platform_device *pdev)
++{
+ 	struct uart_ip22zilog_port *up;
+-	struct zilog_layout *rp;
+-	int channel, chip;
++	char __iomem *membase;
++	struct resource *res;
++	int irq;
++	int i;
+ 
+-	/*
+-	 * Temporary fix.
+-	 */
+-	for (channel = 0; channel < NUM_CHANNELS; channel++)
+-		spin_lock_init(&ip22zilog_port_table[channel].port.lock);
+-
+-	ip22zilog_irq_chain = &ip22zilog_port_table[NUM_CHANNELS - 1];
+-        up = &ip22zilog_port_table[0];
+-	for (channel = NUM_CHANNELS - 1 ; channel > 0; channel--)
+-		up[channel].next = &up[channel - 1];
+-	up[channel].next = NULL;
+-
+-	for (chip = 0; chip < NUM_IP22ZILOG; chip++) {
+-		if (!ip22zilog_chip_regs[chip]) {
+-			ip22zilog_chip_regs[chip] = rp = get_zs(chip);
+-
+-			up[(chip * 2) + 0].port.membase = (char *) &rp->channelB;
+-			up[(chip * 2) + 1].port.membase = (char *) &rp->channelA;
+-
+-			/* In theory mapbase is the physical address ...  */
+-			up[(chip * 2) + 0].port.mapbase =
+-				(unsigned long) ioremap((unsigned long) &rp->channelB, 8);
+-			up[(chip * 2) + 1].port.mapbase =
+-				(unsigned long) ioremap((unsigned long) &rp->channelA, 8);
+-		}
++	up = &ip22zilog_port_table[CHANNEL_B];
++	if (up->port.dev)
++		return -ENOSPC;
+ 
+-		/* Channel A */
+-		up[(chip * 2) + 0].port.iotype = UPIO_MEM;
+-		up[(chip * 2) + 0].port.irq = zilog_irq;
+-		up[(chip * 2) + 0].port.uartclk = ZS_CLOCK;
+-		up[(chip * 2) + 0].port.fifosize = 1;
+-		up[(chip * 2) + 0].port.has_sysrq = sysrq_on;
+-		up[(chip * 2) + 0].port.ops = &ip22zilog_pops;
+-		up[(chip * 2) + 0].port.type = PORT_IP22ZILOG;
+-		up[(chip * 2) + 0].port.flags = 0;
+-		up[(chip * 2) + 0].port.line = (chip * 2) + 0;
+-		up[(chip * 2) + 0].flags = 0;
+-
+-		/* Channel B */
+-		up[(chip * 2) + 1].port.iotype = UPIO_MEM;
+-		up[(chip * 2) + 1].port.irq = zilog_irq;
+-		up[(chip * 2) + 1].port.uartclk = ZS_CLOCK;
+-		up[(chip * 2) + 1].port.fifosize = 1;
+-		up[(chip * 2) + 1].port.has_sysrq = sysrq_on;
+-		up[(chip * 2) + 1].port.ops = &ip22zilog_pops;
+-		up[(chip * 2) + 1].port.type = PORT_IP22ZILOG;
+-		up[(chip * 2) + 1].port.line = (chip * 2) + 1;
+-		up[(chip * 2) + 1].flags |= IP22ZILOG_FLAG_IS_CHANNEL_A;
+-	}
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
+ 
+-	for (channel = 0; channel < NUM_CHANNELS; channel++) {
+-		struct uart_ip22zilog_port *up = &ip22zilog_port_table[channel];
+-		int brg;
++	membase = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
++	if (IS_ERR(membase))
++		return PTR_ERR(membase);
+ 
+-		/* Normal serial TTY. */
+-		up->parity_mask = 0xff;
+-		up->curregs[R1] = EXT_INT_ENAB | INT_ALL_Rx | TxINT_ENAB;
+-		up->curregs[R4] = PAR_EVEN | X16CLK | SB1;
+-		up->curregs[R3] = RxENAB | Rx8;
+-		up->curregs[R5] = TxENAB | Tx8;
+-		up->curregs[R9] = NV | MIE;
+-		up->curregs[R10] = NRZ;
+-		up->curregs[R11] = TCBR | RCBR;
+-		brg = BPS_TO_BRG(9600, ZS_CLOCK / ZS_CLOCK_DIVISOR);
+-		up->curregs[R12] = (brg & 0xff);
+-		up->curregs[R13] = (brg >> 8) & 0xff;
+-		up->curregs[R14] = BRENAB;
+-	}
+-}
++	ip22zilog_prepare(up);
+ 
+-static int __init ip22zilog_ports_init(void)
+-{
+-	int ret;
++	up->port.mapbase = res->start + offsetof(struct zilog_layout, channelB);
++	up->port.membase = membase + offsetof(struct zilog_layout, channelB);
++	up->port.line = 0;
++	up->port.dev = &pdev->dev;
++	up->port.irq = irq;
+ 
+-	printk(KERN_INFO "Serial: IP22 Zilog driver (%d chips).\n", NUM_IP22ZILOG);
++	up = &ip22zilog_port_table[CHANNEL_A];
++	ip22zilog_prepare(up);
+ 
+-	ip22zilog_prepare();
++	up->port.mapbase = res->start + offsetof(struct zilog_layout, channelA);
++	up->port.membase = membase + offsetof(struct zilog_layout, channelA);
++	up->port.line = 1;
++	up->port.dev = &pdev->dev;
++	up->port.irq = irq;
+ 
+-	if (request_irq(zilog_irq, ip22zilog_interrupt, 0,
+-			"IP22-Zilog", ip22zilog_irq_chain)) {
++	if (request_irq(irq, ip22zilog_interrupt, 0,
++			"IP22-Zilog", NULL)) {
+ 		panic("IP22-Zilog: Unable to register zs interrupt handler.\n");
+ 	}
+ 
+-	ret = uart_register_driver(&ip22zilog_reg);
+-	if (ret == 0) {
+-		int i;
+-
+-		for (i = 0; i < NUM_CHANNELS; i++) {
+-			struct uart_ip22zilog_port *up = &ip22zilog_port_table[i];
+-
+-			uart_add_one_port(&ip22zilog_reg, &up->port);
+-		}
+-	}
+-
+-	return ret;
+-}
+-
+-static int __init ip22zilog_init(void)
+-{
+-	/* IP22 Zilog setup is hard coded, no probing to do.  */
+-	ip22zilog_alloc_tables();
+-	ip22zilog_ports_init();
++	for (i = 0; i < NUM_CHANNELS; i++)
++		uart_add_one_port(&ip22zilog_reg,
++				  &ip22zilog_port_table[i].port);
+ 
+ 	return 0;
+ }
+ 
+-static void __exit ip22zilog_exit(void)
++static void ip22zilog_remove(struct platform_device *pdev)
+ {
+ 	int i;
+-	struct uart_ip22zilog_port *up;
+ 
+ 	for (i = 0; i < NUM_CHANNELS; i++) {
+-		up = &ip22zilog_port_table[i];
+-
+-		uart_remove_one_port(&ip22zilog_reg, &up->port);
++		uart_remove_one_port(&ip22zilog_reg,
++				     &ip22zilog_port_table[i].port);
++		ip22zilog_port_table[i].port.dev = NULL;
+ 	}
++}
+ 
+-	/* Free IO mem */
+-	up = &ip22zilog_port_table[0];
+-	for (i = 0; i < NUM_IP22ZILOG; i++) {
+-		if (up[(i * 2) + 0].port.mapbase) {
+-		   iounmap((void*)up[(i * 2) + 0].port.mapbase);
+-		   up[(i * 2) + 0].port.mapbase = 0;
+-		}
+-		if (up[(i * 2) + 1].port.mapbase) {
+-			iounmap((void*)up[(i * 2) + 1].port.mapbase);
+-			up[(i * 2) + 1].port.mapbase = 0;
+-		}
++static struct platform_driver ip22zilog_driver = {
++	.probe	= ip22zilog_probe,
++	.remove	= ip22zilog_remove,
++	.driver	= {
++		.name = "ip22zilog"
+ 	}
++};
++
++static int __init ip22zilog_init(void)
++{
++	int ret;
++
++	ret = uart_register_driver(&ip22zilog_reg);
++	if (ret)
++		return ret;
++
++	ret = platform_driver_register(&ip22zilog_driver);
++	if (ret)
++		uart_unregister_driver(&ip22zilog_reg);
+ 
++	return ret;
++
++}
++
++static void __exit ip22zilog_exit(void)
++{
+ 	uart_unregister_driver(&ip22zilog_reg);
++	platform_driver_unregister(&ip22zilog_driver);
+ }
+ 
+ module_init(ip22zilog_init);
+-- 
+2.51.0
+
diff --git a/queue-6.12/tty-serial-modify-the-use-of-dev_err_probe.patch b/queue-6.12/tty-serial-modify-the-use-of-dev_err_probe.patch
new file mode 100644
index 0000000000..5246bda7f8
--- /dev/null
+++ b/queue-6.12/tty-serial-modify-the-use-of-dev_err_probe.patch
@@ -0,0 +1,54 @@
+From 2607c10c907b5399299dd64649b48e7a9095a143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:09:27 +0800
+Subject: tty: serial: Modify the use of dev_err_probe()
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit 706c3c02eecd41dc675e9102b3719661cd3e30e2 ]
+
+The dev_err_probe() doesn't do anything when error is '-ENOMEM'.
+Make the following two changes:
+(1) Replace -ENOMEM with -ENOSPC in max3100_probe().
+(2) Just return -ENOMEM instead in max310x_probe().
+
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250819120927.607744-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max3100.c | 2 +-
+ drivers/tty/serial/max310x.c | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c
+index cde5f1c86353e..e0fc010a9b9ff 100644
+--- a/drivers/tty/serial/max3100.c
++++ b/drivers/tty/serial/max3100.c
+@@ -704,7 +704,7 @@ static int max3100_probe(struct spi_device *spi)
+ 			break;
+ 	if (i == MAX_MAX3100) {
+ 		mutex_unlock(&max3100s_lock);
+-		return dev_err_probe(dev, -ENOMEM, "too many MAX3100 chips\n");
++		return dev_err_probe(dev, -ENOSPC, "too many MAX3100 chips\n");
+ 	}
+ 
+ 	max3100s[i] = kzalloc(sizeof(struct max3100_port), GFP_KERNEL);
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 2f8e3ea4fe128..9850446ae7037 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1266,8 +1266,7 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty
+ 	/* Alloc port structure */
+ 	s = devm_kzalloc(dev, struct_size(s, p, devtype->nr), GFP_KERNEL);
+ 	if (!s)
+-		return dev_err_probe(dev, -ENOMEM,
+-				     "Error allocating port structure\n");
++		return -ENOMEM;
+ 
+ 	/* Always ask for fixed clock rate from a property. */
+ 	device_property_read_u32(dev, "clock-frequency", &uartclk);
+-- 
+2.51.0
+
diff --git a/queue-6.12/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch b/queue-6.12/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
new file mode 100644
index 0000000000..5a5fd0649e
--- /dev/null
+++ b/queue-6.12/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
@@ -0,0 +1,39 @@
+From 16e2c18d678ee44c2fd5e2daba05ca2ff6ed9944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 10:39:55 +0800
+Subject: tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
+
+From: Zizhi Wo <wozizhi@huaweicloud.com>
+
+[ Upstream commit da7e8b3823962b13e713d4891e136a261ed8e6a2 ]
+
+In vt_ioctl(), the handler for VT_RESIZE always returns 0, which prevents
+users from detecting errors. Add the missing return value so that errors
+can be properly reported to users like vt_resizex().
+
+Signed-off-by: Zizhi Wo <wozizhi@huaweicloud.com>
+Link: https://lore.kernel.org/r/20250904023955.3892120-1-wozizhi@huaweicloud.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt_ioctl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 1f2bdd2e1cc59..387b691826623 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -923,7 +923,9 @@ int vt_ioctl(struct tty_struct *tty,
+ 
+ 			if (vc) {
+ 				/* FIXME: review v tty lock */
+-				__vc_resize(vc_cons[i].d, cc, ll, true);
++				ret = __vc_resize(vc_cons[i].d, cc, ll, true);
++				if (ret)
++					return ret;
+ 			}
+ 		}
+ 		console_unlock();
+-- 
+2.51.0
+
diff --git a/queue-6.12/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-6.12/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..bfec58eb69
--- /dev/null
+++ b/queue-6.12/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 921994457f8d15b5baa640af41eaeb2e34d4c8c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index b6d2d16189c0c..6d13d2f829243 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -892,7 +892,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-cdns3-gadget-use-after-free-during-failed-initia.patch b/queue-6.12/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
new file mode 100644
index 0000000000..efa3267778
--- /dev/null
+++ b/queue-6.12/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
@@ -0,0 +1,62 @@
+From 3da4a59207e6279a198cf01b1e20a8f14db04edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:48:42 +0800
+Subject: usb: cdns3: gadget: Use-after-free during failed initialization and
+ exit of cdnsp gadget
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
+
+In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
+structure (pdev->gadget) was freed before its endpoints.
+The endpoints are linked via the ep_list in the gadget structure.
+Freeing the gadget first leaves dangling pointers in the endpoint list.
+When the endpoints are subsequently freed, this results in a use-after-free.
+
+Fix:
+By separating the usb_del_gadget_udc() operation into distinct "del" and
+"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
+final release of the gadget structure with usb_put_gadget().
+
+A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
+ only after freeing endpoints").
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index 38e693cd3efc0..fb192b120d77f 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
+ 	return 0;
+ 
+ del_gadget:
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
++	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
++	goto halt_pdev;
+ free_endpoints:
+ 	cdnsp_gadget_free_endpoints(pdev);
+ halt_pdev:
+@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
+ 	devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
+ 	pm_runtime_mark_last_busy(cdns->dev);
+ 	pm_runtime_put_autosuspend(cdns->dev);
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
+ 	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
+ 	cdnsp_mem_cleanup(pdev);
+ 	kfree(pdev);
+ 	cdns->gadget_dev = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-6.12/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..78d0154607
--- /dev/null
+++ b/queue-6.12/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From 717c15a5aec620977338ab74e8c6c7a168fd4973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 92c883440e02c..f7be1548cc18a 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2418,7 +2418,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2442,6 +2447,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-6.12/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..86d0227bb1
--- /dev/null
+++ b/queue-6.12/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From 903e0b85a729c9ccb580794912cc13f7c1018695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index ab4d170469f57..34d49d96def61 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -526,7 +526,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -982,7 +982,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-6.12/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..999e83ae2c
--- /dev/null
+++ b/queue-6.12/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From 9f7fb58080b3b0c2a96f8d3433cbd770b733888c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 3afc9a622086c..28e57d93973ac 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1464,6 +1464,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us))
+@@ -1759,7 +1761,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-6.12/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..9d2ec43176
--- /dev/null
+++ b/queue-6.12/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From 9701c361e73d8ab8b90d6f80ef29cd1b9fbf7126 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index afb71c18415dd..01aa6a795d275 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch b/queue-6.12/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
new file mode 100644
index 0000000000..5e9df51dbb
--- /dev/null
+++ b/queue-6.12/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
@@ -0,0 +1,97 @@
+From edf2e2dc20c9839870b3b7297db0c5dcf0993185 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:22 +0300
+Subject: usb: xhci-pci: add support for hosts with zero USB3 ports
+
+From: Niklas Neronin <niklas.neronin@linux.intel.com>
+
+[ Upstream commit 719de070f764e079cdcb4ddeeb5b19b3ddddf9c1 ]
+
+Add xhci support for PCI hosts that have zero USB3 ports.
+Avoid creating a shared Host Controller Driver (HCD) when there is only
+one root hub. Additionally, all references to 'xhci->shared_hcd' are now
+checked before use.
+
+Only xhci-pci.c requires modification to accommodate this change, as the
+xhci core already supports configurations with zero USB3 ports. This
+capability was introduced when xHCI Platform and MediaTek added support
+for zero USB3 ports.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220181
+Tested-by: Nick Nielsen <nick.kainielsen@free.fr>
+Tested-by: grm1 <grm1@mailbox.org>
+Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 42 +++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 234efb9731b2c..933d9fdd9516b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -616,7 +616,7 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ {
+ 	int retval;
+ 	struct xhci_hcd *xhci;
+-	struct usb_hcd *hcd;
++	struct usb_hcd *hcd, *usb3_hcd;
+ 	struct reset_control *reset;
+ 
+ 	reset = devm_reset_control_get_optional_exclusive(&dev->dev, NULL);
+@@ -642,26 +642,32 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	hcd = dev_get_drvdata(&dev->dev);
+ 	xhci = hcd_to_xhci(hcd);
+ 	xhci->reset = reset;
+-	xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
+-						 pci_name(dev), hcd);
+-	if (!xhci->shared_hcd) {
+-		retval = -ENOMEM;
+-		goto dealloc_usb2_hcd;
+-	}
+ 
+-	retval = xhci_ext_cap_init(xhci);
+-	if (retval)
+-		goto put_usb3_hcd;
++	xhci->allow_single_roothub = 1;
++	if (!xhci_has_one_roothub(xhci)) {
++		xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
++							 pci_name(dev), hcd);
++		if (!xhci->shared_hcd) {
++			retval = -ENOMEM;
++			goto dealloc_usb2_hcd;
++		}
+ 
+-	retval = usb_add_hcd(xhci->shared_hcd, dev->irq,
+-			IRQF_SHARED);
+-	if (retval)
+-		goto put_usb3_hcd;
+-	/* Roothub already marked as USB 3.0 speed */
++		retval = xhci_ext_cap_init(xhci);
++		if (retval)
++			goto put_usb3_hcd;
++
++		retval = usb_add_hcd(xhci->shared_hcd, dev->irq, IRQF_SHARED);
++		if (retval)
++			goto put_usb3_hcd;
++	} else {
++		retval = xhci_ext_cap_init(xhci);
++		if (retval)
++			goto dealloc_usb2_hcd;
++	}
+ 
+-	if (!(xhci->quirks & XHCI_BROKEN_STREAMS) &&
+-			HCC_MAX_PSA(xhci->hcc_params) >= 4)
+-		xhci->shared_hcd->can_do_streams = 1;
++	usb3_hcd = xhci_get_usb3_hcd(xhci);
++	if (usb3_hcd && !(xhci->quirks & XHCI_BROKEN_STREAMS) && HCC_MAX_PSA(xhci->hcc_params) >= 4)
++		usb3_hcd->can_do_streams = 1;
+ 
+ 	/* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ 	pm_runtime_put_noidle(&dev->dev);
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch b/queue-6.12/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
new file mode 100644
index 0000000000..d7f4c6d0dc
--- /dev/null
+++ b/queue-6.12/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
@@ -0,0 +1,61 @@
+From 67e0ecbe4e39b00f9f542c01eb66fbfb4a07d9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 01:55:40 +0300
+Subject: usb: xhci-pci: Fix USB2-only root hub registration
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 8607edcd1748503f4f58e66ca0216170f260c79b ]
+
+A recent change to hide USB3 root hubs of USB2-only controllers broke
+registration of USB2 root hubs - allow_single_roothub is set too late,
+and by this time xhci_run() has already deferred root hub registration
+until after the shared HCD is added, which will never happen.
+
+This makes such controllers unusable, but testers didn't notice since
+they were only bothered by warnings about empty USB3 root hubs. The bug
+causes problems to other people who actually use such HCs and I was
+able to confirm it on an ordinary HC by patching to ignore USB3 ports.
+
+Setting allow_single_roothub during early setup fixes things.
+
+Reported-by: Arisa Snowbell <arisa.snowbell@gmail.com>
+Closes: https://lore.kernel.org/linux-usb/CABpa4MA9unucCoKtSdzJyOLjHNVy+Cwgz5AnAxPkKw6vuox1Nw@mail.gmail.com/
+Reported-by: Michal Kubecek <mkubecek@suse.cz>
+Closes: https://lore.kernel.org/linux-usb/lnb5bum7dnzkn3fc7gq6hwigslebo7o4ccflcvsc3lvdgnu7el@fvqpobbdoapl/
+Fixes: 719de070f764 ("usb: xhci-pci: add support for hosts with zero USB3 ports")
+Tested-by: Arisa Snowbell <arisa.snowbell@gmail.com>
+Tested-by: Michal Kubecek <mkubecek@suse.cz>
+Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 933d9fdd9516b..5f60528453e91 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -588,6 +588,8 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ 	if (!usb_hcd_is_primary_hcd(hcd))
+ 		return 0;
+ 
++	xhci->allow_single_roothub = 1;
++
+ 	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+ 		xhci_pme_acpi_rtd3_enable(pdev);
+ 
+@@ -643,7 +645,6 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	xhci = hcd_to_xhci(hcd);
+ 	xhci->reset = reset;
+ 
+-	xhci->allow_single_roothub = 1;
+ 	if (!xhci_has_one_roothub(xhci)) {
+ 		xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
+ 							 pci_name(dev), hcd);
+-- 
+2.51.0
+
diff --git a/queue-6.12/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-6.12/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..6d4b45fd90
--- /dev/null
+++ b/queue-6.12/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From 3b22480b71785f5a8997bd0779f13fe3085f2ebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 8cf278a40bd91..448656d68e494 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -171,6 +171,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
+ 		return ret;
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch b/queue-6.12/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
new file mode 100644
index 0000000000..61b3a4dfb3
--- /dev/null
+++ b/queue-6.12/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
@@ -0,0 +1,77 @@
+From e96e63a33b641138cbe97ff631e50c3b1298e85e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 12:04:33 -0500
+Subject: vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
+
+From: Timothy Pearson <tpearson@raptorengineering.com>
+
+[ Upstream commit 8b9f128947dd72e0fcf256088a673abac9b720bf ]
+
+PCI devices prior to PCI 2.3 both use level interrupts and do not support
+interrupt masking, leading to a failure when passed through to a KVM guest on
+at least the ppc64 platform. This failure manifests as receiving and
+acknowledging a single interrupt in the guest, while the device continues to
+assert the level interrupt indicating a need for further servicing.
+
+When lazy IRQ masking is used on DisINTx- (non-PCI 2.3) hardware, the following
+sequence occurs:
+
+ * Level IRQ assertion on device
+ * IRQ marked disabled in kernel
+ * Host interrupt handler exits without clearing the interrupt on the device
+ * Eventfd is delivered to userspace
+ * Guest processes IRQ and clears device interrupt
+ * Device de-asserts INTx, then re-asserts INTx while the interrupt is masked
+ * Newly asserted interrupt acknowledged by kernel VMM without being handled
+ * Software mask removed by VFIO driver
+ * Device INTx still asserted, host controller does not see new edge after EOI
+
+The behavior is now platform-dependent.  Some platforms (amd64) will continue
+to spew IRQs for as long as the INTX line remains asserted, therefore the IRQ
+will be handled by the host as soon as the mask is dropped.  Others (ppc64) will
+only send the one request, and if it is not handled no further interrupts will
+be sent.  The former behavior theoretically leaves the system vulnerable to
+interrupt storm, and the latter will result in the device stalling after
+receiving exactly one interrupt in the guest.
+
+Work around this by disabling lazy IRQ masking for DisINTx- INTx devices.
+
+Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
+Link: https://lore.kernel.org/r/333803015.1744464.1758647073336.JavaMail.zimbra@raptorengineeringinc.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_intrs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
+index 565966351dfad..b2cf1af7fb0c7 100644
+--- a/drivers/vfio/pci/vfio_pci_intrs.c
++++ b/drivers/vfio/pci/vfio_pci_intrs.c
+@@ -304,9 +304,14 @@ static int vfio_intx_enable(struct vfio_pci_core_device *vdev,
+ 
+ 	vdev->irq_type = VFIO_PCI_INTX_IRQ_INDEX;
+ 
++	if (!vdev->pci_2_3)
++		irq_set_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
++
+ 	ret = request_irq(pdev->irq, vfio_intx_handler,
+ 			  irqflags, ctx->name, ctx);
+ 	if (ret) {
++		if (!vdev->pci_2_3)
++			irq_clear_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
+ 		vdev->irq_type = VFIO_PCI_NUM_IRQS;
+ 		kfree(name);
+ 		vfio_irq_ctx_free(vdev, ctx, 0);
+@@ -352,6 +357,8 @@ static void vfio_intx_disable(struct vfio_pci_core_device *vdev)
+ 		vfio_virqfd_disable(&ctx->unmask);
+ 		vfio_virqfd_disable(&ctx->mask);
+ 		free_irq(pdev->irq, ctx);
++		if (!vdev->pci_2_3)
++			irq_clear_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
+ 		if (ctx->trigger)
+ 			eventfd_ctx_put(ctx->trigger);
+ 		kfree(ctx->name);
+-- 
+2.51.0
+
diff --git a/queue-6.12/vfio-return-enotty-for-unsupported-device-feature.patch b/queue-6.12/vfio-return-enotty-for-unsupported-device-feature.patch
new file mode 100644
index 0000000000..8dbd6e60a1
--- /dev/null
+++ b/queue-6.12/vfio-return-enotty-for-unsupported-device-feature.patch
@@ -0,0 +1,40 @@
+From 7be3b53b128dec16f2e32d6fb787ea2aeb19e6ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 08:58:40 -0700
+Subject: vfio: return -ENOTTY for unsupported device feature
+
+From: Alex Mastro <amastro@fb.com>
+
+[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
+
+The two implementers of vfio_device_ops.device_feature,
+vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return
+-ENOTTY in the fallthrough case when the feature is unsupported. For
+consistency, the base case, vfio_ioctl_device_feature, should do the
+same when device_feature == NULL, indicating an implementation has no
+feature extensions.
+
+Signed-off-by: Alex Mastro <amastro@fb.com>
+Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
+index ae78822f2d715..0ed42769742a8 100644
+--- a/drivers/vfio/vfio_main.c
++++ b/drivers/vfio/vfio_main.c
+@@ -1251,7 +1251,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device,
+ 			feature.argsz - minsz);
+ 	default:
+ 		if (unlikely(!device->ops->device_feature))
+-			return -EINVAL;
++			return -ENOTTY;
+ 		return device->ops->device_feature(device, feature.flags,
+ 						   arg->data,
+ 						   feature.argsz - minsz);
+-- 
+2.51.0
+
diff --git a/queue-6.12/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch b/queue-6.12/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
new file mode 100644
index 0000000000..fdb52906d3
--- /dev/null
+++ b/queue-6.12/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
@@ -0,0 +1,59 @@
+From 372dc042f5661c3fbbb0fe1b6ad6dd290633d3d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:18:23 +0900
+Subject: watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
+
+From: Sangwook Shin <sw617.shin@samsung.com>
+
+[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
+
+Fix the issue of max_timeout being calculated larger than actual value.
+The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) /
+S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder
+is discarded during the calculation process. This leads to a larger
+calculated value for max_timeout compared to the actual settable value.
+To resolve this issue, the order of calculations in the computation process
+has been adjusted.
+
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Signed-off-by: Sangwook Shin <sw617.shin@samsung.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/s3c2410_wdt.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
+index 349d30462c8c0..4b75c0594c872 100644
+--- a/drivers/watchdog/s3c2410_wdt.c
++++ b/drivers/watchdog/s3c2410_wdt.c
+@@ -27,6 +27,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
+ #include <linux/delay.h>
++#include <linux/math64.h>
+ 
+ #define S3C2410_WTCON		0x00
+ #define S3C2410_WTDAT		0x04
+@@ -344,9 +345,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)
+ static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt)
+ {
+ 	const unsigned long freq = s3c2410wdt_get_freq(wdt);
++	const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) *
++			S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT;
++	u64 t_max = div64_ul(n_max, freq);
+ 
+-	return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1)
+-				       / S3C2410_WTCON_MAXDIV);
++	if (t_max > UINT_MAX)
++		t_max = UINT_MAX;
++
++	return t_max;
+ }
+ 
+ static int s3c2410wdt_disable_wdt_reset(struct s3c2410_wdt *wdt, bool mask)
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-6.12/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..1edcc0d3c5
--- /dev/null
+++ b/queue-6.12/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From ee3dc1ec7e25de6983084fb18f7bdd03a602e5ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 6493731333abb..74ee3c4f7a6a2 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -14,6 +14,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -288,8 +289,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch b/queue-6.12/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
new file mode 100644
index 0000000000..7ca9127329
--- /dev/null
+++ b/queue-6.12/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
@@ -0,0 +1,41 @@
+From 1c7639441cb46d726f310c65c07f081ca1c89a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:47:44 +0530
+Subject: wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
+
+From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+
+[ Upstream commit 82993345aef6987a916337ebd2fca3ff4a6250a7 ]
+
+Increase DP_REO_CMD_RING_SIZE from 128 to 256 to avoid
+queuing failures observed during stress test scenarios.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250806111750.3214584-2-nithyanantham.paramasivam@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
+index 2fb18b83b3eec..ec140052097e9 100644
+--- a/drivers/net/wireless/ath/ath12k/dp.h
++++ b/drivers/net/wireless/ath/ath12k/dp.h
+@@ -167,7 +167,7 @@ struct ath12k_pdev_dp {
+ #define DP_REO_REINJECT_RING_SIZE	32
+ #define DP_RX_RELEASE_RING_SIZE		1024
+ #define DP_REO_EXCEPTION_RING_SIZE	128
+-#define DP_REO_CMD_RING_SIZE		128
++#define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RX_MAC_BUF_RING_SIZE		2048
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch b/queue-6.12/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
new file mode 100644
index 0000000000..7b7fa7c6f1
--- /dev/null
+++ b/queue-6.12/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
@@ -0,0 +1,64 @@
+From 984145c4ce47b7706c40ae36d2a4ca28ca65370c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 06:21:21 +0300
+Subject: wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
+
+From: Nidhish A N <nidhish.a.n@intel.com>
+
+[ Upstream commit c5318e6e1c6436ce35ba521d96975e13cc5119f7 ]
+
+Add ASUS to the list of OEMs that are allowed to use
+the PPAG and TAS feature.
+
+Signed-off-by: Nidhish A N <nidhish.a.n@intel.com>
+Reviewed-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250909061931.499af6568e89.Iafb2cb1c83ff82712c0e9d5529f76bc226ed12dd@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
+index 4d9a1f83ef8c2..03af858440604 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
+@@ -57,11 +57,16 @@ static const struct dmi_system_id dmi_ppag_approved_list[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+ 		},
+ 	},
+-	{ .ident = "ASUS",
++	{ .ident = "ASUSTEK",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ 		},
+ 	},
++	{ .ident = "ASUS",
++	  .matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
++		},
++	},
+ 	{ .ident = "GOOGLE-HP",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+@@ -134,11 +139,16 @@ static const struct dmi_system_id dmi_tas_approved_list[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ 		},
+ 	},
+-	{ .ident = "ASUS",
++	{ .ident = "ASUSTEK",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ 		},
+ 	},
++	{ .ident = "ASUS",
++	  .matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
++		},
++	},
+ 	{ .ident = "GOOGLE-HP",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch b/queue-6.12/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
new file mode 100644
index 0000000000..e1ef26dd52
--- /dev/null
+++ b/queue-6.12/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
@@ -0,0 +1,66 @@
+From b718442e4031bde0fee510fff53b72c7a722027a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 16:14:36 +0530
+Subject: wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in
+ lower bands
+
+From: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+
+[ Upstream commit e53f8b12a21c2974b66fa8c706090182da06fff3 ]
+
+Currently, when adding the 6 GHz Band Capabilities element, the channel
+list of the wiphy is checked to determine if 6 GHz is supported for a given
+virtual interface. However, in a multi-radio wiphy (e.g., one that has
+both lower bands and 6 GHz combined), the wiphy advertises support for
+all bands. As a result, the 6 GHz Band Capabilities element is incorrectly
+included in mesh beacon and station's association request frames of
+interfaces operating in lower bands, without verifying whether the
+interface is actually operating in a 6 GHz channel.
+
+Fix this by verifying if the interface operates on 6 GHz channel
+before adding the element. Note that this check cannot be placed
+directly in ieee80211_put_he_6ghz_cap() as the same function is used to
+add probe request elements while initiating scan in which case the
+interface may not be operating in any band's channel.
+
+Signed-off-by: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250606104436.326654-1-rameshkumar.sundaram@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh.c | 3 +++
+ net/mac80211/mlme.c | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 50eb1d8cd43de..37e11320553e3 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -623,6 +623,9 @@ int mesh_add_he_6ghz_cap_ie(struct ieee80211_sub_if_data *sdata,
+ 	if (!sband)
+ 		return -EINVAL;
+ 
++	if (sband->band != NL80211_BAND_6GHZ)
++		return 0;
++
+ 	iftd = ieee80211_get_sband_iftype_data(sband,
+ 					       NL80211_IFTYPE_MESH_POINT);
+ 	/* The device doesn't support HE in mesh mode or at all */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 5a9a84a0cc35d..fd2bc70afa0cd 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1569,7 +1569,8 @@ static size_t ieee80211_assoc_link_elems(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_put_he_cap(skb, sdata, sband,
+ 				     &assoc_data->link[link_id].conn);
+ 		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
+-		ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
++		if (sband->band == NL80211_BAND_6GHZ)
++			ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
+ 	}
+ 
+ 	/*
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mac80211-fix-he-capabilities-element-check.patch b/queue-6.12/wifi-mac80211-fix-he-capabilities-element-check.patch
new file mode 100644
index 0000000000..e665330967
--- /dev/null
+++ b/queue-6.12/wifi-mac80211-fix-he-capabilities-element-check.patch
@@ -0,0 +1,37 @@
+From 22f56834f849b44c2d588db771ae7d999cc07e51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 11:51:17 +0300
+Subject: wifi: mac80211: Fix HE capabilities element check
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
+
+The element data length check did not account for the extra
+octet used for the extension ID. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index fd2bc70afa0cd..0cba454d6e685 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -5148,7 +5148,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
+ 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+ 					     ies->data, ies->len);
+ 
+-	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
++	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1)
+ 		return chains;
+ 
+ 	/* skip one byte ext_tag_id */
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mac80211-track-nan-interface-start-stop.patch b/queue-6.12/wifi-mac80211-track-nan-interface-start-stop.patch
new file mode 100644
index 0000000000..461f383f3a
--- /dev/null
+++ b/queue-6.12/wifi-mac80211-track-nan-interface-start-stop.patch
@@ -0,0 +1,124 @@
+From 0de6c5fd7c784bb8a4adaae125a08cbd2103a655 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:13:04 +0300
+Subject: wifi: mac80211: Track NAN interface start/stop
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 8f79d2f13dd3b0af00a5303d4ff913767dd7684e ]
+
+In case that NAN is started, mark the device as non idle,
+and set LED triggering similar to scan and ROC. Set the
+device to idle once NAN is stopped.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250908140015.2711d62fce22.I9b9f826490e50967a66788d713b0eba985879873@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c         | 20 +++++++++++++++++---
+ net/mac80211/ieee80211_i.h |  2 ++
+ net/mac80211/iface.c       |  9 +++++++++
+ 3 files changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 2890dde9b3bf4..2df4df75f1957 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -285,6 +285,9 @@ static int ieee80211_start_nan(struct wiphy *wiphy,
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
++	if (sdata->u.nan.started)
++		return -EALREADY;
++
+ 	ret = ieee80211_check_combinations(sdata, NULL, 0, 0, -1);
+ 	if (ret < 0)
+ 		return ret;
+@@ -294,12 +297,18 @@ static int ieee80211_start_nan(struct wiphy *wiphy,
+ 		return ret;
+ 
+ 	ret = drv_start_nan(sdata->local, sdata, conf);
+-	if (ret)
++	if (ret) {
+ 		ieee80211_sdata_stop(sdata);
++		return ret;
++	}
+ 
+-	sdata->u.nan.conf = *conf;
++	sdata->u.nan.started = true;
++	ieee80211_recalc_idle(sdata->local);
+ 
+-	return ret;
++	sdata->u.nan.conf.master_pref = conf->master_pref;
++	sdata->u.nan.conf.bands = conf->bands;
++
++	return 0;
+ }
+ 
+ static void ieee80211_stop_nan(struct wiphy *wiphy,
+@@ -307,8 +316,13 @@ static void ieee80211_stop_nan(struct wiphy *wiphy,
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+ 
++	if (!sdata->u.nan.started)
++		return;
++
+ 	drv_stop_nan(sdata->local, sdata);
++	sdata->u.nan.started = false;
+ 	ieee80211_sdata_stop(sdata);
++	ieee80211_recalc_idle(sdata->local);
+ }
+ 
+ static int ieee80211_nan_change_conf(struct wiphy *wiphy,
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 2f017dbbcb975..f0ac51cf66e61 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -949,11 +949,13 @@ struct ieee80211_if_mntr {
+  * struct ieee80211_if_nan - NAN state
+  *
+  * @conf: current NAN configuration
++ * @started: true iff NAN is started
+  * @func_lock: lock for @func_inst_ids
+  * @function_inst_ids: a bitmap of available instance_id's
+  */
+ struct ieee80211_if_nan {
+ 	struct cfg80211_nan_conf conf;
++	bool started;
+ 
+ 	/* protects function_inst_ids */
+ 	spinlock_t func_lock;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 209d6ffa8e426..69a8a2c21d8df 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -108,6 +108,7 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
+ {
+ 	bool working, scanning, active;
+ 	unsigned int led_trig_start = 0, led_trig_stop = 0;
++	struct ieee80211_sub_if_data *iter;
+ 
+ 	lockdep_assert_wiphy(local->hw.wiphy);
+ 
+@@ -118,6 +119,14 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
+ 	working = !local->ops->remain_on_channel &&
+ 		  !list_empty(&local->roc_list);
+ 
++	list_for_each_entry(iter, &local->interfaces, list) {
++		if (iter->vif.type == NL80211_IFTYPE_NAN &&
++		    iter->u.nan.started) {
++			working = true;
++			break;
++		}
++	}
++
+ 	scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+ 		   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mt76-mt76_eeprom_override-to-int.patch b/queue-6.12/wifi-mt76-mt76_eeprom_override-to-int.patch
new file mode 100644
index 0000000000..32e4278a97
--- /dev/null
+++ b/queue-6.12/wifi-mt76-mt76_eeprom_override-to-int.patch
@@ -0,0 +1,249 @@
+From 4a2934fb30d9f60425fc7bca7fd1e1dd9f845679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 15:16:19 -0700
+Subject: wifi: mt76: mt76_eeprom_override to int
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit c7c682100cec97b699fe24b26d89278fd459cc84 ]
+
+mt76_eeprom_override has of_get_mac_address, which can return
+-EPROBE_DEFER if the nvmem driver gets loaded after mt76 for some
+reason.
+
+Make sure this gets passed to probe so that nvmem mac overrides always
+work.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://patch.msgid.link/20250911221619.16035-1-rosenp@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/eeprom.c        | 9 +++++++--
+ drivers/net/wireless/mediatek/mt76/mt76.h          | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c | 3 +--
+ drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 4 +---
+ drivers/net/wireless/mediatek/mt76/mt7615/init.c   | 5 ++++-
+ drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c | 6 +++++-
+ drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 4 +---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7921/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7925/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 3 +--
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c   | 4 +++-
+ 13 files changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
+index 443517d06c9fa..a987c5e4eff6c 100644
+--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
+@@ -163,13 +163,16 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
+ 	return mt76_get_of_data_from_nvmem(dev, eep, "eeprom", len);
+ }
+ 
+-void
++int
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
+ 	struct device_node *np = dev->dev->of_node;
++	int err;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	err = of_get_mac_address(np, phy->macaddr);
++	if (err == -EPROBE_DEFER)
++		return err;
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+@@ -177,6 +180,8 @@ mt76_eeprom_override(struct mt76_phy *phy)
+ 			 "Invalid MAC address, using random address %pM\n",
+ 			 phy->macaddr);
+ 	}
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(mt76_eeprom_override);
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index a6ac8e5512eba..e7ebae0584f55 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -1185,7 +1185,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ 			 s8 *val, int len);
+ 
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+-void mt76_eeprom_override(struct mt76_phy *phy);
++int mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
+ int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
+ 				const char *cell_name, int len);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
+index f5a6b03bc61d0..88382b537a33b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
+@@ -182,7 +182,6 @@ int mt7603_eeprom_init(struct mt7603_dev *dev)
+ 		dev->mphy.antenna_mask = 1;
+ 
+ 	dev->mphy.chainmask = dev->mphy.antenna_mask;
+-	mt76_eeprom_override(&dev->mphy);
+ 
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+index ccedea7e8a50d..d4bc7e11e772b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+@@ -351,8 +351,6 @@ int mt7615_eeprom_init(struct mt7615_dev *dev, u32 addr)
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+ 
+-	mt76_eeprom_override(&dev->mphy);
+-
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ EXPORT_SYMBOL_GPL(mt7615_eeprom_init);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+index 66ba3be273434..d0d880f8c0aa4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+@@ -570,7 +570,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
+ 	       ETH_ALEN);
+ 	mphy->macaddr[0] |= 2;
+ 	mphy->macaddr[0] ^= BIT(7);
+-	mt76_eeprom_override(mphy);
++
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		return ret;
+ 
+ 	/* second phy can only handle 5 GHz */
+ 	mphy->cap.has_5ghz = true;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+index 4de45a56812d6..d4506b8b46fa5 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+@@ -332,7 +332,11 @@ int mt76x0_eeprom_init(struct mt76x02_dev *dev)
+ 
+ 	memcpy(dev->mphy.macaddr, (u8 *)dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+-	mt76_eeprom_override(&dev->mphy);
++
++	err = mt76_eeprom_override(&dev->mphy);
++	if (err)
++		return err;
++
+ 	mt76x02_mac_setaddr(dev, dev->mphy.macaddr);
+ 
+ 	mt76x0_set_chip_cap(dev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
+index 156b16c17b2b4..221805deb42fa 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
+@@ -499,7 +499,9 @@ int mt76x2_eeprom_init(struct mt76x02_dev *dev)
+ 
+ 	mt76x02_eeprom_parse_hw_cap(dev);
+ 	mt76x2_eeprom_get_macaddr(dev);
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		return ret;
+ 	dev->mphy.macaddr[0] &= ~BIT(1);
+ 
+ 	return 0;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+index 928e0b07a9bf1..b038568e0be91 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+@@ -284,9 +284,7 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+ 
+-	mt76_eeprom_override(&dev->mphy);
+-
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ 
+ int mt7915_eeprom_get_target_power(struct mt7915_dev *dev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index bc983ab10b0c7..83f062fb95d5a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -689,7 +689,9 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+ 		mphy->macaddr[0] |= 2;
+ 		mphy->macaddr[0] ^= BIT(7);
+ 	}
+-	mt76_eeprom_override(mphy);
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		return ret;
+ 
+ 	/* init wiphy according to mphy and phy */
+ 	mt7915_init_wiphy(phy);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+index d1d64fa7d35d0..4bd533c4ba9a1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+@@ -182,7 +182,9 @@ static int __mt7921_init_hardware(struct mt792x_dev *dev)
+ 	if (ret)
+ 		goto out;
+ 
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		goto out;
+ 
+ 	ret = mt7921_mcu_set_eeprom(dev);
+ 	if (ret)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+index 02899320da5c1..5123a720413ff 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+@@ -132,7 +132,9 @@ static int __mt7925_init_hardware(struct mt792x_dev *dev)
+ 	if (ret)
+ 		goto out;
+ 
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		goto out;
+ 
+ 	ret = mt7925_mcu_set_eeprom(dev);
+ 	if (ret)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+index 4a82371182873..4c4ab0d4065d2 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+@@ -235,9 +235,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 		return ret;
+ 
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR, ETH_ALEN);
+-	mt76_eeprom_override(&dev->mphy);
+ 
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ 
+ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 65bd9c32d42c1..5cd2fb7d9835c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -601,7 +601,9 @@ static int mt7996_register_phy(struct mt7996_dev *dev, struct mt7996_phy *phy,
+ 		if (band == MT_BAND2)
+ 			mphy->macaddr[0] ^= BIT(6);
+ 	}
+-	mt76_eeprom_override(mphy);
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		goto error;
+ 
+ 	/* init wiphy according to mphy and phy */
+ 	mt7996_init_wiphy(mphy->hw, wed);
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch b/queue-6.12/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
new file mode 100644
index 0000000000..3010cc3a18
--- /dev/null
+++ b/queue-6.12/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
@@ -0,0 +1,43 @@
+From a6fd88524d7bdecc4137412e05452fa1f2da32c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 20:39:42 +0800
+Subject: wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922
+ device
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
+
+Enable 160MHz beamformee support on mt7922 by updating HE capability
+element configuration. Previously, only 160MHz channel width was set,
+but beamformee for 160MHz was not properly advertised. This patch
+adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices
+to utilize 160MHz BW for beamforming.
+
+Tested by connecting to 160MHz-bandwidth beamforming AP and verified
+HE capability.
+
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 5b832f1aa00d7..0a7eafc470596 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -135,6 +135,8 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,
+ 			if (is_mt7922(phy->mt76->dev)) {
+ 				he_cap_elem->phy_cap_info[0] |=
+ 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++				he_cap_elem->phy_cap_info[4] |=
++					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
+ 				he_cap_elem->phy_cap_info[8] |=
+ 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+ 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch b/queue-6.12/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
new file mode 100644
index 0000000000..f0f3a195e8
--- /dev/null
+++ b/queue-6.12/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
@@ -0,0 +1,37 @@
+From ae6dfc8ecce7347f7a6e824a4b4fd3b3c70a399e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:59:00 +0200
+Subject: wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 7c0f63fe37a5da2c13fc35c89053b31be8ead895 ]
+
+Free the allocated skb on error
+
+Link: https://patch.msgid.link/20250915075910.47558-5-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 5f5544b6214cd..8738e4b645420 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -2283,8 +2283,10 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	ret = mt7996_mcu_sta_key_tlv(wcid, skb, key, cmd);
+-	if (ret)
++	if (ret) {
++		dev_kfree_skb(skb);
+ 		return ret;
++	}
+ 
+ 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-mt76-mt7996-temporarily-disable-epcs.patch b/queue-6.12/wifi-mt76-mt7996-temporarily-disable-epcs.patch
new file mode 100644
index 0000000000..8cfb500d62
--- /dev/null
+++ b/queue-6.12/wifi-mt76-mt7996-temporarily-disable-epcs.patch
@@ -0,0 +1,36 @@
+From cc8a459a8d5aef1d70ca7dab278427135fcac6e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 09:56:42 +0200
+Subject: wifi: mt76: mt7996: Temporarily disable EPCS
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit e6291bb7a5935b2f1d337fd7a58eab7ada6678ad ]
+
+EPCS is not yet ready, so do not claim to support it.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-4-89d8fed67f20@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 91b7d35bdb431..65bd9c32d42c1 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -1190,7 +1190,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 	eht_cap->has_eht = true;
+ 
+ 	eht_cap_elem->mac_cap_info[0] =
+-		IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
+ 		IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
+ 		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
+ 			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch b/queue-6.12/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
new file mode 100644
index 0000000000..9348ce7a83
--- /dev/null
+++ b/queue-6.12/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
@@ -0,0 +1,52 @@
+From a28d621a861b1e6d2ee59a31365f388256e9a41e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 08:48:15 +0800
+Subject: wifi: rtw88: sdio: use indirect IO for device registers before
+ power-on
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 58de1f91e033b1fface8d8948984583125f93736 ]
+
+The register REG_SYS_CFG1 is used to determine chip basic information
+as arguments of following flows, such as download firmware and load PHY
+parameters, so driver read the value early (before power-on).
+
+However, the direct IO is disallowed before power-on, or it causes wrong
+values, which driver recognizes a chip as a wrong type RF_1T1R, but
+actually RF_2T2R, causing driver warns:
+
+  rtw88_8822cs mmc1:0001:1: unsupported rf path (1)
+
+Fix it by using indirect IO before power-on.
+
+Reported-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/699C22B4-A3E3-4206-97D0-22AB3348EBF6@gmail.com/T/#t
+Suggested-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Tested-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250724004815.7043-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
+index 787fa09fd063a..d6bea5ec8e24d 100644
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -144,6 +144,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr,
+ 
+ static bool rtw_sdio_use_direct_io(struct rtw_dev *rtwdev, u32 addr)
+ {
++	if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags) &&
++	    !rtw_sdio_is_bus_addr(addr))
++		return false;
++
+ 	return !rtw_sdio_is_sdio30_supported(rtwdev) ||
+ 		rtw_sdio_is_bus_addr(addr);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch b/queue-6.12/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
new file mode 100644
index 0000000000..c74ec7d8bd
--- /dev/null
+++ b/queue-6.12/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
@@ -0,0 +1,47 @@
+From 2e887b61d569e411b922ce5c4718ec9d260cb40f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:39:50 +0800
+Subject: wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit c4c16c88e78417424b4e3f33177e84baf0bc9a99 ]
+
+For non-transmitted connections, beacons are received from the
+transmitted BSSID. Fix this to avoid missing beacon statistics.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250811123950.15697-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index df8fad7a2aea6..1147abf771547 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -2074,6 +2074,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ 	struct ieee80211_bss_conf *bss_conf;
+ 	struct rtw89_vif_link *rtwvif_link;
+ 	const u8 *bssid = iter_data->bssid;
++	const u8 *target_bssid;
+ 
+ 	if (rtwdev->scanning &&
+ 	    (ieee80211_is_beacon(hdr->frame_control) ||
+@@ -2098,7 +2099,10 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ 		goto out;
+ 	}
+ 
+-	if (!ether_addr_equal(bss_conf->bssid, bssid))
++	target_bssid = ieee80211_is_beacon(hdr->frame_control) &&
++		       bss_conf->nontransmitted ?
++		       bss_conf->transmitter_bssid : bss_conf->bssid;
++	if (!ether_addr_equal(target_bssid, bssid))
+ 		goto out;
+ 
+ 	if (ieee80211_is_beacon(hdr->frame_control)) {
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch b/queue-6.12/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
new file mode 100644
index 0000000000..b88ef33a6f
--- /dev/null
+++ b/queue-6.12/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
@@ -0,0 +1,51 @@
+From 1f5b44b3cef6ac3ded586180d45c735a7bb686f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:52:06 +0800
+Subject: wifi: rtw89: obtain RX path from ppdu status IE00
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit e156d2ab36d7e47aec36845705e4ecb1e4e89976 ]
+
+The header v2 of ppdu status is optional, If it is not enabled, the RX
+path must be obtained from IE00 or IE01. Append the IE00 part.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250915065213.38659-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/txrx.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 1147abf771547..3584445b27387 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -1710,6 +1710,10 @@ static void rtw89_core_parse_phy_status_ie00(struct rtw89_dev *rtwdev,
+ 
+ 	tmp_rpl = le32_get_bits(ie->w0, RTW89_PHY_STS_IE00_W0_RPL);
+ 	phy_ppdu->rpl_avg = tmp_rpl >> 1;
++
++	if (!phy_ppdu->hdr_2_en)
++		phy_ppdu->rx_path_en =
++			le32_get_bits(ie->w3, RTW89_PHY_STS_IE00_W3_RX_PATH_EN);
+ }
+ 
+ static void rtw89_core_parse_phy_status_ie00_v2(struct rtw89_dev *rtwdev,
+diff --git a/drivers/net/wireless/realtek/rtw89/txrx.h b/drivers/net/wireless/realtek/rtw89/txrx.h
+index b2e47829983fe..3a3b6154db458 100644
+--- a/drivers/net/wireless/realtek/rtw89/txrx.h
++++ b/drivers/net/wireless/realtek/rtw89/txrx.h
+@@ -568,6 +568,7 @@ struct rtw89_phy_sts_ie00 {
+ } __packed;
+ 
+ #define RTW89_PHY_STS_IE00_W0_RPL GENMASK(15, 7)
++#define RTW89_PHY_STS_IE00_W3_RX_PATH_EN GENMASK(31, 28)
+ 
+ struct rtw89_phy_sts_ie00_v2 {
+ 	__le32 w0;
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch b/queue-6.12/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
new file mode 100644
index 0000000000..7fbdfecf10
--- /dev/null
+++ b/queue-6.12/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
@@ -0,0 +1,84 @@
+From 27a39a2dec8dca528e18ceebc86d74d2727e21a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 09:22:33 +0800
+Subject: wifi: rtw89: print just once for unknown C2H events
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 7e1c44fe4c2e1e01fa47d9490893d95309a99687 ]
+
+When driver receives new or unknown C2H events, it print out messages
+repeatedly once events are received, like
+
+  rtw89_8922ae 0000:81:00.0: PHY c2h class 2 not support
+
+To avoid the thousands of messages, use rtw89_info_once() instead. Also,
+print out class/func for unknown (undefined) class.
+
+Reported-by: Sean Anderson <sean.anderson@linux.dev>
+Closes: https://lore.kernel.org/linux-wireless/20250729204437.164320-1-sean.anderson@linux.dev/
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250804012234.8913-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/debug.h | 1 +
+ drivers/net/wireless/realtek/rtw89/mac.c   | 7 +++----
+ drivers/net/wireless/realtek/rtw89/phy.c   | 7 +++----
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/debug.h b/drivers/net/wireless/realtek/rtw89/debug.h
+index fc690f7c55dc7..a364e7adb0798 100644
+--- a/drivers/net/wireless/realtek/rtw89/debug.h
++++ b/drivers/net/wireless/realtek/rtw89/debug.h
+@@ -56,6 +56,7 @@ static inline void rtw89_debugfs_deinit(struct rtw89_dev *rtwdev) {}
+ #endif
+ 
+ #define rtw89_info(rtwdev, a...) dev_info((rtwdev)->dev, ##a)
++#define rtw89_info_once(rtwdev, a...) dev_info_once((rtwdev)->dev, ##a)
+ #define rtw89_warn(rtwdev, a...) dev_warn((rtwdev)->dev, ##a)
+ #define rtw89_err(rtwdev, a...) dev_err((rtwdev)->dev, ##a)
+ 
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index 8b7ca63af7ed0..b956ea2add919 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -5532,12 +5532,11 @@ void rtw89_mac_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ 	case RTW89_MAC_C2H_CLASS_FWDBG:
+ 		return;
+ 	default:
+-		rtw89_info(rtwdev, "MAC c2h class %d not support\n", class);
+-		return;
++		break;
+ 	}
+ 	if (!handler) {
+-		rtw89_info(rtwdev, "MAC c2h class %d func %d not support\n", class,
+-			   func);
++		rtw89_info_once(rtwdev, "MAC c2h class %d func %d not support\n",
++				class, func);
+ 		return;
+ 	}
+ 	handler(rtwdev, skb, len);
+diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
+index 355c3f58ab185..b473e02ecd9e7 100644
+--- a/drivers/net/wireless/realtek/rtw89/phy.c
++++ b/drivers/net/wireless/realtek/rtw89/phy.c
+@@ -3125,12 +3125,11 @@ void rtw89_phy_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ 			return;
+ 		fallthrough;
+ 	default:
+-		rtw89_info(rtwdev, "PHY c2h class %d not support\n", class);
+-		return;
++		break;
+ 	}
+ 	if (!handler) {
+-		rtw89_info(rtwdev, "PHY c2h class %d func %d not support\n", class,
+-			   func);
++		rtw89_info_once(rtwdev, "PHY c2h class %d func %d not support\n",
++				class, func);
+ 		return;
+ 	}
+ 	handler(rtwdev, skb, len);
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch b/queue-6.12/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
new file mode 100644
index 0000000000..225fe8458b
--- /dev/null
+++ b/queue-6.12/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
@@ -0,0 +1,157 @@
+From df9c1e39fbfc9b2b12d9eebb90ceda050910d3ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:53:43 +0800
+Subject: wifi: rtw89: renew a completion for each H2C command waiting C2H
+ event
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit bc2a5a12fa6259e190c7edb03e63b28ab480101b ]
+
+Logically before a waiting side which has already timed out turns the
+atomic status back to idle, a completing side could still pass atomic
+condition and call complete. It will make the following H2C commands,
+waiting C2H events, get a completion unexpectedly early. Hence, renew
+a completion for each H2C command waiting a C2H event.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250915065343.39023-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 49 ++++++++++++++++++++---
+ drivers/net/wireless/realtek/rtw89/core.h | 10 ++++-
+ drivers/net/wireless/realtek/rtw89/fw.c   |  2 +
+ 3 files changed, 53 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 3584445b27387..faa764d5c1a01 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -4318,37 +4318,74 @@ void rtw89_core_update_beacon_work(struct work_struct *work)
+ 
+ int rtw89_wait_for_cond(struct rtw89_wait_info *wait, unsigned int cond)
+ {
+-	struct completion *cmpl = &wait->completion;
++	struct rtw89_wait_response *prep;
+ 	unsigned long time_left;
+ 	unsigned int cur;
++	int err = 0;
+ 
+ 	cur = atomic_cmpxchg(&wait->cond, RTW89_WAIT_COND_IDLE, cond);
+ 	if (cur != RTW89_WAIT_COND_IDLE)
+ 		return -EBUSY;
+ 
+-	time_left = wait_for_completion_timeout(cmpl, RTW89_WAIT_FOR_COND_TIMEOUT);
++	prep = kzalloc(sizeof(*prep), GFP_KERNEL);
++	if (!prep) {
++		err = -ENOMEM;
++		goto reset;
++	}
++
++	init_completion(&prep->completion);
++
++	rcu_assign_pointer(wait->resp, prep);
++
++	time_left = wait_for_completion_timeout(&prep->completion,
++						RTW89_WAIT_FOR_COND_TIMEOUT);
+ 	if (time_left == 0) {
+-		atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
+-		return -ETIMEDOUT;
++		err = -ETIMEDOUT;
++		goto cleanup;
+ 	}
+ 
++	wait->data = prep->data;
++
++cleanup:
++	rcu_assign_pointer(wait->resp, NULL);
++	kfree_rcu(prep, rcu_head);
++
++reset:
++	atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
++
++	if (err)
++		return err;
++
+ 	if (wait->data.err)
+ 		return -EFAULT;
+ 
+ 	return 0;
+ }
+ 
++static void rtw89_complete_cond_resp(struct rtw89_wait_response *resp,
++				     const struct rtw89_completion_data *data)
++{
++	resp->data = *data;
++	complete(&resp->completion);
++}
++
+ void rtw89_complete_cond(struct rtw89_wait_info *wait, unsigned int cond,
+ 			 const struct rtw89_completion_data *data)
+ {
++	struct rtw89_wait_response *resp;
+ 	unsigned int cur;
+ 
++	guard(rcu)();
++
++	resp = rcu_dereference(wait->resp);
++	if (!resp)
++		return;
++
+ 	cur = atomic_cmpxchg(&wait->cond, cond, RTW89_WAIT_COND_IDLE);
+ 	if (cur != cond)
+ 		return;
+ 
+-	wait->data = *data;
+-	complete(&wait->completion);
++	rtw89_complete_cond_resp(resp, data);
+ }
+ 
+ void rtw89_core_ntfy_btc_event(struct rtw89_dev *rtwdev, enum rtw89_btc_hmsg event)
+diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
+index 7be32b83d4d64..36ba2ca255bb0 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.h
++++ b/drivers/net/wireless/realtek/rtw89/core.h
+@@ -4391,17 +4391,23 @@ struct rtw89_completion_data {
+ 	u8 buf[RTW89_COMPLETION_BUF_SIZE];
+ };
+ 
++struct rtw89_wait_response {
++	struct rcu_head rcu_head;
++	struct completion completion;
++	struct rtw89_completion_data data;
++};
++
+ struct rtw89_wait_info {
+ 	atomic_t cond;
+-	struct completion completion;
+ 	struct rtw89_completion_data data;
++	struct rtw89_wait_response __rcu *resp;
+ };
+ 
+ #define RTW89_WAIT_FOR_COND_TIMEOUT msecs_to_jiffies(100)
+ 
+ static inline void rtw89_init_wait(struct rtw89_wait_info *wait)
+ {
+-	init_completion(&wait->completion);
++	rcu_assign_pointer(wait->resp, NULL);
+ 	atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
+ }
+ 
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 7894e1a569a2c..ae2c4ff74531a 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -7446,6 +7446,8 @@ static int rtw89_h2c_tx_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ {
+ 	int ret;
+ 
++	lockdep_assert_wiphy(rtwdev->hw->wiphy);
++
+ 	ret = rtw89_h2c_tx(rtwdev, skb, false);
+ 	if (ret) {
+ 		rtw89_err(rtwdev, "failed to send h2c\n");
+-- 
+2.51.0
+
diff --git a/queue-6.12/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch b/queue-6.12/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
new file mode 100644
index 0000000000..5369038e40
--- /dev/null
+++ b/queue-6.12/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
@@ -0,0 +1,45 @@
+From 82ff1a5cb84a9c0875d89c70af0227f03850129b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:37:39 +0800
+Subject: wifi: rtw89: wow: remove notify during WoWLAN net-detect
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit 38846585f9df9af1f7261d85134a5510fc079458 ]
+
+In WoWLAN net-detect mode, the firmware periodically performs scans
+and sends scan reports via C2H, which driver does not need. These
+unnecessary C2H events cause firmware watchdog timeout, leading
+to unexpected wakeups and SER 0x2599 on 8922AE.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250811123744.15361-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 10a3a66a9981d..7894e1a569a2c 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -6212,7 +6212,6 @@ static void rtw89_pno_scan_add_chan_ax(struct rtw89_dev *rtwdev,
+ 	struct rtw89_pktofld_info *info;
+ 	u8 probe_count = 0;
+ 
+-	ch_info->notify_action = RTW89_SCANOFLD_DEBUG_MASK;
+ 	ch_info->dfs_ch = chan_type == RTW89_CHAN_DFS;
+ 	ch_info->bw = RTW89_SCAN_WIDTH;
+ 	ch_info->tx_pkt = true;
+@@ -6341,7 +6340,6 @@ static void rtw89_pno_scan_add_chan_be(struct rtw89_dev *rtwdev, int chan_type,
+ 	struct rtw89_pktofld_info *info;
+ 	u8 probe_count = 0, i;
+ 
+-	ch_info->notify_action = RTW89_SCANOFLD_DEBUG_MASK;
+ 	ch_info->dfs_ch = chan_type == RTW89_CHAN_DFS;
+ 	ch_info->bw = RTW89_SCAN_WIDTH;
+ 	ch_info->tx_null = false;
+-- 
+2.51.0
+
diff --git a/queue-6.12/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-6.12/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..0a66614397
--- /dev/null
+++ b/queue-6.12/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From 7dcbf3bcfadc52c3ab578f4c0bea2eba3fe76d51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index bd21c568bc2ad..46887d60348ef 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -1089,16 +1089,6 @@ static void kvm_wait(u8 *ptr, u8 val)
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -1118,6 +1108,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-6.12/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-6.12/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..7cfba577b4
--- /dev/null
+++ b/queue-6.12/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 7762e25948d9c5400523b794904adc5a55892ba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index 2fb7d53cf3338..95e053b0a4bc0 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-6.17/6pack-drop-redundant-locking-and-refcounting.patch b/queue-6.17/6pack-drop-redundant-locking-and-refcounting.patch
new file mode 100644
index 0000000000..9e3adff107
--- /dev/null
+++ b/queue-6.17/6pack-drop-redundant-locking-and-refcounting.patch
@@ -0,0 +1,173 @@
+From fd49298e0db3ef6d4dcf25189f23fe06e132f98b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:10:59 +0800
+Subject: 6pack: drop redundant locking and refcounting
+
+From: Qingfang Deng <dqfext@gmail.com>
+
+[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
+
+The TTY layer already serializes line discipline operations with
+tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack
+are unnecessary.
+
+Removing them simplifies the code and also resolves a lockdep warning
+reported by syzbot. The warning did not indicate a real deadlock, since
+the write-side lock was only taken in process context with hardirqs
+disabled.
+
+Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/
+Signed-off-by: Qingfang Deng <dqfext@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 57 ++++--------------------------------
+ 1 file changed, 5 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index c5e5423e18633..885992951e8a6 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -115,8 +115,6 @@ struct sixpack {
+ 
+ 	struct timer_list	tx_t;
+ 	struct timer_list	resync_t;
+-	refcount_t		refcnt;
+-	struct completion	dead;
+ 	spinlock_t		lock;
+ };
+ 
+@@ -353,42 +351,13 @@ static void sp_bump(struct sixpack *sp, char cmd)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+-/*
+- * We have a potential race on dereferencing tty->disc_data, because the tty
+- * layer provides no locking at all - thus one cpu could be running
+- * sixpack_receive_buf while another calls sixpack_close, which zeroes
+- * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
+- * best way to fix this is to use a rwlock in the tty struct, but for now we
+- * use a single global rwlock for all ttys in ppp line discipline.
+- */
+-static DEFINE_RWLOCK(disc_data_lock);
+-                                                                                
+-static struct sixpack *sp_get(struct tty_struct *tty)
+-{
+-	struct sixpack *sp;
+-
+-	read_lock(&disc_data_lock);
+-	sp = tty->disc_data;
+-	if (sp)
+-		refcount_inc(&sp->refcnt);
+-	read_unlock(&disc_data_lock);
+-
+-	return sp;
+-}
+-
+-static void sp_put(struct sixpack *sp)
+-{
+-	if (refcount_dec_and_test(&sp->refcnt))
+-		complete(&sp->dead);
+-}
+-
+ /*
+  * Called by the TTY driver when there's room for more data.  If we have
+  * more packets to send, we send them here.
+  */
+ static void sixpack_write_wakeup(struct tty_struct *tty)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	int actual;
+ 
+ 	if (!sp)
+@@ -400,7 +369,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ 		sp->tx_enable = 0;
+ 		netif_wake_queue(sp->dev);
+-		goto out;
++		return;
+ 	}
+ 
+ 	if (sp->tx_enable) {
+@@ -408,9 +377,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		sp->xleft -= actual;
+ 		sp->xhead += actual;
+ 	}
+-
+-out:
+-	sp_put(sp);
+ }
+ 
+ /* ----------------------------------------------------------------------- */
+@@ -430,7 +396,7 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	if (!count)
+ 		return;
+ 
+-	sp = sp_get(tty);
++	sp = tty->disc_data;
+ 	if (!sp)
+ 		return;
+ 
+@@ -446,7 +412,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	}
+ 	sixpack_decode(sp, cp, count1);
+ 
+-	sp_put(sp);
+ 	tty_unthrottle(tty);
+ }
+ 
+@@ -561,8 +526,6 @@ static int sixpack_open(struct tty_struct *tty)
+ 
+ 	spin_lock_init(&sp->lock);
+ 	spin_lock_init(&sp->rxlock);
+-	refcount_set(&sp->refcnt, 1);
+-	init_completion(&sp->dead);
+ 
+ 	/* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
+ 
+@@ -638,19 +601,11 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock_irq(&disc_data_lock);
+ 	sp = tty->disc_data;
+-	tty->disc_data = NULL;
+-	write_unlock_irq(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+-	/*
+-	 * We have now ensured that nobody can start using ap from now on, but
+-	 * we have to wait for all existing users to finish.
+-	 */
+-	if (!refcount_dec_and_test(&sp->refcnt))
+-		wait_for_completion(&sp->dead);
++	tty->disc_data = NULL;
+ 
+ 	/* We must stop the queue to avoid potentially scribbling
+ 	 * on the free buffers. The sp->dead completion is not sufficient
+@@ -673,7 +628,7 @@ static void sixpack_close(struct tty_struct *tty)
+ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		unsigned long arg)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	struct net_device *dev;
+ 	unsigned int tmp, err;
+ 
+@@ -725,8 +680,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		err = tty_mode_ioctl(tty, cmd, arg);
+ 	}
+ 
+-	sp_put(sp);
+-
+ 	return err;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/accel-amdxdna-unify-pm-and-rpm-suspend-and-resume-ca.patch b/queue-6.17/accel-amdxdna-unify-pm-and-rpm-suspend-and-resume-ca.patch
new file mode 100644
index 0000000000..44cfbd75cc
--- /dev/null
+++ b/queue-6.17/accel-amdxdna-unify-pm-and-rpm-suspend-and-resume-ca.patch
@@ -0,0 +1,380 @@
+From ccb941cea3754d00dbd020f56f34ed790745e2cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Aug 2025 12:14:50 -0700
+Subject: accel/amdxdna: Unify pm and rpm suspend and resume callbacks
+
+From: Lizhi Hou <lizhi.hou@amd.com>
+
+[ Upstream commit d2b48f2b30f25997a1ae1ad0cefac68c25f8c330 ]
+
+The suspend and resume callbacks for pm and runtime pm should be same.
+During suspending, it needs to stop all hardware contexts first. And
+the hardware contexts will be restarted after the device is resumed.
+
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
+Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
+Link: https://lore.kernel.org/r/20250803191450.1568851-1-lizhi.hou@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/amdxdna/aie2_ctx.c        | 59 ++++++++++----------
+ drivers/accel/amdxdna/aie2_pci.c        | 37 +++++++++++--
+ drivers/accel/amdxdna/aie2_pci.h        |  5 +-
+ drivers/accel/amdxdna/amdxdna_ctx.c     | 26 ---------
+ drivers/accel/amdxdna/amdxdna_ctx.h     |  2 -
+ drivers/accel/amdxdna/amdxdna_pci_drv.c | 74 +++----------------------
+ drivers/accel/amdxdna/amdxdna_pci_drv.h |  4 +-
+ 7 files changed, 73 insertions(+), 134 deletions(-)
+
+diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c
+index cda964ba33cd7..6f77d1794e483 100644
+--- a/drivers/accel/amdxdna/aie2_ctx.c
++++ b/drivers/accel/amdxdna/aie2_ctx.c
+@@ -46,6 +46,17 @@ static void aie2_job_put(struct amdxdna_sched_job *job)
+ 	kref_put(&job->refcnt, aie2_job_release);
+ }
+ 
++static void aie2_hwctx_status_shift_stop(struct amdxdna_hwctx *hwctx)
++{
++	 hwctx->old_status = hwctx->status;
++	 hwctx->status = HWCTX_STAT_STOP;
++}
++
++static void aie2_hwctx_status_restore(struct amdxdna_hwctx *hwctx)
++{
++	hwctx->status = hwctx->old_status;
++}
++
+ /* The bad_job is used in aie2_sched_job_timedout, otherwise, set it to NULL */
+ static void aie2_hwctx_stop(struct amdxdna_dev *xdna, struct amdxdna_hwctx *hwctx,
+ 			    struct drm_sched_job *bad_job)
+@@ -89,25 +100,6 @@ static int aie2_hwctx_restart(struct amdxdna_dev *xdna, struct amdxdna_hwctx *hw
+ 	return ret;
+ }
+ 
+-void aie2_restart_ctx(struct amdxdna_client *client)
+-{
+-	struct amdxdna_dev *xdna = client->xdna;
+-	struct amdxdna_hwctx *hwctx;
+-	unsigned long hwctx_id;
+-
+-	drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+-	mutex_lock(&client->hwctx_lock);
+-	amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
+-		if (hwctx->status != HWCTX_STAT_STOP)
+-			continue;
+-
+-		hwctx->status = hwctx->old_status;
+-		XDNA_DBG(xdna, "Resetting %s", hwctx->name);
+-		aie2_hwctx_restart(xdna, hwctx);
+-	}
+-	mutex_unlock(&client->hwctx_lock);
+-}
+-
+ static struct dma_fence *aie2_cmd_get_out_fence(struct amdxdna_hwctx *hwctx, u64 seq)
+ {
+ 	struct dma_fence *fence, *out_fence = NULL;
+@@ -141,9 +133,11 @@ static void aie2_hwctx_wait_for_idle(struct amdxdna_hwctx *hwctx)
+ 	dma_fence_put(fence);
+ }
+ 
+-void aie2_hwctx_suspend(struct amdxdna_hwctx *hwctx)
++void aie2_hwctx_suspend(struct amdxdna_client *client)
+ {
+-	struct amdxdna_dev *xdna = hwctx->client->xdna;
++	struct amdxdna_dev *xdna = client->xdna;
++	struct amdxdna_hwctx *hwctx;
++	unsigned long hwctx_id;
+ 
+ 	/*
+ 	 * Command timeout is unlikely. But if it happens, it doesn't
+@@ -151,15 +145,19 @@ void aie2_hwctx_suspend(struct amdxdna_hwctx *hwctx)
+ 	 * and abort all commands.
+ 	 */
+ 	drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+-	aie2_hwctx_wait_for_idle(hwctx);
+-	aie2_hwctx_stop(xdna, hwctx, NULL);
+-	hwctx->old_status = hwctx->status;
+-	hwctx->status = HWCTX_STAT_STOP;
++	guard(mutex)(&client->hwctx_lock);
++	amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
++		aie2_hwctx_wait_for_idle(hwctx);
++		aie2_hwctx_stop(xdna, hwctx, NULL);
++		aie2_hwctx_status_shift_stop(hwctx);
++	}
+ }
+ 
+-void aie2_hwctx_resume(struct amdxdna_hwctx *hwctx)
++void aie2_hwctx_resume(struct amdxdna_client *client)
+ {
+-	struct amdxdna_dev *xdna = hwctx->client->xdna;
++	struct amdxdna_dev *xdna = client->xdna;
++	struct amdxdna_hwctx *hwctx;
++	unsigned long hwctx_id;
+ 
+ 	/*
+ 	 * The resume path cannot guarantee that mailbox channel can be
+@@ -167,8 +165,11 @@ void aie2_hwctx_resume(struct amdxdna_hwctx *hwctx)
+ 	 * mailbox channel, error will return.
+ 	 */
+ 	drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+-	hwctx->status = hwctx->old_status;
+-	aie2_hwctx_restart(xdna, hwctx);
++	guard(mutex)(&client->hwctx_lock);
++	amdxdna_for_each_hwctx(client, hwctx_id, hwctx) {
++		aie2_hwctx_status_restore(hwctx);
++		aie2_hwctx_restart(xdna, hwctx);
++	}
+ }
+ 
+ static void
+diff --git a/drivers/accel/amdxdna/aie2_pci.c b/drivers/accel/amdxdna/aie2_pci.c
+index c6cf7068d23c0..272c919d6d4fd 100644
+--- a/drivers/accel/amdxdna/aie2_pci.c
++++ b/drivers/accel/amdxdna/aie2_pci.c
+@@ -440,6 +440,37 @@ static int aie2_hw_start(struct amdxdna_dev *xdna)
+ 	return ret;
+ }
+ 
++static int aie2_hw_suspend(struct amdxdna_dev *xdna)
++{
++	struct amdxdna_client *client;
++
++	guard(mutex)(&xdna->dev_lock);
++	list_for_each_entry(client, &xdna->client_list, node)
++		aie2_hwctx_suspend(client);
++
++	aie2_hw_stop(xdna);
++
++	return 0;
++}
++
++static int aie2_hw_resume(struct amdxdna_dev *xdna)
++{
++	struct amdxdna_client *client;
++	int ret;
++
++	guard(mutex)(&xdna->dev_lock);
++	ret = aie2_hw_start(xdna);
++	if (ret) {
++		XDNA_ERR(xdna, "Start hardware failed, %d", ret);
++		return ret;
++	}
++
++	list_for_each_entry(client, &xdna->client_list, node)
++		aie2_hwctx_resume(client);
++
++	return ret;
++}
++
+ static int aie2_init(struct amdxdna_dev *xdna)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(xdna->ddev.dev);
+@@ -905,8 +936,8 @@ static int aie2_set_state(struct amdxdna_client *client,
+ const struct amdxdna_dev_ops aie2_ops = {
+ 	.init           = aie2_init,
+ 	.fini           = aie2_fini,
+-	.resume         = aie2_hw_start,
+-	.suspend        = aie2_hw_stop,
++	.resume         = aie2_hw_resume,
++	.suspend        = aie2_hw_suspend,
+ 	.get_aie_info   = aie2_get_info,
+ 	.set_aie_state	= aie2_set_state,
+ 	.hwctx_init     = aie2_hwctx_init,
+@@ -914,6 +945,4 @@ const struct amdxdna_dev_ops aie2_ops = {
+ 	.hwctx_config   = aie2_hwctx_config,
+ 	.cmd_submit     = aie2_cmd_submit,
+ 	.hmm_invalidate = aie2_hmm_invalidate,
+-	.hwctx_suspend  = aie2_hwctx_suspend,
+-	.hwctx_resume   = aie2_hwctx_resume,
+ };
+diff --git a/drivers/accel/amdxdna/aie2_pci.h b/drivers/accel/amdxdna/aie2_pci.h
+index 385914840eaa6..488d8ee568eb1 100644
+--- a/drivers/accel/amdxdna/aie2_pci.h
++++ b/drivers/accel/amdxdna/aie2_pci.h
+@@ -288,10 +288,9 @@ int aie2_sync_bo(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job,
+ int aie2_hwctx_init(struct amdxdna_hwctx *hwctx);
+ void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx);
+ int aie2_hwctx_config(struct amdxdna_hwctx *hwctx, u32 type, u64 value, void *buf, u32 size);
+-void aie2_hwctx_suspend(struct amdxdna_hwctx *hwctx);
+-void aie2_hwctx_resume(struct amdxdna_hwctx *hwctx);
++void aie2_hwctx_suspend(struct amdxdna_client *client);
++void aie2_hwctx_resume(struct amdxdna_client *client);
+ int aie2_cmd_submit(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, u64 *seq);
+ void aie2_hmm_invalidate(struct amdxdna_gem_obj *abo, unsigned long cur_seq);
+-void aie2_restart_ctx(struct amdxdna_client *client);
+ 
+ #endif /* _AIE2_PCI_H_ */
+diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
+index be073224bd693..b47a7f8e90170 100644
+--- a/drivers/accel/amdxdna/amdxdna_ctx.c
++++ b/drivers/accel/amdxdna/amdxdna_ctx.c
+@@ -60,32 +60,6 @@ static struct dma_fence *amdxdna_fence_create(struct amdxdna_hwctx *hwctx)
+ 	return &fence->base;
+ }
+ 
+-void amdxdna_hwctx_suspend(struct amdxdna_client *client)
+-{
+-	struct amdxdna_dev *xdna = client->xdna;
+-	struct amdxdna_hwctx *hwctx;
+-	unsigned long hwctx_id;
+-
+-	drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+-	mutex_lock(&client->hwctx_lock);
+-	amdxdna_for_each_hwctx(client, hwctx_id, hwctx)
+-		xdna->dev_info->ops->hwctx_suspend(hwctx);
+-	mutex_unlock(&client->hwctx_lock);
+-}
+-
+-void amdxdna_hwctx_resume(struct amdxdna_client *client)
+-{
+-	struct amdxdna_dev *xdna = client->xdna;
+-	struct amdxdna_hwctx *hwctx;
+-	unsigned long hwctx_id;
+-
+-	drm_WARN_ON(&xdna->ddev, !mutex_is_locked(&xdna->dev_lock));
+-	mutex_lock(&client->hwctx_lock);
+-	amdxdna_for_each_hwctx(client, hwctx_id, hwctx)
+-		xdna->dev_info->ops->hwctx_resume(hwctx);
+-	mutex_unlock(&client->hwctx_lock);
+-}
+-
+ static void amdxdna_hwctx_destroy_rcu(struct amdxdna_hwctx *hwctx,
+ 				      struct srcu_struct *ss)
+ {
+diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
+index f0a4a8586d858..c652229547a3c 100644
+--- a/drivers/accel/amdxdna/amdxdna_ctx.h
++++ b/drivers/accel/amdxdna/amdxdna_ctx.h
+@@ -147,8 +147,6 @@ static inline u32 amdxdna_hwctx_col_map(struct amdxdna_hwctx *hwctx)
+ 
+ void amdxdna_sched_job_cleanup(struct amdxdna_sched_job *job);
+ void amdxdna_hwctx_remove_all(struct amdxdna_client *client);
+-void amdxdna_hwctx_suspend(struct amdxdna_client *client);
+-void amdxdna_hwctx_resume(struct amdxdna_client *client);
+ 
+ int amdxdna_cmd_submit(struct amdxdna_client *client,
+ 		       u32 cmd_bo_hdls, u32 *arg_bo_hdls, u32 arg_bo_cnt,
+diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
+index f2bf1d374cc70..fbca94183f963 100644
+--- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
++++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
+@@ -343,89 +343,29 @@ static void amdxdna_remove(struct pci_dev *pdev)
+ 	mutex_unlock(&xdna->dev_lock);
+ }
+ 
+-static int amdxdna_dev_suspend_nolock(struct amdxdna_dev *xdna)
+-{
+-	if (xdna->dev_info->ops->suspend)
+-		xdna->dev_info->ops->suspend(xdna);
+-
+-	return 0;
+-}
+-
+-static int amdxdna_dev_resume_nolock(struct amdxdna_dev *xdna)
+-{
+-	if (xdna->dev_info->ops->resume)
+-		return xdna->dev_info->ops->resume(xdna);
+-
+-	return 0;
+-}
+-
+ static int amdxdna_pmops_suspend(struct device *dev)
+ {
+ 	struct amdxdna_dev *xdna = pci_get_drvdata(to_pci_dev(dev));
+-	struct amdxdna_client *client;
+-
+-	mutex_lock(&xdna->dev_lock);
+-	list_for_each_entry(client, &xdna->client_list, node)
+-		amdxdna_hwctx_suspend(client);
+ 
+-	amdxdna_dev_suspend_nolock(xdna);
+-	mutex_unlock(&xdna->dev_lock);
++	if (!xdna->dev_info->ops->suspend)
++		return -EOPNOTSUPP;
+ 
+-	return 0;
++	return xdna->dev_info->ops->suspend(xdna);
+ }
+ 
+ static int amdxdna_pmops_resume(struct device *dev)
+ {
+ 	struct amdxdna_dev *xdna = pci_get_drvdata(to_pci_dev(dev));
+-	struct amdxdna_client *client;
+-	int ret;
+-
+-	XDNA_INFO(xdna, "firmware resuming...");
+-	mutex_lock(&xdna->dev_lock);
+-	ret = amdxdna_dev_resume_nolock(xdna);
+-	if (ret) {
+-		XDNA_ERR(xdna, "resume NPU firmware failed");
+-		mutex_unlock(&xdna->dev_lock);
+-		return ret;
+-	}
+ 
+-	XDNA_INFO(xdna, "hardware context resuming...");
+-	list_for_each_entry(client, &xdna->client_list, node)
+-		amdxdna_hwctx_resume(client);
+-	mutex_unlock(&xdna->dev_lock);
+-
+-	return 0;
+-}
+-
+-static int amdxdna_rpmops_suspend(struct device *dev)
+-{
+-	struct amdxdna_dev *xdna = pci_get_drvdata(to_pci_dev(dev));
+-	int ret;
+-
+-	mutex_lock(&xdna->dev_lock);
+-	ret = amdxdna_dev_suspend_nolock(xdna);
+-	mutex_unlock(&xdna->dev_lock);
+-
+-	XDNA_DBG(xdna, "Runtime suspend done ret: %d", ret);
+-	return ret;
+-}
+-
+-static int amdxdna_rpmops_resume(struct device *dev)
+-{
+-	struct amdxdna_dev *xdna = pci_get_drvdata(to_pci_dev(dev));
+-	int ret;
+-
+-	mutex_lock(&xdna->dev_lock);
+-	ret = amdxdna_dev_resume_nolock(xdna);
+-	mutex_unlock(&xdna->dev_lock);
++	if (!xdna->dev_info->ops->resume)
++		return -EOPNOTSUPP;
+ 
+-	XDNA_DBG(xdna, "Runtime resume done ret: %d", ret);
+-	return ret;
++	return xdna->dev_info->ops->resume(xdna);
+ }
+ 
+ static const struct dev_pm_ops amdxdna_pm_ops = {
+ 	SYSTEM_SLEEP_PM_OPS(amdxdna_pmops_suspend, amdxdna_pmops_resume)
+-	RUNTIME_PM_OPS(amdxdna_rpmops_suspend, amdxdna_rpmops_resume, NULL)
++	RUNTIME_PM_OPS(amdxdna_pmops_suspend, amdxdna_pmops_resume, NULL)
+ };
+ 
+ static struct pci_driver amdxdna_pci_driver = {
+diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.h b/drivers/accel/amdxdna/amdxdna_pci_drv.h
+index ab79600911aaa..40bbb3c063203 100644
+--- a/drivers/accel/amdxdna/amdxdna_pci_drv.h
++++ b/drivers/accel/amdxdna/amdxdna_pci_drv.h
+@@ -50,13 +50,11 @@ struct amdxdna_dev_ops {
+ 	int (*init)(struct amdxdna_dev *xdna);
+ 	void (*fini)(struct amdxdna_dev *xdna);
+ 	int (*resume)(struct amdxdna_dev *xdna);
+-	void (*suspend)(struct amdxdna_dev *xdna);
++	int (*suspend)(struct amdxdna_dev *xdna);
+ 	int (*hwctx_init)(struct amdxdna_hwctx *hwctx);
+ 	void (*hwctx_fini)(struct amdxdna_hwctx *hwctx);
+ 	int (*hwctx_config)(struct amdxdna_hwctx *hwctx, u32 type, u64 value, void *buf, u32 size);
+ 	void (*hmm_invalidate)(struct amdxdna_gem_obj *abo, unsigned long cur_seq);
+-	void (*hwctx_suspend)(struct amdxdna_hwctx *hwctx);
+-	void (*hwctx_resume)(struct amdxdna_hwctx *hwctx);
+ 	int (*cmd_submit)(struct amdxdna_hwctx *hwctx, struct amdxdna_sched_job *job, u64 *seq);
+ 	int (*get_aie_info)(struct amdxdna_client *client, struct amdxdna_drm_get_info *args);
+ 	int (*set_aie_state)(struct amdxdna_client *client, struct amdxdna_drm_set_state *args);
+-- 
+2.51.0
+
diff --git a/queue-6.17/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch b/queue-6.17/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
new file mode 100644
index 0000000000..ccecf99a25
--- /dev/null
+++ b/queue-6.17/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
@@ -0,0 +1,37 @@
+From e5bf84e79fd1711c2c509b9fde487b3cda78e9fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2024 19:58:30 +0300
+Subject: accel/habanalabs/gaudi2: fix BMON disable configuration
+
+From: Vered Yavniely <vered.yavniely@intel.com>
+
+[ Upstream commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd ]
+
+Change the BMON_CR register value back to its original state before
+enabling, so that BMON does not continue to collect information
+after being disabled.
+
+Signed-off-by: Vered Yavniely <vered.yavniely@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+index 2423620ff358f..bc3c57bda5cda 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+@@ -2426,7 +2426,7 @@ static int gaudi2_config_bmon(struct hl_device *hdev, struct hl_debug_params *pa
+ 		WREG32(base_reg + mmBMON_ADDRH_E3_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_REDUCTION_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_STM_TRC_OFFSET, 0x7 | (0xA << 8));
+-		WREG32(base_reg + mmBMON_CR_OFFSET, 0x77 | 0xf << 24);
++		WREG32(base_reg + mmBMON_CR_OFFSET, 0x41);
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch b/queue-6.17/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
new file mode 100644
index 0000000000..7629ee4045
--- /dev/null
+++ b/queue-6.17/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
@@ -0,0 +1,53 @@
+From 42b971d33e3108180e718b80f3e1c9bcb653419c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 15:52:27 +0300
+Subject: accel/habanalabs/gaudi2: read preboot status after recovering from
+ dirty state
+
+From: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+
+[ Upstream commit a0d866bab184161ba155b352650083bf6695e50e ]
+
+Dirty state can occur when the host VM undergoes a reset while the
+device does not. In such a case, the driver must reset the device before
+it can be used again. As part of this reset, the device capabilities
+are zeroed. Therefore, the driver must read the Preboot status again to
+learn the Preboot state, capabilities, and security configuration.
+
+Signed-off-by: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 5722e4128d3ce..3df72a5d024a6 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -3150,7 +3150,6 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 	rc = hl_fw_read_preboot_status(hdev);
+ 	if (rc) {
+ 		if (hdev->reset_on_preboot_fail)
+-			/* we are already on failure flow, so don't check if hw_fini fails. */
+ 			hdev->asic_funcs->hw_fini(hdev, true, false);
+ 		goto pci_fini;
+ 	}
+@@ -3162,6 +3161,13 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 			dev_err(hdev->dev, "failed to reset HW in dirty state (%d)\n", rc);
+ 			goto pci_fini;
+ 		}
++
++		rc = hl_fw_read_preboot_status(hdev);
++		if (rc) {
++			if (hdev->reset_on_preboot_fail)
++				hdev->asic_funcs->hw_fini(hdev, true, false);
++			goto pci_fini;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/accel-habanalabs-return-enomem-if-less-than-requeste.patch b/queue-6.17/accel-habanalabs-return-enomem-if-less-than-requeste.patch
new file mode 100644
index 0000000000..ad4a704534
--- /dev/null
+++ b/queue-6.17/accel-habanalabs-return-enomem-if-less-than-requeste.patch
@@ -0,0 +1,42 @@
+From 43ae58d210d3ba82a5dcfa9141fee2bfe2c7b127 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2024 16:32:32 +0300
+Subject: accel/habanalabs: return ENOMEM if less than requested pages were
+ pinned
+
+From: Tomer Tayar <tomer.tayar@intel.com>
+
+[ Upstream commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 ]
+
+EFAULT is currently returned if less than requested user pages are
+pinned. This value means a "bad address" which might be confusing to
+the user, as the address of the given user memory is not necessarily
+"bad".
+
+Modify the return value to ENOMEM, as "out of memory" is more suitable
+in this case.
+
+Signed-off-by: Tomer Tayar <tomer.tayar@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/common/memory.c b/drivers/accel/habanalabs/common/memory.c
+index 61472a381904e..48d2d598a3876 100644
+--- a/drivers/accel/habanalabs/common/memory.c
++++ b/drivers/accel/habanalabs/common/memory.c
+@@ -2332,7 +2332,7 @@ static int get_user_memory(struct hl_device *hdev, u64 addr, u64 size,
+ 		if (rc < 0)
+ 			goto destroy_pages;
+ 		npages = rc;
+-		rc = -EFAULT;
++		rc = -ENOMEM;
+ 		goto put_pages;
+ 	}
+ 	userptr->npages = npages;
+-- 
+2.51.0
+
diff --git a/queue-6.17/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch b/queue-6.17/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
new file mode 100644
index 0000000000..dfdc8bfe61
--- /dev/null
+++ b/queue-6.17/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
@@ -0,0 +1,84 @@
+From 5b1ded07b162c2ad25901b13ea73f8a5ba817157 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2024 15:01:26 +0300
+Subject: accel/habanalabs: support mapping cb with vmalloc-backed coherent
+ memory
+
+From: Moti Haimovski <moti.haimovski@intel.com>
+
+[ Upstream commit 513024d5a0e34fd34247043f1876b6138ca52847 ]
+
+When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return
+addresses from the vmalloc range. If such an address is mapped without
+VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the
+VM_PFNMAP restriction.
+
+Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP
+in the VMA before mapping. This ensures safe mapping and avoids kernel
+crashes. The memory is still driver-allocated and cannot be accessed
+directly by userspace.
+
+Signed-off-by: Moti Haimovski  <moti.haimovski@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi/gaudi.c   | 19 +++++++++++++++++++
+ drivers/accel/habanalabs/gaudi2/gaudi2.c |  7 +++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/accel/habanalabs/gaudi/gaudi.c b/drivers/accel/habanalabs/gaudi/gaudi.c
+index fa893a9b826ec..34771d75da9d7 100644
+--- a/drivers/accel/habanalabs/gaudi/gaudi.c
++++ b/drivers/accel/habanalabs/gaudi/gaudi.c
+@@ -4168,10 +4168,29 @@ static int gaudi_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 	vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP |
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
++#ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
++
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr,
+ 				(dma_addr - HOST_PHYS_BASE), size);
+ 	if (rc)
+ 		dev_err(hdev->dev, "dma_mmap_coherent error %d", rc);
++#else
++
++	rc = remap_pfn_range(vma, vma->vm_start,
++				virt_to_phys(cpu_addr) >> PAGE_SHIFT,
++				size, vma->vm_page_prot);
++	if (rc)
++		dev_err(hdev->dev, "remap_pfn_range error %d", rc);
++
++ #endif
++
+ 
+ 	return rc;
+ }
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 3df72a5d024a6..b957957df3d3a 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -6490,6 +6490,13 @@ static int gaudi2_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
+ #ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
+ 
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr, dma_addr, size);
+ 	if (rc)
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpi-scan-update-honor-list-for-rpmi-system-msi.patch b/queue-6.17/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
new file mode 100644
index 0000000000..72ca0496f2
--- /dev/null
+++ b/queue-6.17/acpi-scan-update-honor-list-for-rpmi-system-msi.patch
@@ -0,0 +1,45 @@
+From 62f3ea21b7402b806fdd1231807ef228aac7232e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:39:12 +0530
+Subject: ACPI: scan: Update honor list for RPMI System MSI
+
+From: Sunil V L <sunilvl@ventanamicro.com>
+
+[ Upstream commit 4215d1cf59e4b272755f4277a05cd5967935a704 ]
+
+The RPMI System MSI interrupt controller (just like PLIC and APLIC)
+needs to probed prior to devices like GED which use interrupts provided
+by it. Also, it has dependency on the SBI MPXY mailbox device.
+
+Add HIDs of RPMI System MSI and SBI MPXY mailbox devices to the honor
+list so that those dependencies are handled.
+
+Reviewed-by: Atish Patra <atishp@rivosinc.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Acked-by: Jassi Brar <jassisinghbrar@gmail.com>
+Link: https://lore.kernel.org/r/20250818040920.272664-17-apatel@ventanamicro.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 9865faa996b0d..f2e032f381625 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -860,6 +860,8 @@ static const char * const acpi_honor_dep_ids[] = {
+ 	"INTC10CF", /* IVSC (MTL) driver must be loaded to allow i2c access to camera sensors */
+ 	"RSCV0001", /* RISC-V PLIC */
+ 	"RSCV0002", /* RISC-V APLIC */
++	"RSCV0005", /* RISC-V SBI MPXY MBOX */
++	"RSCV0006", /* RISC-V RPMI SYSMSI */
+ 	"PNP0C0F",  /* PCI Link Device */
+ 	NULL
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-6.17/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..04e398857f
--- /dev/null
+++ b/queue-6.17/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From 886bbafc955c269ebc2b913d7742047e48fb2e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index e707a70368026..b2f756b7078d3 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/allow-finish_no_open-file-err_ptr-e.patch b/queue-6.17/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..ee2e4de504
--- /dev/null
+++ b/queue-6.17/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 162407bbdeecfb0045191f09a12e6f3de7210fa6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index 9655158c38853..4890b13461c7b 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -1059,18 +1059,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch b/queue-6.17/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
new file mode 100644
index 0000000000..376f5e7984
--- /dev/null
+++ b/queue-6.17/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
@@ -0,0 +1,39 @@
+From bfae597f3d84b25095d81957b77eb47711f15100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 14:13:27 +0200
+Subject: ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c ]
+
+snd_seq_fifo_poll_wait() evaluates f->cells without locking after
+poll_wait(), and KCSAN doesn't like it as it appears to be a
+data-race.  Although this doesn't matter much in practice as the value
+is volatile, it's still better to address it for the mind piece.
+
+Wrap it with f->lock spinlock for avoiding the potential data race.
+
+Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_fifo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 3a10b081f129c..7dc2bd94cefc3 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -213,6 +213,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file,
+ 			   poll_table *wait)
+ {
+ 	poll_wait(file, &f->input_sleep, wait);
++	guard(spinlock_irq)(&f->lock);
+ 	return (f->cells > 0);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/alsa-serial-generic-remove-shared-static-buffer.patch b/queue-6.17/alsa-serial-generic-remove-shared-static-buffer.patch
new file mode 100644
index 0000000000..861161d67e
--- /dev/null
+++ b/queue-6.17/alsa-serial-generic-remove-shared-static-buffer.patch
@@ -0,0 +1,71 @@
+From c771bcdef89a4623e84942d331e31eb5bf6a914e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:42:19 +0100
+Subject: ALSA: serial-generic: remove shared static buffer
+
+From: John Keeping <jkeeping@inmusicbrands.com>
+
+[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
+
+If multiple instances of this driver are instantiated and try to send
+concurrently then the single static buffer snd_serial_generic_tx_work()
+will cause corruption in the data output.
+
+Move the buffer into the per-instance driver data to avoid this.
+
+Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/drivers/serial-generic.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c
+index 21ae053c05767..766206c6ca75a 100644
+--- a/sound/drivers/serial-generic.c
++++ b/sound/drivers/serial-generic.c
+@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");
+ #define SERIAL_TX_STATE_ACTIVE	1
+ #define SERIAL_TX_STATE_WAKEUP	2
+ 
++#define INTERNAL_BUF_SIZE 256
++
+ struct snd_serial_generic {
+ 	struct serdev_device *serdev;
+ 
+@@ -51,6 +53,7 @@ struct snd_serial_generic {
+ 	struct work_struct tx_work;
+ 	unsigned long tx_state;
+ 
++	char tx_buf[INTERNAL_BUF_SIZE];
+ };
+ 
+ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+ 	schedule_work(&drvdata->tx_work);
+ }
+ 
+-#define INTERNAL_BUF_SIZE 256
+-
+ static void snd_serial_generic_tx_work(struct work_struct *work)
+ {
+-	static char buf[INTERNAL_BUF_SIZE];
+ 	int num_bytes;
+ 	struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic,
+ 						   tx_work);
+@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)
+ 		if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode))
+ 			break;
+ 
+-		num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE);
+-		num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes);
++		num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf,
++						      INTERNAL_BUF_SIZE);
++		num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf,
++						    num_bytes);
+ 
+ 		if (!num_bytes)
+ 			break;
+-- 
+2.51.0
+
diff --git a/queue-6.17/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-6.17/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..8a19a02b96
--- /dev/null
+++ b/queue-6.17/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From 6be5e21849409ac18eb7a660f62f327a79ba52db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-6.17/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-6.17/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..b7aebbacee
--- /dev/null
+++ b/queue-6.17/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From b97f6f4146e7777a0969edcbbc1544a163185bd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 63b300bc67ba9..cf296decefefc 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/alsa-usb-audio-don-t-apply-interface-quirk-to-preson.patch b/queue-6.17/alsa-usb-audio-don-t-apply-interface-quirk-to-preson.patch
new file mode 100644
index 0000000000..4e515f8a39
--- /dev/null
+++ b/queue-6.17/alsa-usb-audio-don-t-apply-interface-quirk-to-preson.patch
@@ -0,0 +1,46 @@
+From f0fcc56bfefb707b298f5685fccb29e6a60bf04f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 20:54:10 +0200
+Subject: ALSA: usb-audio: don't apply interface quirk to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit d1d6ad7f6686e208aba06b7af3feef7a7cba61cf ]
+
+Testing with a Presonus STUDIO 1824c together with
+a Behringer ultragain digital ADAT device shows that
+using all 3 altno settings works fine.
+
+When selecting sample rate, the driver sets the interface
+to the correct altno setting and the correct number of
+channels is set.
+
+Selecting the correct altno setting via Ardour, Reaper or
+whatever other way to set the sample rate is more convenient
+than re-loading the driver module with device_setup to
+set altno.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 766db7d00cbc9..4a35f962527e9 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1599,9 +1599,6 @@ int snd_usb_apply_interface_quirk(struct snd_usb_audio *chip,
+ 	/* presonus studio 1810c: skip altsets incompatible with device_setup */
+ 	if (chip->usb_id == USB_ID(0x194f, 0x010c))
+ 		return s1810c_skip_setting_quirk(chip, iface, altno);
+-	/* presonus studio 1824c: skip altsets incompatible with device_setup */
+-	if (chip->usb_id == USB_ID(0x194f, 0x010d))
+-		return s1810c_skip_setting_quirk(chip, iface, altno);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/amd-amdkfd-enhance-kfd-process-check-in-switch-parti.patch b/queue-6.17/amd-amdkfd-enhance-kfd-process-check-in-switch-parti.patch
new file mode 100644
index 0000000000..613121d826
--- /dev/null
+++ b/queue-6.17/amd-amdkfd-enhance-kfd-process-check-in-switch-parti.patch
@@ -0,0 +1,157 @@
+From 1124a4e9b9da783fa14017d322cb93139f2c07bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 23:19:14 +0800
+Subject: amd/amdkfd: enhance kfd process check in switch partition
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 45da20e00d5da842e17dfc633072b127504f0d0e ]
+
+current switch partition only check if kfd_processes_table is empty.
+kfd_prcesses_table entry is deleted in kfd_process_notifier_release, but
+kfd_process tear down is in kfd_process_wq_release.
+
+consider two processes:
+
+Process A (workqueue) -> kfd_process_wq_release -> Access kfd_node member
+Process B switch partition -> amdgpu_xcp_pre_partition_switch -> amdgpu_amdkfd_device_fini_sw
+-> kfd_node tear down.
+
+Process A and B may trigger a race as shown in dmesg log.
+
+This patch is to resolve the race by adding an atomic kfd_process counter
+kfd_processes_count, it increment as create kfd process, decrement as
+finish kfd_process_wq_release.
+
+v2: Put kfd_processes_count per kfd_dev, move decrement to kfd_process_destroy_pdds
+and bug fix. (Philip Yang)
+
+[3966658.307702] divide error: 0000 [#1] SMP NOPTI
+[3966658.350818]  i10nm_edac
+[3966658.356318] CPU: 124 PID: 38435 Comm: kworker/124:0 Kdump: loaded Tainted
+[3966658.356890] Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]
+[3966658.362839]  nfit
+[3966658.366457] RIP: 0010:kfd_get_num_sdma_engines+0x17/0x40 [amdgpu]
+[3966658.366460] Code: 00 00 e9 ac 81 02 00 66 66 2e 0f 1f 84 00 00 00 00 00 90 0f 1f 44 00 00 48 8b 4f 08 48 8b b7 00 01 00 00 8b 81 58 26 03 00 99 <f7> be b8 01 00 00 80 b9 70 2e 00 00 00 74 0b 83 f8 02 ba 02 00 00
+[3966658.380967]  x86_pkg_temp_thermal
+[3966658.391529] RSP: 0018:ffffc900a0edfdd8 EFLAGS: 00010246
+[3966658.391531] RAX: 0000000000000008 RBX: ffff8974e593b800 RCX: ffff888645900000
+[3966658.391531] RDX: 0000000000000000 RSI: ffff888129154400 RDI: ffff888129151c00
+[3966658.391532] RBP: ffff8883ad79d400 R08: 0000000000000000 R09: ffff8890d2750af4
+[3966658.391532] R10: 0000000000000018 R11: 0000000000000018 R12: 0000000000000000
+[3966658.391533] R13: ffff8883ad79d400 R14: ffffe87ff662ba00 R15: ffff8974e593b800
+[3966658.391533] FS:  0000000000000000(0000) GS:ffff88fe7f600000(0000) knlGS:0000000000000000
+[3966658.391534] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[3966658.391534] CR2: 0000000000d71000 CR3: 000000dd0e970004 CR4: 0000000002770ee0
+[3966658.391535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[3966658.391535] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[3966658.391536] PKRU: 55555554
+[3966658.391536] Call Trace:
+[3966658.391674]  deallocate_sdma_queue+0x38/0xa0 [amdgpu]
+[3966658.391762]  process_termination_cpsch+0x1ed/0x480 [amdgpu]
+[3966658.399754]  intel_powerclamp
+[3966658.402831]  kfd_process_dequeue_from_all_devices+0x5b/0xc0 [amdgpu]
+[3966658.402908]  kfd_process_wq_release+0x1a/0x1a0 [amdgpu]
+[3966658.410516]  coretemp
+[3966658.434016]  process_one_work+0x1ad/0x380
+[3966658.434021]  worker_thread+0x49/0x310
+[3966658.438963]  kvm_intel
+[3966658.446041]  ? process_one_work+0x380/0x380
+[3966658.446045]  kthread+0x118/0x140
+[3966658.446047]  ? __kthread_bind_mask+0x60/0x60
+[3966658.446050]  ret_from_fork+0x1f/0x30
+[3966658.446053] Modules linked in: kpatch_20765354(OEK)
+[3966658.455310]  kvm
+[3966658.464534]  mptcp_diag xsk_diag raw_diag unix_diag af_packet_diag netlink_diag udp_diag act_pedit act_mirred act_vlan cls_flower kpatch_21951273(OEK) kpatch_18424469(OEK) kpatch_19749756(OEK)
+[3966658.473462]  idxd_mdev
+[3966658.482306]  kpatch_17971294(OEK) sch_ingress xt_conntrack amdgpu(OE) amdxcp(OE) amddrm_buddy(OE) amd_sched(OE) amdttm(OE) amdkcl(OE) intel_ifs iptable_mangle tcm_loop target_core_pscsi tcp_diag target_core_file inet_diag target_core_iblock target_core_user target_core_mod coldpgs kpatch_18383292(OEK) ip6table_nat ip6table_filter ip6_tables ip_set_hash_ipportip ip_set_hash_ipportnet ip_set_hash_ipport ip_set_bitmap_port xt_comment iptable_nat nf_nat iptable_filter ip_tables ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 sn_core_odd(OE) i40e overlay binfmt_misc tun bonding(OE) aisqos(OE) aisqos_hotfixes(OE) rfkill uio_pci_generic uio cuse fuse nf_tables nfnetlink intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac nfit x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm idxd_mdev
+[3966658.491237]  vfio_pci
+[3966658.501196]  vfio_pci vfio_virqfd mdev vfio_iommu_type1 vfio iax_crypto intel_pmt_telemetry iTCO_wdt intel_pmt_class iTCO_vendor_support irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel rapl intel_cstate snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_seq
+[3966658.508537]  vfio_virqfd
+[3966658.517569]  snd_seq_device ipmi_ssif isst_if_mbox_pci isst_if_mmio pcspkr snd_pcm idxd intel_uncore ses isst_if_common intel_vsec idxd_bus enclosure snd_timer mei_me snd i2c_i801 i2c_smbus mei i2c_ismt soundcore joydev acpi_ipmi ipmi_si ipmi_devintf ipmi_msghandler acpi_power_meter acpi_pad vfat fat
+[3966658.526851]  mdev
+[3966658.536096]  nfsd auth_rpcgss nfs_acl lockd grace slb_vtoa(OE) sunrpc dm_mod hookers mlx5_ib(OE) ast i2c_algo_bit drm_vram_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm_ttm_helper ttm mlx5_core(OE) mlxfw(OE)
+[3966658.540381]  vfio_iommu_type1
+[3966658.544341]  nvme mpt3sas tls drm nvme_core pci_hyperv_intf raid_class psample libcrc32c crc32c_intel mlxdevm(OE) i2c_core
+[3966658.551254]  vfio
+[3966658.558742]  scsi_transport_sas wmi pinctrl_emmitsburg sd_mod t10_pi sg ahci libahci libata rdma_ucm(OE) ib_uverbs(OE) rdma_cm(OE) iw_cm(OE) ib_cm(OE) ib_umad(OE) ib_core(OE) ib_ucm(OE) mlx_compat(OE)
+[3966658.563004]  iax_crypto
+[3966658.570988]  [last unloaded: diagnose]
+[3966658.571027] ---[ end trace cc9dbb180f9ae537 ]---
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: Philip.Yang<Philip.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c  | 10 ++++++++++
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h    |  2 ++
+ drivers/gpu/drm/amd/amdkfd/kfd_process.c |  4 ++++
+ 3 files changed, 16 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 051a00152b089..e9cfb80bd4366 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -495,6 +495,7 @@ struct kfd_dev *kgd2kfd_probe(struct amdgpu_device *adev, bool vf)
+ 	mutex_init(&kfd->doorbell_mutex);
+ 
+ 	ida_init(&kfd->doorbell_ida);
++	atomic_set(&kfd->kfd_processes_count, 0);
+ 
+ 	return kfd;
+ }
+@@ -1493,6 +1494,15 @@ int kgd2kfd_check_and_lock_kfd(struct kfd_dev *kfd)
+ 
+ 	mutex_lock(&kfd_processes_mutex);
+ 
++	/* kfd_processes_count is per kfd_dev, return -EBUSY without
++	 * further check
++	 */
++	if (!!atomic_read(&kfd->kfd_processes_count)) {
++		pr_debug("process_wq_release not finished\n");
++		r = -EBUSY;
++		goto out;
++	}
++
+ 	if (hash_empty(kfd_processes_table) && !kfd_is_locked(kfd))
+ 		goto out;
+ 
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index d01ef5ac07666..70ef051511bb1 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -382,6 +382,8 @@ struct kfd_dev {
+ 
+ 	/* for dynamic partitioning */
+ 	int kfd_dev_lock;
++
++	atomic_t kfd_processes_count;
+ };
+ 
+ enum kfd_mempool {
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index 5be28c6c4f6aa..ddfe30c13e9d6 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -1088,6 +1088,8 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)
+ 			pdd->runtime_inuse = false;
+ 		}
+ 
++		atomic_dec(&pdd->dev->kfd->kfd_processes_count);
++
+ 		kfree(pdd);
+ 		p->pdds[i] = NULL;
+ 	}
+@@ -1649,6 +1651,8 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev,
+ 	/* Init idr used for memory handle translation */
+ 	idr_init(&pdd->alloc_idr);
+ 
++	atomic_inc(&dev->kfd->kfd_processes_count);
++
+ 	return pdd;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch b/queue-6.17/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
new file mode 100644
index 0000000000..7ea94f2284
--- /dev/null
+++ b/queue-6.17/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
@@ -0,0 +1,121 @@
+From afd13774f354b9d478674a579b45629e82d235de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:21:15 +0800
+Subject: amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 ]
+
+There is race in amdgpu_amdkfd_device_fini_sw and interrupt.
+if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and
+  kfree(kfd), and KGD interrupt generated.
+
+kernel panic log:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000098
+amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP
+
+PGD d78c68067 P4D d78c68067
+
+kfd kfd: amdgpu: Allocated 3969056 bytes on gart
+
+PUD 1465b8067 PMD @
+
+Oops: @002 [#1] SMP NOPTI
+
+kfd kfd: amdgpu: Total number of KFD nodes to be created: 4
+CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K
+
+RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40
+
+Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 <fO> OF b1 17 75 Ba 4c 89 e@ 41 Sc
+
+89 c6 e8 07 38 5d
+
+RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046
+
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018
+0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098
+ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020
+0000000000000000 R11: 0000000000000000 R12: 0900000000000002
+ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00
+
+CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033
+
+CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0
+0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400
+
+PKRU: 55555554
+
+Call Trace:
+
+<IRQ>
+
+kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu]
+
+? amdgpu_fence_process+0xa4/0x150 [amdgpu]
+
+kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace
+
+amdgpu_irq_dispatch+0x165/0x210 [amdgpu]
+
+amdgpu_ih_process+0x80/0x100 [amdgpu]
+
+amdgpu: Virtual CRAT table created for GPU
+
+amdgpu_irq_handler+0x1f/@x60 [amdgpu]
+
+__handle_irq_event_percpu+0x3d/0x170
+
+amdgpu: Topology: Add dGPU node [0x74a2:0x1002]
+
+handle_irq_event+0x5a/@xcO
+
+handle_edge_irq+0x93/0x240
+
+kfd kfd: amdgpu: KFD node 1 partition @ size 49148M
+
+asm_call_irq_on_stack+0xf/@x20
+
+</IRQ>
+
+common_interrupt+0xb3/0x130
+
+asm_common_interrupt+0x1le/0x40
+
+5.10.134-010.a1i5000.a18.x86_64 #1
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: Philip Yang<Philip.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 349c351e242b5..051a00152b089 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -1133,7 +1133,15 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ 	}
+ 
+ 	for (i = 0; i < kfd->num_nodes; i++) {
+-		node = kfd->nodes[i];
++		/* Race if another thread in b/w
++		 * kfd_cleanup_nodes and kfree(kfd),
++		 * when kfd->nodes[i] = NULL
++		 */
++		if (kfd->nodes[i])
++			node = kfd->nodes[i];
++		else
++			return;
++
+ 		spin_lock_irqsave(&node->interrupt_lock, flags);
+ 
+ 		if (node->interrupts_active
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-codecs-wsa883x-handle-shared-reset-gpio-for-wsa.patch b/queue-6.17/asoc-codecs-wsa883x-handle-shared-reset-gpio-for-wsa.patch
new file mode 100644
index 0000000000..acd5037b20
--- /dev/null
+++ b/queue-6.17/asoc-codecs-wsa883x-handle-shared-reset-gpio-for-wsa.patch
@@ -0,0 +1,129 @@
+From 3e5ece9164217c43ee39b4cdc676df6bb0e144f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 22:53:53 +0530
+Subject: ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers
+
+From: Mohammad Rafi Shaik <quic_mohs@quicinc.com>
+
+[ Upstream commit cf65182247761f7993737b710afe8c781699356b ]
+
+On some Qualcomm platforms such as QCS6490-RB3Gen2, the multiple
+WSA8830/WSA8835 speaker amplifiers share a common reset (shutdown) GPIO.
+
+To handle such scenario, use the reset controller framework and its
+"reset-gpio" driver to handle such case. This allows proper handling
+of all WSA883x speaker amplifiers on QCS6490-RB3Gen2 board.
+
+Signed-off-by: Mohammad Rafi Shaik <quic_mohs@quicinc.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250815172353.2430981-3-mohammad.rafi.shaik@oss.qualcomm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wsa883x.c | 57 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 49 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c
+index 188363b03b937..ca4520ade79aa 100644
+--- a/sound/soc/codecs/wsa883x.c
++++ b/sound/soc/codecs/wsa883x.c
+@@ -14,6 +14,7 @@
+ #include <linux/printk.h>
+ #include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/reset.h>
+ #include <linux/slab.h>
+ #include <linux/soundwire/sdw.h>
+ #include <linux/soundwire/sdw_registers.h>
+@@ -468,6 +469,7 @@ struct wsa883x_priv {
+ 	struct sdw_stream_runtime *sruntime;
+ 	struct sdw_port_config port_config[WSA883X_MAX_SWR_PORTS];
+ 	struct gpio_desc *sd_n;
++	struct reset_control *sd_reset;
+ 	bool port_prepared[WSA883X_MAX_SWR_PORTS];
+ 	bool port_enable[WSA883X_MAX_SWR_PORTS];
+ 	int active_ports;
+@@ -1546,6 +1548,46 @@ static const struct hwmon_chip_info wsa883x_hwmon_chip_info = {
+ 	.info	= wsa883x_hwmon_info,
+ };
+ 
++static void wsa883x_reset_assert(void *data)
++{
++	struct wsa883x_priv *wsa883x = data;
++
++	if (wsa883x->sd_reset)
++		reset_control_assert(wsa883x->sd_reset);
++	else
++		gpiod_direction_output(wsa883x->sd_n, 1);
++}
++
++static void wsa883x_reset_deassert(struct wsa883x_priv *wsa883x)
++{
++	if (wsa883x->sd_reset)
++		reset_control_deassert(wsa883x->sd_reset);
++	else
++		gpiod_direction_output(wsa883x->sd_n, 0);
++}
++
++static int wsa883x_get_reset(struct device *dev, struct wsa883x_priv *wsa883x)
++{
++	wsa883x->sd_reset = devm_reset_control_get_optional_shared(dev, NULL);
++	if (IS_ERR(wsa883x->sd_reset))
++		return dev_err_probe(dev, PTR_ERR(wsa883x->sd_reset),
++				     "Failed to get reset\n");
++	/*
++	 * if sd_reset: NULL, so use the backwards compatible way for powerdown-gpios,
++	 * which does not handle sharing GPIO properly.
++	 */
++	if (!wsa883x->sd_reset) {
++		wsa883x->sd_n = devm_gpiod_get_optional(dev, "powerdown",
++							GPIOD_FLAGS_BIT_NONEXCLUSIVE |
++							GPIOD_OUT_HIGH);
++		if (IS_ERR(wsa883x->sd_n))
++			return dev_err_probe(dev, PTR_ERR(wsa883x->sd_n),
++					     "Shutdown Control GPIO not found\n");
++	}
++
++	return 0;
++}
++
+ static int wsa883x_probe(struct sdw_slave *pdev,
+ 			 const struct sdw_device_id *id)
+ {
+@@ -1566,13 +1608,9 @@ static int wsa883x_probe(struct sdw_slave *pdev,
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Failed to enable vdd regulator\n");
+ 
+-	wsa883x->sd_n = devm_gpiod_get_optional(dev, "powerdown",
+-						GPIOD_FLAGS_BIT_NONEXCLUSIVE | GPIOD_OUT_HIGH);
+-	if (IS_ERR(wsa883x->sd_n)) {
+-		ret = dev_err_probe(dev, PTR_ERR(wsa883x->sd_n),
+-				    "Shutdown Control GPIO not found\n");
++	ret = wsa883x_get_reset(dev, wsa883x);
++	if (ret)
+ 		goto err;
+-	}
+ 
+ 	dev_set_drvdata(dev, wsa883x);
+ 	wsa883x->slave = pdev;
+@@ -1595,11 +1633,14 @@ static int wsa883x_probe(struct sdw_slave *pdev,
+ 	pdev->prop.simple_clk_stop_capable = true;
+ 	pdev->prop.sink_dpn_prop = wsa_sink_dpn_prop;
+ 	pdev->prop.scp_int1_mask = SDW_SCP_INT1_BUS_CLASH | SDW_SCP_INT1_PARITY;
+-	gpiod_direction_output(wsa883x->sd_n, 0);
++
++	wsa883x_reset_deassert(wsa883x);
++	ret = devm_add_action_or_reset(dev, wsa883x_reset_assert, wsa883x);
++	if (ret)
++		return ret;
+ 
+ 	wsa883x->regmap = devm_regmap_init_sdw(pdev, &wsa883x_regmap_config);
+ 	if (IS_ERR(wsa883x->regmap)) {
+-		gpiod_direction_output(wsa883x->sd_n, 1);
+ 		ret = dev_err_probe(dev, PTR_ERR(wsa883x->regmap),
+ 				    "regmap_init failed\n");
+ 		goto err;
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-es8323-add-proper-left-right-mixer-controls-via.patch b/queue-6.17/asoc-es8323-add-proper-left-right-mixer-controls-via.patch
new file mode 100644
index 0000000000..e7f135d296
--- /dev/null
+++ b/queue-6.17/asoc-es8323-add-proper-left-right-mixer-controls-via.patch
@@ -0,0 +1,43 @@
+From 6baeda6796673d1a546acdef4273312c14f002a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 23:20:22 -0500
+Subject: ASoC: es8323: add proper left/right mixer controls via DAPM
+
+From: Shimrra Shai <shimrrashai@gmail.com>
+
+[ Upstream commit 7e39ca4056d11fef6b90aedd9eeeb3e070d3ce9f ]
+
+Add proper DAC and mixer controls to DAPM; no initialization in
+es8323_probe.
+
+Signed-off-by: Shimrra Shai <shimrrashai@gmail.com>
+Link: https://patch.msgid.link/20250815042023.115485-3-shimrrashai@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8323.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/es8323.c b/sound/soc/codecs/es8323.c
+index 4c15fffda733c..eb85b71e87f39 100644
+--- a/sound/soc/codecs/es8323.c
++++ b/sound/soc/codecs/es8323.c
+@@ -182,13 +182,13 @@ static const struct snd_kcontrol_new es8323_mono_adc_mux_controls =
+ 
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8323_left_mixer_controls[] = {
+-	SOC_DAPM_SINGLE("Left Playback Switch", SND_SOC_NOPM, 7, 1, 1),
++	SOC_DAPM_SINGLE("Left Playback Switch", ES8323_DACCONTROL17, 7, 1, 0),
+ 	SOC_DAPM_SINGLE("Left Bypass Switch", ES8323_DACCONTROL17, 6, 1, 0),
+ };
+ 
+ /* Right Mixer */
+ static const struct snd_kcontrol_new es8323_right_mixer_controls[] = {
+-	SOC_DAPM_SINGLE("Right Playback Switch", SND_SOC_NOPM, 6, 1, 1),
++	SOC_DAPM_SINGLE("Right Playback Switch", ES8323_DACCONTROL20, 7, 1, 0),
+ 	SOC_DAPM_SINGLE("Right Bypass Switch", ES8323_DACCONTROL20, 6, 1, 0),
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-es8323-enable-dapm-power-widgets-for-playback-d.patch b/queue-6.17/asoc-es8323-enable-dapm-power-widgets-for-playback-d.patch
new file mode 100644
index 0000000000..309c932972
--- /dev/null
+++ b/queue-6.17/asoc-es8323-enable-dapm-power-widgets-for-playback-d.patch
@@ -0,0 +1,52 @@
+From c7720f7bf14cf7a5d9e1cd0584377bb2ee1d3cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 20:49:19 -0500
+Subject: ASoC: es8323: enable DAPM power widgets for playback DAC and output
+
+From: Shimrra Shai <shimrrashai@gmail.com>
+
+[ Upstream commit 258384d8ce365dddd6c5c15204de8ccd53a7ab0a ]
+
+Enable DAPM widgets for power and volume control of playback.
+
+Signed-off-by: Shimrra Shai <shimrrashai@gmail.com>
+Link: https://patch.msgid.link/20250814014919.87170-1-shimrrashai@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8323.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/es8323.c b/sound/soc/codecs/es8323.c
+index a9822998199fb..70d348ff3b437 100644
+--- a/sound/soc/codecs/es8323.c
++++ b/sound/soc/codecs/es8323.c
+@@ -211,8 +211,8 @@ static const struct snd_soc_dapm_widget es8323_dapm_widgets[] = {
+ 
+ 	SND_SOC_DAPM_ADC("Right ADC", "Right Capture", SND_SOC_NOPM, 4, 1),
+ 	SND_SOC_DAPM_ADC("Left ADC", "Left Capture", SND_SOC_NOPM, 5, 1),
+-	SND_SOC_DAPM_DAC("Right DAC", "Right Playback", SND_SOC_NOPM, 6, 1),
+-	SND_SOC_DAPM_DAC("Left DAC", "Left Playback", SND_SOC_NOPM, 7, 1),
++	SND_SOC_DAPM_DAC("Right DAC", "Right Playback", ES8323_DACPOWER, 6, 1),
++	SND_SOC_DAPM_DAC("Left DAC", "Left Playback", ES8323_DACPOWER, 7, 1),
+ 
+ 	SND_SOC_DAPM_MIXER("Left Mixer", SND_SOC_NOPM, 0, 0,
+ 			   &es8323_left_mixer_controls[0],
+@@ -223,10 +223,10 @@ static const struct snd_soc_dapm_widget es8323_dapm_widgets[] = {
+ 
+ 	SND_SOC_DAPM_PGA("Right ADC Power", SND_SOC_NOPM, 6, 1, NULL, 0),
+ 	SND_SOC_DAPM_PGA("Left ADC Power", SND_SOC_NOPM, 7, 1, NULL, 0),
+-	SND_SOC_DAPM_PGA("Right Out 2", SND_SOC_NOPM, 2, 0, NULL, 0),
+-	SND_SOC_DAPM_PGA("Left Out 2", SND_SOC_NOPM, 3, 0, NULL, 0),
+-	SND_SOC_DAPM_PGA("Right Out 1", SND_SOC_NOPM, 4, 0, NULL, 0),
+-	SND_SOC_DAPM_PGA("Left Out 1", SND_SOC_NOPM, 5, 0, NULL, 0),
++	SND_SOC_DAPM_PGA("Right Out 2", ES8323_DACPOWER, 2, 0, NULL, 0),
++	SND_SOC_DAPM_PGA("Left Out 2", ES8323_DACPOWER, 3, 0, NULL, 0),
++	SND_SOC_DAPM_PGA("Right Out 1", ES8323_DACPOWER, 4, 0, NULL, 0),
++	SND_SOC_DAPM_PGA("Left Out 1", ES8323_DACPOWER, 5, 0, NULL, 0),
+ 	SND_SOC_DAPM_PGA("LAMP", ES8323_ADCCONTROL1, 4, 0, NULL, 0),
+ 	SND_SOC_DAPM_PGA("RAMP", ES8323_ADCCONTROL1, 0, 0, NULL, 0),
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-es8323-remove-dac-enablement-write-from-es8323_.patch b/queue-6.17/asoc-es8323-remove-dac-enablement-write-from-es8323_.patch
new file mode 100644
index 0000000000..770e2adf80
--- /dev/null
+++ b/queue-6.17/asoc-es8323-remove-dac-enablement-write-from-es8323_.patch
@@ -0,0 +1,36 @@
+From 44edeb407a37bd0d68644bdff5fd4c9da291ae34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 23:20:21 -0500
+Subject: ASoC: es8323: remove DAC enablement write from es8323_probe
+
+From: Shimrra Shai <shimrrashai@gmail.com>
+
+[ Upstream commit 33bc29123d26f7caa7d11f139e153e39104afc6c ]
+
+Remove initialization of the DAC and mixer enablement bits from the
+es8323_probe routine. This really should be handled by the DAPM
+subsystem.
+
+Signed-off-by: Shimrra Shai <shimrrashai@gmail.com>
+Link: https://patch.msgid.link/20250815042023.115485-2-shimrrashai@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8323.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8323.c b/sound/soc/codecs/es8323.c
+index 70d348ff3b437..4c15fffda733c 100644
+--- a/sound/soc/codecs/es8323.c
++++ b/sound/soc/codecs/es8323.c
+@@ -632,7 +632,6 @@ static int es8323_probe(struct snd_soc_component *component)
+ 
+ 	snd_soc_component_write(component, ES8323_CONTROL2, 0x60);
+ 	snd_soc_component_write(component, ES8323_CHIPPOWER, 0x00);
+-	snd_soc_component_write(component, ES8323_DACCONTROL17, 0xB8);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-intel-avs-do-not-share-the-name-pointer-between.patch b/queue-6.17/asoc-intel-avs-do-not-share-the-name-pointer-between.patch
new file mode 100644
index 0000000000..bac6daf7b8
--- /dev/null
+++ b/queue-6.17/asoc-intel-avs-do-not-share-the-name-pointer-between.patch
@@ -0,0 +1,60 @@
+From 86bda46d7df78888621e5679d7ef10d7f5730e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 12:41:25 +0200
+Subject: ASoC: Intel: avs: Do not share the name pointer between components
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 4dee5c1cc439b0d5ef87f741518268ad6a95b23d ]
+
+By sharing 'name' directly, tearing down components may lead to
+use-after-free errors. Duplicate the name to avoid that.
+
+At the same time, update the order of operations - since commit
+cee28113db17 ("ASoC: dmaengine_pcm: Allow passing component name via
+config") the framework does not override component->name if set before
+invoking the initializer.
+
+Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://patch.msgid.link/20250818104126.526442-4-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/pcm.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c
+index 0180cf7d5fe15..306c94911a775 100644
+--- a/sound/soc/intel/avs/pcm.c
++++ b/sound/soc/intel/avs/pcm.c
+@@ -1393,16 +1393,18 @@ int avs_soc_component_register(struct device *dev, const char *name,
+ 	if (!acomp)
+ 		return -ENOMEM;
+ 
+-	ret = snd_soc_component_initialize(&acomp->base, drv, dev);
+-	if (ret < 0)
+-		return ret;
++	acomp->base.name = devm_kstrdup(dev, name, GFP_KERNEL);
++	if (!acomp->base.name)
++		return -ENOMEM;
+ 
+-	/* force name change after ASoC is done with its init */
+-	acomp->base.name = name;
+ 	INIT_LIST_HEAD(&acomp->node);
+ 
+ 	drv->use_dai_pcm_id = !obsolete_card_names;
+ 
++	ret = snd_soc_component_initialize(&acomp->base, drv, dev);
++	if (ret < 0)
++		return ret;
++
+ 	return snd_soc_add_component(&acomp->base, cpu_dais, num_cpu_dais);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch b/queue-6.17/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
new file mode 100644
index 0000000000..79ca6d0dd9
--- /dev/null
+++ b/queue-6.17/asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
@@ -0,0 +1,157 @@
+From b16e5f4816df84d40f32097bea49d014196a078e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 17:20:11 +0800
+Subject: ASoC: mediatek: Use SND_JACK_AVOUT for HDMI/DP jacks
+
+From: Terry Cheong <htcheong@chromium.org>
+
+[ Upstream commit 8ed2dca4df2297177e0edcb7e0c72ef87f3fd81a ]
+
+The SND_JACK_AVOUT is a more specific jack type for HDMI and DisplayPort.
+Updatae the MediaTek drivers to use such jack type, allowing system to
+determine the device type based on jack event.
+
+Signed-off-by: Terry Cheong <htcheong@chromium.org>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://patch.msgid.link/20250723-mtk-hdmi-v1-1-4ff945eb6136@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8173/mt8173-rt5650.c                 | 2 +-
+ sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c        | 2 +-
+ .../soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c  | 2 +-
+ sound/soc/mediatek/mt8186/mt8186-mt6366.c                 | 2 +-
+ sound/soc/mediatek/mt8188/mt8188-mt6359.c                 | 8 ++++----
+ sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c   | 2 +-
+ sound/soc/mediatek/mt8195/mt8195-mt6359.c                 | 4 ++--
+ 7 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+index 7d6a3586cdd55..3d6d7bc05b872 100644
+--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c
++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c
+@@ -159,7 +159,7 @@ static int mt8173_rt5650_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ {
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &mt8173_rt5650_hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+index 3388e076ccc9e..983f3b91119a9 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c
+@@ -378,7 +378,7 @@ static int mt8183_da7219_max98357_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_card_get_drvdata(rtd->card);
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &priv->hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+index 497a9043be7bb..0bc1f11e17aa7 100644
+--- a/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
++++ b/sound/soc/mediatek/mt8183/mt8183-mt6358-ts3a227-max98357.c
+@@ -383,7 +383,7 @@ mt8183_mt6358_ts3a227_max98357_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_card_get_drvdata(rtd->card);
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT,
+ 				    &priv->hdmi_jack);
+ 	if (ret)
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8186/mt8186-mt6366.c b/sound/soc/mediatek/mt8186/mt8186-mt6366.c
+index 43546012cf613..45df69809cbab 100644
+--- a/sound/soc/mediatek/mt8186/mt8186-mt6366.c
++++ b/sound/soc/mediatek/mt8186/mt8186-mt6366.c
+@@ -362,7 +362,7 @@ static int mt8186_mt6366_rt1019_rt5682s_hdmi_init(struct snd_soc_pcm_runtime *rt
+ 		return ret;
+ 	}
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret) {
+ 		dev_err(rtd->dev, "HDMI Jack creation failed: %d\n", ret);
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8188/mt8188-mt6359.c b/sound/soc/mediatek/mt8188/mt8188-mt6359.c
+index ea814a0f726d6..c6e7461e8f764 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-mt6359.c
++++ b/sound/soc/mediatek/mt8188/mt8188-mt6359.c
+@@ -250,14 +250,14 @@ enum mt8188_jacks {
+ static struct snd_soc_jack_pin mt8188_hdmi_jack_pins[] = {
+ 	{
+ 		.pin = "HDMI",
+-		.mask = SND_JACK_LINEOUT,
++		.mask = SND_JACK_AVOUT,
+ 	},
+ };
+ 
+ static struct snd_soc_jack_pin mt8188_dp_jack_pins[] = {
+ 	{
+ 		.pin = "DP",
+-		.mask = SND_JACK_LINEOUT,
++		.mask = SND_JACK_AVOUT,
+ 	},
+ };
+ 
+@@ -638,7 +638,7 @@ static int mt8188_hdmi_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 	int ret = 0;
+ 
+ 	ret = snd_soc_card_jack_new_pins(rtd->card, "HDMI Jack",
+-					 SND_JACK_LINEOUT, jack,
++					 SND_JACK_AVOUT, jack,
+ 					 mt8188_hdmi_jack_pins,
+ 					 ARRAY_SIZE(mt8188_hdmi_jack_pins));
+ 	if (ret) {
+@@ -663,7 +663,7 @@ static int mt8188_dptx_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 	struct snd_soc_component *component = snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret = 0;
+ 
+-	ret = snd_soc_card_jack_new_pins(rtd->card, "DP Jack", SND_JACK_LINEOUT,
++	ret = snd_soc_card_jack_new_pins(rtd->card, "DP Jack", SND_JACK_AVOUT,
+ 					 jack, mt8188_dp_jack_pins,
+ 					 ARRAY_SIZE(mt8188_dp_jack_pins));
+ 	if (ret) {
+diff --git a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+index bf483a8fb34a4..91c57765ab57b 100644
+--- a/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
++++ b/sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c
+@@ -368,7 +368,7 @@ static int mt8192_mt6359_hdmi_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret) {
+ 		dev_err(rtd->dev, "HDMI Jack creation failed: %d\n", ret);
+ 		return ret;
+diff --git a/sound/soc/mediatek/mt8195/mt8195-mt6359.c b/sound/soc/mediatek/mt8195/mt8195-mt6359.c
+index e57391c213e7d..7b96c843a14a5 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-mt6359.c
++++ b/sound/soc/mediatek/mt8195/mt8195-mt6359.c
+@@ -360,7 +360,7 @@ static int mt8195_dptx_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "DP Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "DP Jack", SND_JACK_AVOUT, jack);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -375,7 +375,7 @@ static int mt8195_hdmi_codec_init(struct snd_soc_pcm_runtime *rtd)
+ 		snd_soc_rtd_to_codec(rtd, 0)->component;
+ 	int ret;
+ 
+-	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_LINEOUT, jack);
++	ret = snd_soc_card_jack_new(rtd->card, "HDMI Jack", SND_JACK_AVOUT, jack);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-ops-improve-snd_soc_get_volsw.patch b/queue-6.17/asoc-ops-improve-snd_soc_get_volsw.patch
new file mode 100644
index 0000000000..e34feb225f
--- /dev/null
+++ b/queue-6.17/asoc-ops-improve-snd_soc_get_volsw.patch
@@ -0,0 +1,41 @@
+From cb15c20269a15b0c09b1c74dc2d5de51d65f787c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 14:06:20 +0530
+Subject: ASoC: ops: improve snd_soc_get_volsw
+
+From: Niranjan H Y <niranjan.hy@ti.com>
+
+[ Upstream commit a0ce874cfaaab9792d657440b9d050e2112f6e4d ]
+
+* clamp the values if the register value read is
+  out of range
+
+Signed-off-by: Niranjan H Y <niranjan.hy@ti.com>
+[This patch originally had two changes in it, I removed a second buggy
+ one -- broonie]
+--
+v5:
+ - remove clamp parameter
+ - move the boundary check after sign-bit extension
+Link: https://patch.msgid.link/20250912083624.804-1-niranjan.hy@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-ops.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index a629e0eacb20e..d2b6fb8e0b6c6 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -118,6 +118,7 @@ static int soc_mixer_reg_to_ctl(struct soc_mixer_control *mc, unsigned int reg_v
+ 	if (mc->sign_bit)
+ 		val = sign_extend32(val, mc->sign_bit);
+ 
++	val = clamp(val, mc->min, mc->max);
+ 	val -= mc->min;
+ 
+ 	if (mc->invert)
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch b/queue-6.17/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
new file mode 100644
index 0000000000..591ee8301a
--- /dev/null
+++ b/queue-6.17/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
@@ -0,0 +1,47 @@
+From 9d859c970c2b8d7d26fcd74ed1c8825d1c79e730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 16:43:40 +0100
+Subject: ASoC: qcom: sc8280xp: explicitly set S16LE format in
+ sc8280xp_be_hw_params_fixup()
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
+
+Setting format to s16le is required for compressed playback on compatible
+soundcards.
+
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sc8280xp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
+index 6847ae4acbd18..78e327bc2f077 100644
+--- a/sound/soc/qcom/sc8280xp.c
++++ b/sound/soc/qcom/sc8280xp.c
+@@ -7,6 +7,7 @@
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+ #include <sound/pcm.h>
++#include <sound/pcm_params.h>
+ #include <linux/soundwire/sdw.h>
+ #include <sound/jack.h>
+ #include <linux/input-event-codes.h>
+@@ -86,8 +87,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+ 					SNDRV_PCM_HW_PARAM_RATE);
+ 	struct snd_interval *channels = hw_param_interval(params,
+ 					SNDRV_PCM_HW_PARAM_CHANNELS);
++	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+ 
+ 	rate->min = rate->max = 48000;
++	snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
+ 	channels->min = 2;
+ 	channels->max = 2;
+ 	switch (cpu_dai->id) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-renesas-msiof-add-.symmetric_xxx-on-snd_soc_dai.patch b/queue-6.17/asoc-renesas-msiof-add-.symmetric_xxx-on-snd_soc_dai.patch
new file mode 100644
index 0000000000..ae6997147c
--- /dev/null
+++ b/queue-6.17/asoc-renesas-msiof-add-.symmetric_xxx-on-snd_soc_dai.patch
@@ -0,0 +1,37 @@
+From 309989f0e673358c44eedb02fbf6ca1f61bfad45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 05:17:21 +0000
+Subject: ASoC: renesas: msiof: add .symmetric_xxx on snd_soc_dai_driver
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit ab77fa5533e4d1dcfdd2711b9b1e166e4ed57dab ]
+
+MSIOF TX/RX are sharing same clock. Adds .symmetric_xxx flags.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Link: https://patch.msgid.link/87a52jyuu6.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/renesas/rcar/msiof.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/renesas/rcar/msiof.c b/sound/soc/renesas/rcar/msiof.c
+index 36d31ab8ac6a5..7a9ecc73231a8 100644
+--- a/sound/soc/renesas/rcar/msiof.c
++++ b/sound/soc/renesas/rcar/msiof.c
+@@ -292,6 +292,9 @@ static struct snd_soc_dai_driver msiof_dai_driver = {
+ 		.channels_max	= 2,
+ 	},
+ 	.ops = &msiof_dai_ops,
++	.symmetric_rate		= 1,
++	.symmetric_channels	= 1,
++	.symmetric_sample_bits	= 1,
+ };
+ 
+ static struct snd_pcm_hardware msiof_pcm_hardware = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-renesas-msiof-set-sifctr-register.patch b/queue-6.17/asoc-renesas-msiof-set-sifctr-register.patch
new file mode 100644
index 0000000000..9f6e502767
--- /dev/null
+++ b/queue-6.17/asoc-renesas-msiof-set-sifctr-register.patch
@@ -0,0 +1,41 @@
+From 20deecd8c26a46fc5511a4d7c770be6f3be78fa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 05:17:17 +0000
+Subject: ASoC: renesas: msiof: set SIFCTR register
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 130947b4681c515a5e5a7961244b502de2de85ca ]
+
+Because it uses DMAC, we would like to transfer data if there is any data.
+Set SIFCTR for it.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Link: https://patch.msgid.link/87bjmzyuub.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/renesas/rcar/msiof.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/renesas/rcar/msiof.c b/sound/soc/renesas/rcar/msiof.c
+index 555fdd4fb2513..ede0211daacba 100644
+--- a/sound/soc/renesas/rcar/msiof.c
++++ b/sound/soc/renesas/rcar/msiof.c
+@@ -185,6 +185,12 @@ static int msiof_hw_start(struct snd_soc_component *component,
+ 		msiof_write(priv, SIRMDR3, val);
+ 	}
+ 
++	/* SIFCTR */
++	if (is_play)
++		msiof_update(priv, SIFCTR, SIFCTR_TFWM, FIELD_PREP(SIFCTR_TFWM, SIFCTR_TFWM_1));
++	else
++		msiof_update(priv, SIFCTR, SIFCTR_RFWM, FIELD_PREP(SIFCTR_RFWM, SIFCTR_RFWM_1));
++
+ 	/* SIIER */
+ 	if (is_play)
+ 		val = SIIER_TDREQE | SIIER_TDMAE | SISTR_ERR_TX;
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-renesas-msiof-tidyup-dmac-stop-timing.patch b/queue-6.17/asoc-renesas-msiof-tidyup-dmac-stop-timing.patch
new file mode 100644
index 0000000000..881338d573
--- /dev/null
+++ b/queue-6.17/asoc-renesas-msiof-tidyup-dmac-stop-timing.patch
@@ -0,0 +1,48 @@
+From 39fe15becb8b6f06911cbcad94e3a42c757d5f5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 05:17:27 +0000
+Subject: ASoC: renesas: msiof: tidyup DMAC stop timing
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 25aa058b5c83a3c455a2a288bb3295c0b234f093 ]
+
+Current DMAC is stopped before HW stop, but it might be cause of
+sync error. Stop HW first.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Link: https://patch.msgid.link/878qi3yuu0.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/renesas/rcar/msiof.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/renesas/rcar/msiof.c b/sound/soc/renesas/rcar/msiof.c
+index 3a1a6496637dd..555fdd4fb2513 100644
+--- a/sound/soc/renesas/rcar/msiof.c
++++ b/sound/soc/renesas/rcar/msiof.c
+@@ -222,9 +222,6 @@ static int msiof_hw_stop(struct snd_soc_component *component,
+ 		val = SIIER_RDREQE | SIIER_RDMAE | SISTR_ERR_RX;
+ 	msiof_update(priv, SIIER, val, 0);
+ 
+-	/* Stop DMAC */
+-	snd_dmaengine_pcm_trigger(substream, cmd);
+-
+ 	/* SICTR */
+ 	if (is_play)
+ 		val = SICTR_TXE;
+@@ -232,6 +229,9 @@ static int msiof_hw_stop(struct snd_soc_component *component,
+ 		val = SICTR_RXE;
+ 	msiof_update_and_wait(priv, SICTR, val, 0, 0);
+ 
++	/* Stop DMAC */
++	snd_dmaengine_pcm_trigger(substream, cmd);
++
+ 	/* indicate error status if exist */
+ 	if (priv->err_syc[substream->stream] ||
+ 	    priv->err_ovf[substream->stream] ||
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-renesas-msiof-use-reset-controller.patch b/queue-6.17/asoc-renesas-msiof-use-reset-controller.patch
new file mode 100644
index 0000000000..f2eff74479
--- /dev/null
+++ b/queue-6.17/asoc-renesas-msiof-use-reset-controller.patch
@@ -0,0 +1,131 @@
+From f91368fc79e0801aa39b0d2b3370061b84f494a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 05:17:11 +0000
+Subject: ASoC: renesas: msiof: use reset controller
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 25226abc1affd4bf4f6dd415d475b76e7a273fa8 ]
+
+MSIOF has TXRST/RXRST to reset FIFO, but it shouldn't be used during SYNC
+signal was asserted, because it will be cause of HW issue.
+
+When MSIOF is used as Sound driver, this driver is assuming it is used as
+clock consumer mode (= Codec is clock provider). This means, it can't
+control SYNC signal by itself.
+
+We need to use SW reset (= reset_control_xxx()) instead of TXRST/RXRST.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Link: https://patch.msgid.link/87cy7fyuug.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/renesas/rcar/msiof.c | 39 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/renesas/rcar/msiof.c b/sound/soc/renesas/rcar/msiof.c
+index 7a9ecc73231a8..3a1a6496637dd 100644
+--- a/sound/soc/renesas/rcar/msiof.c
++++ b/sound/soc/renesas/rcar/msiof.c
+@@ -24,12 +24,25 @@
+  * Clock/Frame Consumer Mode.
+  */
+ 
++/*
++ * [NOTE-RESET]
++ *
++ * MSIOF has TXRST/RXRST to reset FIFO, but it shouldn't be used during SYNC signal was asserted,
++ * because it will be cause of HW issue.
++ *
++ * When MSIOF is used as Sound driver, this driver is assuming it is used as clock consumer mode
++ * (= Codec is clock provider). This means, it can't control SYNC signal by itself.
++ *
++ * We need to use SW reset (= reset_control_xxx()) instead of TXRST/RXRST.
++ */
++
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_dma.h>
+ #include <linux/of_graph.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/reset.h>
+ #include <linux/spi/sh_msiof.h>
+ #include <sound/dmaengine_pcm.h>
+ #include <sound/soc.h>
+@@ -61,10 +74,13 @@
+ struct msiof_priv {
+ 	struct device *dev;
+ 	struct snd_pcm_substream *substream[SNDRV_PCM_STREAM_LAST + 1];
++	struct reset_control *reset;
+ 	spinlock_t lock;
+ 	void __iomem *base;
+ 	resource_size_t phy_addr;
+ 
++	int count;
++
+ 	/* for error */
+ 	int err_syc[SNDRV_PCM_STREAM_LAST + 1];
+ 	int err_ovf[SNDRV_PCM_STREAM_LAST + 1];
+@@ -126,6 +142,16 @@ static int msiof_hw_start(struct snd_soc_component *component,
+ 	 *	RX: Fig 109.15
+ 	 */
+ 
++	/*
++	 * Use reset_control_xx() instead of TXRST/RXRST.
++	 * see
++	 *	[NOTE-RESET]
++	 */
++	if (!priv->count)
++		reset_control_deassert(priv->reset);
++
++	priv->count++;
++
+ 	/* reset errors */
+ 	priv->err_syc[substream->stream] =
+ 	priv->err_ovf[substream->stream] =
+@@ -144,7 +170,6 @@ static int msiof_hw_start(struct snd_soc_component *component,
+ 		val = FIELD_PREP(SIMDR2_BITLEN1, width - 1);
+ 		msiof_write(priv, SITMDR2, val | FIELD_PREP(SIMDR2_GRP, 1));
+ 		msiof_write(priv, SITMDR3, val);
+-
+ 	}
+ 	/* SIRMDRx */
+ 	else {
+@@ -217,6 +242,11 @@ static int msiof_hw_stop(struct snd_soc_component *component,
+ 			 priv->err_ovf[substream->stream],
+ 			 priv->err_udf[substream->stream]);
+ 
++	priv->count--;
++
++	if (!priv->count)
++		reset_control_assert(priv->reset);
++
+ 	return 0;
+ }
+ 
+@@ -493,12 +523,19 @@ static int msiof_probe(struct platform_device *pdev)
+ 	if (IS_ERR(priv->base))
+ 		return PTR_ERR(priv->base);
+ 
++	priv->reset = devm_reset_control_get_exclusive(dev, NULL);
++	if (IS_ERR(priv->reset))
++		return PTR_ERR(priv->reset);
++
++	reset_control_assert(priv->reset);
++
+ 	ret = devm_request_irq(dev, irq, msiof_interrupt, 0, dev_name(dev), priv);
+ 	if (ret)
+ 		return ret;
+ 
+ 	priv->dev	= dev;
+ 	priv->phy_addr	= res->start;
++	priv->count	= 0;
+ 
+ 	spin_lock_init(&priv->lock);
+ 	platform_set_drvdata(pdev, priv);
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch b/queue-6.17/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
new file mode 100644
index 0000000000..f989421c0b
--- /dev/null
+++ b/queue-6.17/asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
@@ -0,0 +1,101 @@
+From f9cb30cfd336ff66308130fabb48a87efad3e72a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 13:53:03 +0300
+Subject: ASoC: SOF: ipc4-pcm: Add fixup for channels
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 6ad299a9b968e1c63988e2a327295e522cf6bbf5 ]
+
+We can have modules in path which can change the number of channels and in
+this case the BE params needs to be adjusted to configure the DAI according
+to the copier configuration.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
+Message-ID: <20250829105305.31818-2-peter.ujfalusi@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc4-pcm.c | 56 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 56 insertions(+)
+
+diff --git a/sound/soc/sof/ipc4-pcm.c b/sound/soc/sof/ipc4-pcm.c
+index 37d72a50c1272..9542c428daa4a 100644
+--- a/sound/soc/sof/ipc4-pcm.c
++++ b/sound/soc/sof/ipc4-pcm.c
+@@ -738,6 +738,58 @@ static int sof_ipc4_pcm_dai_link_fixup_rate(struct snd_sof_dev *sdev,
+ 	return 0;
+ }
+ 
++static int sof_ipc4_pcm_dai_link_fixup_channels(struct snd_sof_dev *sdev,
++						struct snd_pcm_hw_params *params,
++						struct sof_ipc4_copier *ipc4_copier)
++{
++	struct sof_ipc4_pin_format *pin_fmts = ipc4_copier->available_fmt.input_pin_fmts;
++	struct snd_interval *channels = hw_param_interval(params, SNDRV_PCM_HW_PARAM_CHANNELS);
++	int num_input_formats = ipc4_copier->available_fmt.num_input_formats;
++	unsigned int fe_channels = params_channels(params);
++	bool fe_be_match = false;
++	bool single_be_channels = true;
++	unsigned int be_channels, val;
++	int i;
++
++	if (WARN_ON_ONCE(!num_input_formats))
++		return -EINVAL;
++
++	/*
++	 * Copier does not change channels, so we
++	 * need to only consider the input pin information.
++	 */
++	be_channels = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(pin_fmts[0].audio_fmt.fmt_cfg);
++	for (i = 0; i < num_input_formats; i++) {
++		val = SOF_IPC4_AUDIO_FORMAT_CFG_CHANNELS_COUNT(pin_fmts[i].audio_fmt.fmt_cfg);
++
++		if (val != be_channels)
++			single_be_channels = false;
++
++		if (val == fe_channels) {
++			fe_be_match = true;
++			break;
++		}
++	}
++
++	/*
++	 * If channels is different than FE channels, topology must contain a
++	 * module which can change the number of channels. But we do require
++	 * topology to define a single channels in the DAI copier config in
++	 * this case (FE channels may be variable).
++	 */
++	if (!fe_be_match) {
++		if (!single_be_channels) {
++			dev_err(sdev->dev, "Unable to select channels for DAI link\n");
++			return -EINVAL;
++		}
++
++		channels->min = be_channels;
++		channels->max = be_channels;
++	}
++
++	return 0;
++}
++
+ static int sof_ipc4_pcm_dai_link_fixup(struct snd_soc_pcm_runtime *rtd,
+ 				       struct snd_pcm_hw_params *params)
+ {
+@@ -801,6 +853,10 @@ static int sof_ipc4_pcm_dai_link_fixup(struct snd_soc_pcm_runtime *rtd,
+ 	if (ret)
+ 		return ret;
+ 
++	ret = sof_ipc4_pcm_dai_link_fixup_channels(sdev, params, ipc4_copier);
++	if (ret)
++		return ret;
++
+ 	if (single_bitdepth) {
+ 		snd_mask_none(fmt);
+ 		valid_bits = SOF_IPC4_AUDIO_FORMAT_CFG_V_BIT_DEPTH(ipc4_fmt->fmt_cfg);
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch b/queue-6.17/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
new file mode 100644
index 0000000000..9bdd8b5586
--- /dev/null
+++ b/queue-6.17/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
@@ -0,0 +1,49 @@
+From 54b46117021f0316329e99db6d85d068d750ae22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:31:18 +0200
+Subject: ASoC: stm32: sai: manage context in set_sysclk callback
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 ]
+
+The mclk direction now needs to be specified in endpoint node with
+"system-clock-direction-out" property. However some calls to the
+set_sysclk callback, related to CPU DAI clock, result in unbalanced
+calls to clock API.
+The set_sysclk callback in STM32 SAI driver is intended only for mclk
+management. So it is relevant to ensure that calls to set_sysclk are
+related to mclk only.
+Since the master clock is handled only at runtime, skip the calls to
+set_sysclk in the initialization phase.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Link: https://patch.msgid.link/20250916123118.84175-1-olivier.moysan@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 463a2b7d023b9..0ae1eae2a59e2 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -672,6 +672,14 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
+ 	struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+ 	int ret;
+ 
++	/*
++	 * The mclk rate is determined at runtime from the audio stream rate.
++	 * Skip calls to the set_sysclk callback that are not relevant during the
++	 * initialization phase.
++	 */
++	if (!snd_soc_card_is_instantiated(cpu_dai->component->card))
++		return 0;
++
+ 	if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) {
+ 		ret = stm32_sai_sub_reg_up(sai, STM_SAI_CR1_REGX,
+ 					   SAI_XCR1_NODIV,
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-tas2781-add-keyword-init-in-profile-section.patch b/queue-6.17/asoc-tas2781-add-keyword-init-in-profile-section.patch
new file mode 100644
index 0000000000..1006d85d29
--- /dev/null
+++ b/queue-6.17/asoc-tas2781-add-keyword-init-in-profile-section.patch
@@ -0,0 +1,92 @@
+From b5848afb71092f4321dcc74e06d7ee3739328453 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Aug 2025 21:11:10 +0800
+Subject: ASoC: tas2781: Add keyword "init" in profile section
+
+From: Shenghao Ding <shenghao-ding@ti.com>
+
+[ Upstream commit e83dcd139e776ebb86d5e88e13282580407278e4 ]
+
+Since version 0x105, the keyword 'init' was introduced into the profile,
+which is used for chip initialization, particularly to store common
+settings for other non-initialization profiles.
+
+Signed-off-by: Shenghao Ding <shenghao-ding@ti.com>
+Link: https://patch.msgid.link/20250803131110.1443-1-shenghao-ding@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/tas2781-dsp.h       |  8 ++++++++
+ sound/soc/codecs/tas2781-fmwlib.c | 12 ++++++++++++
+ sound/soc/codecs/tas2781-i2c.c    |  6 ++++++
+ 3 files changed, 26 insertions(+)
+
+diff --git a/include/sound/tas2781-dsp.h b/include/sound/tas2781-dsp.h
+index c3a9efa73d5d0..a21f34c0266ea 100644
+--- a/include/sound/tas2781-dsp.h
++++ b/include/sound/tas2781-dsp.h
+@@ -198,6 +198,14 @@ struct tasdevice_rca {
+ 	int ncfgs;
+ 	struct tasdevice_config_info **cfg_info;
+ 	int profile_cfg_id;
++	/*
++	 * Since version 0x105, the keyword 'init' was introduced into the
++	 * profile, which is used for chip initialization, particularly to
++	 * store common settings for other non-initialization profiles.
++	 * if (init_profile_id < 0)
++	 *         No init profile inside the RCA firmware.
++	 */
++	int init_profile_id;
+ };
+ 
+ void tasdevice_select_cfg_blk(void *context, int conf_no,
+diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c
+index c9c1e608ddb75..8baf56237624a 100644
+--- a/sound/soc/codecs/tas2781-fmwlib.c
++++ b/sound/soc/codecs/tas2781-fmwlib.c
+@@ -180,6 +180,16 @@ static struct tasdevice_config_info *tasdevice_add_config(
+ 			dev_err(tas_priv->dev, "add conf: Out of boundary\n");
+ 			goto out;
+ 		}
++		/* If in the RCA bin file are several profiles with the
++		 * keyword "init", init_profile_id only store the last
++		 * init profile id.
++		 */
++		if (strnstr(&config_data[config_offset], "init", 64)) {
++			tas_priv->rcabin.init_profile_id =
++				tas_priv->rcabin.ncfgs - 1;
++			dev_dbg(tas_priv->dev, "%s: init profile id = %d\n",
++				__func__, tas_priv->rcabin.init_profile_id);
++		}
+ 		config_offset += 64;
+ 	}
+ 
+@@ -283,6 +293,8 @@ int tasdevice_rca_parser(void *context, const struct firmware *fmw)
+ 	int i;
+ 
+ 	rca = &(tas_priv->rcabin);
++	/* Initialize to none */
++	rca->init_profile_id = -1;
+ 	fw_hdr = &(rca->fw_hdr);
+ 	if (!fmw || !fmw->data) {
+ 		dev_err(tas_priv->dev, "Failed to read %s\n",
+diff --git a/sound/soc/codecs/tas2781-i2c.c b/sound/soc/codecs/tas2781-i2c.c
+index 0e09d794516fc..ea3cdb8553de1 100644
+--- a/sound/soc/codecs/tas2781-i2c.c
++++ b/sound/soc/codecs/tas2781-i2c.c
+@@ -1641,6 +1641,12 @@ static void tasdevice_fw_ready(const struct firmware *fmw,
+ 	tasdevice_prmg_load(tas_priv, 0);
+ 	tas_priv->cur_prog = 0;
+ 
++	/* Init common setting for different audio profiles */
++	if (tas_priv->rcabin.init_profile_id >= 0)
++		tasdevice_select_cfg_blk(tas_priv,
++			tas_priv->rcabin.init_profile_id,
++			TASDEVICE_BIN_BLK_PRE_POWER_UP);
++
+ #ifdef CONFIG_SND_SOC_TAS2781_ACOUST_I2C
+ 	if (tas_priv->name_prefix)
+ 		acoustic_debugfs_node = devm_kasprintf(tas_priv->dev,
+-- 
+2.51.0
+
diff --git a/queue-6.17/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch b/queue-6.17/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
new file mode 100644
index 0000000000..7972ab88f0
--- /dev/null
+++ b/queue-6.17/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
@@ -0,0 +1,99 @@
+From 54123fe434391c435635a05d062e619d82fda1eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:59:29 +0200
+Subject: ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
+
+From: Primoz Fiser <primoz.fiser@norik.com>
+
+[ Upstream commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e ]
+
+The problem of having class-D initialization sequence in probe using
+regmap_register_patch() is that it will do hardware register writes
+immediately after being called as it bypasses regcache. Afterwards, in
+aic3x_init() we also perform codec soft reset, rendering class-D init
+sequence pointless. This issue is even more apparent when using reset
+GPIO line, since in that case class-D amplifier initialization fails
+with "Failed to init class D: -5" message as codec is already held in
+reset state after requesting the reset GPIO and hence hardware I/O
+fails with -EIO errno.
+
+Thus move class-D amplifier initialization sequence from probe function
+to aic3x_set_power() just before the usual regcache sync. Use bypassed
+regmap_multi_reg_write_bypassed() function to make sure, class-D init
+sequence is performed in proper order as described in the datasheet.
+
+Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250925085929.2581749-1-primoz.fiser@norik.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic3x.c | 32 ++++++++++++++------------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index f1649df197389..eea8ca285f8e0 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -121,6 +121,16 @@ static const struct reg_default aic3x_reg[] = {
+ 	{ 108, 0x00 }, { 109, 0x00 },
+ };
+ 
++static const struct reg_sequence aic3007_class_d[] = {
++	/* Class-D speaker driver init; datasheet p. 46 */
++	{ AIC3X_PAGE_SELECT, 0x0D },
++	{ 0xD, 0x0D },
++	{ 0x8, 0x5C },
++	{ 0x8, 0x5D },
++	{ 0x8, 0x5C },
++	{ AIC3X_PAGE_SELECT, 0x00 },
++};
++
+ static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
+ {
+ 	switch (reg) {
+@@ -1393,6 +1403,10 @@ static int aic3x_set_power(struct snd_soc_component *component, int power)
+ 			gpiod_set_value(aic3x->gpio_reset, 0);
+ 		}
+ 
++		if (aic3x->model == AIC3X_MODEL_3007)
++			regmap_multi_reg_write_bypassed(aic3x->regmap, aic3007_class_d,
++							ARRAY_SIZE(aic3007_class_d));
++
+ 		/* Sync reg_cache with the hardware */
+ 		regcache_cache_only(aic3x->regmap, false);
+ 		regcache_sync(aic3x->regmap);
+@@ -1723,17 +1737,6 @@ static void aic3x_configure_ocmv(struct device *dev, struct aic3x_priv *aic3x)
+ 	}
+ }
+ 
+-
+-static const struct reg_sequence aic3007_class_d[] = {
+-	/* Class-D speaker driver init; datasheet p. 46 */
+-	{ AIC3X_PAGE_SELECT, 0x0D },
+-	{ 0xD, 0x0D },
+-	{ 0x8, 0x5C },
+-	{ 0x8, 0x5D },
+-	{ 0x8, 0x5C },
+-	{ AIC3X_PAGE_SELECT, 0x00 },
+-};
+-
+ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver_data)
+ {
+ 	struct aic3x_priv *aic3x;
+@@ -1823,13 +1826,6 @@ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver
+ 
+ 	aic3x_configure_ocmv(dev, aic3x);
+ 
+-	if (aic3x->model == AIC3X_MODEL_3007) {
+-		ret = regmap_register_patch(aic3x->regmap, aic3007_class_d,
+-					    ARRAY_SIZE(aic3007_class_d));
+-		if (ret != 0)
+-			dev_err(dev, "Failed to init class D: %d\n", ret);
+-	}
+-
+ 	ret = devm_snd_soc_register_component(dev, &soc_component_dev_aic3x, &aic3x_dai, 1);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-6.17/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..2e0cfea7fd
--- /dev/null
+++ b/queue-6.17/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From f6af69562ea610a0ab3d06a19dcc0eb206905d6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 664d82d1e6139..591abe6d63ddb 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-btintel-add-support-for-blazariw-core.patch b/queue-6.17/bluetooth-btintel-add-support-for-blazariw-core.patch
new file mode 100644
index 0000000000..ed7df0766a
--- /dev/null
+++ b/queue-6.17/bluetooth-btintel-add-support-for-blazariw-core.patch
@@ -0,0 +1,76 @@
+From b49bbbbe131a18f0ecd7711fe22e7d376625ee47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 17:58:24 +0530
+Subject: Bluetooth: btintel: Add support for BlazarIW core
+
+From: Kiran K <kiran.k@intel.com>
+
+[ Upstream commit 926e8bfaaa11471b3df25befc284da62b11a1e92 ]
+
+Add support for the BlazarIW Bluetooth core used in the Wildcat Lake
+platform.
+
+HCI traces:
+< HCI Command: Intel Read Version (0x3f|0x0005) plen 1
+    Requested Type:
+      All Supported Types(0xff)
+> HCI Event: Command Complete (0x0e) plen 122
+  Intel Read Version (0x3f|0x0005) ncmd 1
+    Status: Success (0x00)
+    .....
+    CNVi BT(18): 0x00223700 - BlazarIW(0x22)
+    .....
+    .....
+
+Signed-off-by: Vijay Satija <vijay.satija@intel.com>
+Signed-off-by: Kiran K <kiran.k@intel.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btintel.c      | 3 +++
+ drivers/bluetooth/btintel_pcie.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
+index be69d21c9aa74..9d29ab811f802 100644
+--- a/drivers/bluetooth/btintel.c
++++ b/drivers/bluetooth/btintel.c
+@@ -484,6 +484,7 @@ int btintel_version_info_tlv(struct hci_dev *hdev,
+ 	case 0x1d:	/* BlazarU (BzrU) */
+ 	case 0x1e:	/* BlazarI (Bzr) */
+ 	case 0x1f:      /* Scorpious Peak */
++	case 0x22:	/* BlazarIW (BzrIW) */
+ 		break;
+ 	default:
+ 		bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
+@@ -3253,6 +3254,7 @@ void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
+ 	case 0x1d:
+ 	case 0x1e:
+ 	case 0x1f:
++	case 0x22:
+ 		hci_set_msft_opcode(hdev, 0xFC1E);
+ 		break;
+ 	default:
+@@ -3593,6 +3595,7 @@ static int btintel_setup_combined(struct hci_dev *hdev)
+ 	case 0x1d:
+ 	case 0x1e:
+ 	case 0x1f:
++	case 0x22:
+ 		/* Display version information of TLV type */
+ 		btintel_version_info_tlv(hdev, &ver_tlv);
+ 
+diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
+index 562acaf023f55..c9fb824fb8e1d 100644
+--- a/drivers/bluetooth/btintel_pcie.c
++++ b/drivers/bluetooth/btintel_pcie.c
+@@ -2088,6 +2088,7 @@ static int btintel_pcie_setup_internal(struct hci_dev *hdev)
+ 	switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
+ 	case 0x1e:	/* BzrI */
+ 	case 0x1f:	/* ScP  */
++	case 0x22:	/* BzrIW */
+ 		/* Display version information of TLV type */
+ 		btintel_version_info_tlv(hdev, &ver_tlv);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-btintel_pcie-define-hdev-wakeup-callback.patch b/queue-6.17/bluetooth-btintel_pcie-define-hdev-wakeup-callback.patch
new file mode 100644
index 0000000000..1af1fcd825
--- /dev/null
+++ b/queue-6.17/bluetooth-btintel_pcie-define-hdev-wakeup-callback.patch
@@ -0,0 +1,54 @@
+From 609e9c696274ca85f863cda47f4030fe089e8619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 16:47:11 +0530
+Subject: Bluetooth: btintel_pcie: Define hdev->wakeup() callback
+
+From: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
+
+[ Upstream commit 3e94262921990e2884ff7a49064c12fb6d3a0733 ]
+
+Implement hdev->wakeup() callback to support Wake On BT feature.
+
+Test steps:
+1. echo enabled > /sys/bus/pci/devices/0000:00:14.7/power/wakeup
+2. connect bluetooth hid device
+3. put the system to suspend - rtcwake -m mem -s 300
+4. press any key on hid to wake up the system
+
+Signed-off-by: Kiran K <kiran.k@intel.com>
+Signed-off-by: Chandrashekar Devegowda <chandrashekar.devegowda@intel.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btintel_pcie.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
+index c9fb824fb8e1d..becb471ffd421 100644
+--- a/drivers/bluetooth/btintel_pcie.c
++++ b/drivers/bluetooth/btintel_pcie.c
+@@ -2342,6 +2342,13 @@ static void btintel_pcie_hw_error(struct hci_dev *hdev, u8 code)
+ 	btintel_pcie_reset(hdev);
+ }
+ 
++static bool btintel_pcie_wakeup(struct hci_dev *hdev)
++{
++	struct btintel_pcie_data *data = hci_get_drvdata(hdev);
++
++	return device_may_wakeup(&data->pdev->dev);
++}
++
+ static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data)
+ {
+ 	int err;
+@@ -2367,6 +2374,7 @@ static int btintel_pcie_setup_hdev(struct btintel_pcie_data *data)
+ 	hdev->set_diag = btintel_set_diag;
+ 	hdev->set_bdaddr = btintel_set_bdaddr;
+ 	hdev->reset = btintel_pcie_reset;
++	hdev->wakeup = btintel_pcie_wakeup;
+ 
+ 	err = hci_register_dev(hdev);
+ 	if (err < 0) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3627-for-mt7925.patch b/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3627-for-mt7925.patch
new file mode 100644
index 0000000000..59998249c8
--- /dev/null
+++ b/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3627-for-mt7925.patch
@@ -0,0 +1,77 @@
+From 5fe0ad0c29451a6af4ec7fc7212a218e2639f46c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 15:58:00 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 13d3/3627 for MT7925
+
+From: Chris Lu <chris.lu@mediatek.com>
+
+[ Upstream commit 576952cf981b7d2b7d3227b246b4326e5548a133 ]
+
+Add VID 13d3 & PID 3627 for MediaTek MT7922 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T:  Bus=07 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=13d3 ProdID=3627 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Chris Lu <chris.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 3595a8bad6bdf..30679a572095c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -734,6 +734,8 @@ static const struct usb_device_id quirks_table[] = {
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3613), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
++	{ USB_DEVICE(0x13d3, 0x3627), .driver_info = BTUSB_MEDIATEK |
++						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3630), .driver_info = BTUSB_MEDIATEK |
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch b/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
new file mode 100644
index 0000000000..64fd1ff512
--- /dev/null
+++ b/queue-6.17/bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
@@ -0,0 +1,77 @@
+From d240bfe15891db3947f2175b2af69a085f999ad4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 19:46:11 +0800
+Subject: Bluetooth: btusb: Add new VID/PID 13d3/3633 for MT7922
+
+From: Chris Lu <chris.lu@mediatek.com>
+
+[ Upstream commit 70cd38d22d4659ca8133c7124528c90678215dda ]
+
+Add VID 13d3 & PID 3633 for MediaTek MT7922 USB Bluetooth chip.
+
+The information in /sys/kernel/debug/usb/devices about the Bluetooth
+device is listed as the below.
+
+T:  Bus=06 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=13d3 ProdID=3633 Rev= 1.00
+S:  Manufacturer=MediaTek Inc.
+S:  Product=Wireless_Device
+S:  SerialNumber=000000000
+C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA
+A:  FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=125us
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+I:  If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  63 Ivl=1ms
+I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS=  64 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS=  64 Ivl=125us
+I:  If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none)
+E:  Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us
+E:  Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
+
+Signed-off-by: Chris Lu <chris.lu@mediatek.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index b231caa84757c..5e9ebf0c53125 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -701,6 +701,8 @@ static const struct usb_device_id quirks_table[] = {
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x13d3, 0x3615), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
++	{ USB_DEVICE(0x13d3, 0x3633), .driver_info = BTUSB_MEDIATEK |
++						     BTUSB_WIDEBAND_SPEECH },
+ 	{ USB_DEVICE(0x35f5, 0x7922), .driver_info = BTUSB_MEDIATEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch b/queue-6.17/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
new file mode 100644
index 0000000000..3b26e25fe1
--- /dev/null
+++ b/queue-6.17/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
@@ -0,0 +1,122 @@
+From ed43e94a0104794345c3081982065dfda3348166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 18:40:16 +0200
+Subject: Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI
+ frames
+
+From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+
+[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
+
+Some Barrot based USB Bluetooth dongles erroneously send one extra
+random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The
+consequence of that is that the next HCI transfer is misaligned by one
+byte causing undefined behavior. In most cases the response event for
+the next command fails with random error code.
+
+Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI
+controller initialization, the initialization fails rendering the USB
+dongle not usable.
+
+> [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd
+> [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter
+> [61.720116] Bluetooth: hci1: command 0x1005 tx timeout
+> [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
+
+This patch was tested with the 33fa:0012 device. The info from the
+/sys/kernel/debug/usb/devices is shown below:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=33fa ProdID=0012 Rev=88.91
+S:  Product=UGREEN BT6.0 Adapter
+C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Now the device is initialized properly:
+
+> [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg
+> [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter
+> [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.750141] Bluetooth: MGMT ver 1.23
+
+Link: https://github.com/bluez/bluez/issues/1326
+Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Tested-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 30679a572095c..b231caa84757c 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -66,6 +66,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
+ #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
++#define BTUSB_BARROT			BIT(28)
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -814,6 +815,10 @@ static const struct usb_device_id quirks_table[] = {
+ 	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
++	/* Barrot Technology Bluetooth devices */
++	{ USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT },
++	{ USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT },
++
+ 	/* Actions Semiconductor ATS2851 based devices */
+ 	{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
+ 
+@@ -1196,6 +1201,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
+ 		}
+ 
+ 		if (!hci_skb_expect(skb)) {
++			/* Each chunk should correspond to at least 1 or more
++			 * events so if there are still bytes left that doesn't
++			 * constitute a new event this is likely a bug in the
++			 * controller.
++			 */
++			if (count && count < HCI_EVENT_HDR_SIZE) {
++				bt_dev_warn(data->hdev,
++					"Unexpected continuation: %d bytes",
++					count);
++				count = 0;
++			}
++
+ 			/* Complete frame */
+ 			btusb_recv_event(data, skb);
+ 			skb = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-iso-don-t-initiate-cis-connections-if-ther.patch b/queue-6.17/bluetooth-iso-don-t-initiate-cis-connections-if-ther.patch
new file mode 100644
index 0000000000..44e1955c9c
--- /dev/null
+++ b/queue-6.17/bluetooth-iso-don-t-initiate-cis-connections-if-ther.patch
@@ -0,0 +1,40 @@
+From 114a9d02706213e6340754881539f72fc4f449c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 11:18:29 -0400
+Subject: Bluetooth: ISO: Don't initiate CIS connections if there are no
+ buffers
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit d79c7d01f1c8bcf9a48337c8960d618fbe31fc0c ]
+
+If the controller has no buffers left return -ENOBUFF to indicate that
+iso_cnt might be out of sync.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/iso.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 6e2923b301505..3b2a4a9d79d61 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -460,6 +460,13 @@ static int iso_connect_cis(struct sock *sk)
+ 		goto unlock;
+ 	}
+ 
++	/* Check if there are available buffers for output/TX. */
++	if (iso_pi(sk)->qos.ucast.out.sdu && !hci_iso_count(hdev) &&
++	    (hdev->iso_pkts && !hdev->iso_cnt)) {
++		err = -ENOBUFS;
++		goto unlock;
++	}
++
+ 	/* Just bind if DEFER_SETUP has been set */
+ 	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+ 		hcon = hci_bind_cis(hdev, &iso_pi(sk)->dst,
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-iso-use-sk_sndtimeo-as-conn_timeout.patch b/queue-6.17/bluetooth-iso-use-sk_sndtimeo-as-conn_timeout.patch
new file mode 100644
index 0000000000..12264cc7bb
--- /dev/null
+++ b/queue-6.17/bluetooth-iso-use-sk_sndtimeo-as-conn_timeout.patch
@@ -0,0 +1,199 @@
+From e1ae3ff5cd4504d31faa8fc2441987f1f1c66075 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 15:21:19 -0400
+Subject: Bluetooth: ISO: Use sk_sndtimeo as conn_timeout
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 339a87883a14d6a818ca436fed41aa5d10e0f4bd ]
+
+This aligns the usage of socket sk_sndtimeo as conn_timeout when
+initiating a connection and then use it when scheduling the
+resulting HCI command, similar to what has been done in bf98feea5b65
+("Bluetooth: hci_conn: Always use sk_timeo as conn_timeout").
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h | 10 ++++++----
+ net/bluetooth/hci_conn.c         | 20 ++++++++++++--------
+ net/bluetooth/iso.c              | 16 ++++++++++------
+ 3 files changed, 28 insertions(+), 18 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 8a4b2ac15f470..8d78cb2b9f1ab 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1588,16 +1588,18 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst,
+ 				 __u16 setting, struct bt_codec *codec,
+ 				 u16 timeout);
+ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
+-			      __u8 dst_type, struct bt_iso_qos *qos);
++			      __u8 dst_type, struct bt_iso_qos *qos,
++			      u16 timeout);
+ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
+ 			      struct bt_iso_qos *qos,
+-			      __u8 base_len, __u8 *base);
++			      __u8 base_len, __u8 *base, u16 timeout);
+ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
+-				 __u8 dst_type, struct bt_iso_qos *qos);
++				 __u8 dst_type, struct bt_iso_qos *qos,
++				 u16 timeout);
+ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ 				 __u8 dst_type, __u8 sid,
+ 				 struct bt_iso_qos *qos,
+-				 __u8 data_len, __u8 *data);
++				 __u8 data_len, __u8 *data, u16 timeout);
+ struct hci_conn *hci_pa_create_sync(struct hci_dev *hdev, bdaddr_t *dst,
+ 		       __u8 dst_type, __u8 sid, struct bt_iso_qos *qos);
+ int hci_conn_big_create_sync(struct hci_dev *hdev, struct hci_conn *hcon,
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 63ae62fe20bbc..c021c6cb3d9a5 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1547,7 +1547,7 @@ static int qos_set_bis(struct hci_dev *hdev, struct bt_iso_qos *qos)
+ /* This function requires the caller holds hdev->lock */
+ static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ 				    __u8 sid, struct bt_iso_qos *qos,
+-				    __u8 base_len, __u8 *base)
++				    __u8 base_len, __u8 *base, u16 timeout)
+ {
+ 	struct hci_conn *conn;
+ 	int err;
+@@ -1589,6 +1589,7 @@ static struct hci_conn *hci_add_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ 
+ 	conn->state = BT_CONNECT;
+ 	conn->sid = sid;
++	conn->conn_timeout = timeout;
+ 
+ 	hci_conn_hold(conn);
+ 	return conn;
+@@ -1929,7 +1930,8 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)
+ }
+ 
+ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
+-			      __u8 dst_type, struct bt_iso_qos *qos)
++			      __u8 dst_type, struct bt_iso_qos *qos,
++			      u16 timeout)
+ {
+ 	struct hci_conn *cis;
+ 
+@@ -1944,6 +1946,7 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
+ 		cis->dst_type = dst_type;
+ 		cis->iso_qos.ucast.cig = BT_ISO_QOS_CIG_UNSET;
+ 		cis->iso_qos.ucast.cis = BT_ISO_QOS_CIS_UNSET;
++		cis->conn_timeout = timeout;
+ 	}
+ 
+ 	if (cis->state == BT_CONNECTED)
+@@ -2183,7 +2186,7 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)
+ 
+ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
+ 			      struct bt_iso_qos *qos,
+-			      __u8 base_len, __u8 *base)
++			      __u8 base_len, __u8 *base, u16 timeout)
+ {
+ 	struct hci_conn *conn;
+ 	struct hci_conn *parent;
+@@ -2204,7 +2207,7 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
+ 						   base, base_len);
+ 
+ 	/* We need hci_conn object using the BDADDR_ANY as dst */
+-	conn = hci_add_bis(hdev, dst, sid, qos, base_len, eir);
++	conn = hci_add_bis(hdev, dst, sid, qos, base_len, eir, timeout);
+ 	if (IS_ERR(conn))
+ 		return conn;
+ 
+@@ -2257,13 +2260,13 @@ static void bis_mark_per_adv(struct hci_conn *conn, void *data)
+ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ 				 __u8 dst_type, __u8 sid,
+ 				 struct bt_iso_qos *qos,
+-				 __u8 base_len, __u8 *base)
++				 __u8 base_len, __u8 *base, u16 timeout)
+ {
+ 	struct hci_conn *conn;
+ 	int err;
+ 	struct iso_list_data data;
+ 
+-	conn = hci_bind_bis(hdev, dst, sid, qos, base_len, base);
++	conn = hci_bind_bis(hdev, dst, sid, qos, base_len, base, timeout);
+ 	if (IS_ERR(conn))
+ 		return conn;
+ 
+@@ -2306,7 +2309,8 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
+ }
+ 
+ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
+-				 __u8 dst_type, struct bt_iso_qos *qos)
++				 __u8 dst_type, struct bt_iso_qos *qos,
++				 u16 timeout)
+ {
+ 	struct hci_conn *le;
+ 	struct hci_conn *cis;
+@@ -2330,7 +2334,7 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
+ 	hci_iso_qos_setup(hdev, le, &qos->ucast.in,
+ 			  le->le_rx_phy ? le->le_rx_phy : hdev->le_rx_def_phys);
+ 
+-	cis = hci_bind_cis(hdev, dst, dst_type, qos);
++	cis = hci_bind_cis(hdev, dst, dst_type, qos, timeout);
+ 	if (IS_ERR(cis)) {
+ 		hci_conn_drop(le);
+ 		return cis;
+diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
+index 3b2a4a9d79d61..3d98cb6291da6 100644
+--- a/net/bluetooth/iso.c
++++ b/net/bluetooth/iso.c
+@@ -91,8 +91,8 @@ static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,
+ 				 iso_sock_match_t match, void *data);
+ 
+ /* ---- ISO timers ---- */
+-#define ISO_CONN_TIMEOUT	(HZ * 40)
+-#define ISO_DISCONN_TIMEOUT	(HZ * 2)
++#define ISO_CONN_TIMEOUT	secs_to_jiffies(20)
++#define ISO_DISCONN_TIMEOUT	secs_to_jiffies(2)
+ 
+ static void iso_conn_free(struct kref *ref)
+ {
+@@ -369,7 +369,8 @@ static int iso_connect_bis(struct sock *sk)
+ 	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+ 		hcon = hci_bind_bis(hdev, &iso_pi(sk)->dst, iso_pi(sk)->bc_sid,
+ 				    &iso_pi(sk)->qos, iso_pi(sk)->base_len,
+-				    iso_pi(sk)->base);
++				    iso_pi(sk)->base,
++				    READ_ONCE(sk->sk_sndtimeo));
+ 		if (IS_ERR(hcon)) {
+ 			err = PTR_ERR(hcon);
+ 			goto unlock;
+@@ -378,7 +379,8 @@ static int iso_connect_bis(struct sock *sk)
+ 		hcon = hci_connect_bis(hdev, &iso_pi(sk)->dst,
+ 				       le_addr_type(iso_pi(sk)->dst_type),
+ 				       iso_pi(sk)->bc_sid, &iso_pi(sk)->qos,
+-				       iso_pi(sk)->base_len, iso_pi(sk)->base);
++				       iso_pi(sk)->base_len, iso_pi(sk)->base,
++				       READ_ONCE(sk->sk_sndtimeo));
+ 		if (IS_ERR(hcon)) {
+ 			err = PTR_ERR(hcon);
+ 			goto unlock;
+@@ -471,7 +473,8 @@ static int iso_connect_cis(struct sock *sk)
+ 	if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
+ 		hcon = hci_bind_cis(hdev, &iso_pi(sk)->dst,
+ 				    le_addr_type(iso_pi(sk)->dst_type),
+-				    &iso_pi(sk)->qos);
++				    &iso_pi(sk)->qos,
++				    READ_ONCE(sk->sk_sndtimeo));
+ 		if (IS_ERR(hcon)) {
+ 			err = PTR_ERR(hcon);
+ 			goto unlock;
+@@ -479,7 +482,8 @@ static int iso_connect_cis(struct sock *sk)
+ 	} else {
+ 		hcon = hci_connect_cis(hdev, &iso_pi(sk)->dst,
+ 				       le_addr_type(iso_pi(sk)->dst_type),
+-				       &iso_pi(sk)->qos);
++				       &iso_pi(sk)->qos,
++				       READ_ONCE(sk->sk_sndtimeo));
+ 		if (IS_ERR(hcon)) {
+ 			err = PTR_ERR(hcon);
+ 			goto unlock;
+-- 
+2.51.0
+
diff --git a/queue-6.17/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-6.17/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..1a32517808
--- /dev/null
+++ b/queue-6.17/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From 672d376199ba249ba67e88ad5e152fec03053f01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index d382d980fd9a7..ab0cf442d57b9 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -498,6 +498,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-6.17/bng_en-make-bnge_alloc_ring-self-unwind-on-failure.patch b/queue-6.17/bng_en-make-bnge_alloc_ring-self-unwind-on-failure.patch
new file mode 100644
index 0000000000..ef6b2f936c
--- /dev/null
+++ b/queue-6.17/bng_en-make-bnge_alloc_ring-self-unwind-on-failure.patch
@@ -0,0 +1,55 @@
+From 35ea1aa473ca2e4099f2286d466a3a2616d24dfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 23:17:32 +0530
+Subject: bng_en: make bnge_alloc_ring() self-unwind on failure
+
+From: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
+
+[ Upstream commit 9ee5994418bb527788e77361d338af40a126aa21 ]
+
+Ensure bnge_alloc_ring() frees any intermediate allocations
+when it fails. This enables later patches to rely on this
+self-unwinding behavior.
+
+Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
+Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
+Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
+Link: https://patch.msgid.link/20250919174742.24969-2-bhargava.marreddy@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnge/bnge_rmem.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.c b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.c
+index 52ada65943a02..98b4e9f55bcbb 100644
+--- a/drivers/net/ethernet/broadcom/bnge/bnge_rmem.c
++++ b/drivers/net/ethernet/broadcom/bnge/bnge_rmem.c
+@@ -95,7 +95,7 @@ int bnge_alloc_ring(struct bnge_dev *bd, struct bnge_ring_mem_info *rmem)
+ 						     &rmem->dma_arr[i],
+ 						     GFP_KERNEL);
+ 		if (!rmem->pg_arr[i])
+-			return -ENOMEM;
++			goto err_free_ring;
+ 
+ 		if (rmem->ctx_mem)
+ 			bnge_init_ctx_mem(rmem->ctx_mem, rmem->pg_arr[i],
+@@ -116,10 +116,13 @@ int bnge_alloc_ring(struct bnge_dev *bd, struct bnge_ring_mem_info *rmem)
+ 	if (rmem->vmem_size) {
+ 		*rmem->vmem = vzalloc(rmem->vmem_size);
+ 		if (!(*rmem->vmem))
+-			return -ENOMEM;
++			goto err_free_ring;
+ 	}
+-
+ 	return 0;
++
++err_free_ring:
++	bnge_free_ring(bd, rmem);
++	return -ENOMEM;
+ }
+ 
+ static int bnge_alloc_ctx_one_lvl(struct bnge_dev *bd,
+-- 
+2.51.0
+
diff --git a/queue-6.17/bnxt_en-add-fw-log-trace-support-for-5731x-5741x-chi.patch b/queue-6.17/bnxt_en-add-fw-log-trace-support-for-5731x-5741x-chi.patch
new file mode 100644
index 0000000000..7235c26779
--- /dev/null
+++ b/queue-6.17/bnxt_en-add-fw-log-trace-support-for-5731x-5741x-chi.patch
@@ -0,0 +1,128 @@
+From 056208234f6c94d3d751aeea10c7ddc5120c44fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:08:34 -0700
+Subject: bnxt_en: Add fw log trace support for 5731X/5741X chips
+
+From: Shruti Parab <shruti.parab@broadcom.com>
+
+[ Upstream commit ba1aefee2e9835fe6e07b86cb7020bd2550a81ee ]
+
+These older chips now support the fw log traces via backing store
+qcaps_v2. No other backing store memory types are supported besides
+the fw trace types.
+
+Reviewed-by: Hongguang Gao <hongguang.gao@broadcom.com>
+Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
+Signed-off-by: Shruti Parab <shruti.parab@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250917040839.1924698-6-michael.chan@broadcom.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c          | 9 +++++++--
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h          | 3 ++-
+ drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c | 3 ++-
+ drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h | 1 +
+ 4 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 0f3cc21ab0320..60e20b7642174 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -265,6 +265,7 @@ const u16 bnxt_bstore_to_trace[] = {
+ 	[BNXT_CTX_CA1]		= DBG_LOG_BUFFER_FLUSH_REQ_TYPE_CA1_TRACE,
+ 	[BNXT_CTX_CA2]		= DBG_LOG_BUFFER_FLUSH_REQ_TYPE_CA2_TRACE,
+ 	[BNXT_CTX_RIGP1]	= DBG_LOG_BUFFER_FLUSH_REQ_TYPE_RIGP1_TRACE,
++	[BNXT_CTX_KONG]		= DBG_LOG_BUFFER_FLUSH_REQ_TYPE_AFM_KONG_HWRM_TRACE,
+ };
+ 
+ static struct workqueue_struct *bnxt_pf_wq;
+@@ -9155,7 +9156,7 @@ static int bnxt_backing_store_cfg_v2(struct bnxt *bp, u32 ena)
+ 	int rc = 0;
+ 	u16 type;
+ 
+-	for (type = BNXT_CTX_SRT; type <= BNXT_CTX_RIGP1; type++) {
++	for (type = BNXT_CTX_SRT; type <= BNXT_CTX_KONG; type++) {
+ 		ctxm = &ctx->ctx_arr[type];
+ 		if (!bnxt_bs_trace_avail(bp, type))
+ 			continue;
+@@ -9305,6 +9306,10 @@ static int bnxt_alloc_ctx_mem(struct bnxt *bp)
+ 	if (!ctx || (ctx->flags & BNXT_CTX_FLAG_INITED))
+ 		return 0;
+ 
++	ena = 0;
++	if (!(bp->flags & BNXT_FLAG_CHIP_P5_PLUS))
++		goto skip_legacy;
++
+ 	ctxm = &ctx->ctx_arr[BNXT_CTX_QP];
+ 	l2_qps = ctxm->qp_l2_entries;
+ 	qp1_qps = ctxm->qp_qp1_entries;
+@@ -9313,7 +9318,6 @@ static int bnxt_alloc_ctx_mem(struct bnxt *bp)
+ 	ctxm = &ctx->ctx_arr[BNXT_CTX_SRQ];
+ 	srqs = ctxm->srq_l2_entries;
+ 	max_srqs = ctxm->max_entries;
+-	ena = 0;
+ 	if ((bp->flags & BNXT_FLAG_ROCE_CAP) && !is_kdump_kernel()) {
+ 		pg_lvl = 2;
+ 		if (BNXT_SW_RES_LMT(bp)) {
+@@ -9407,6 +9411,7 @@ static int bnxt_alloc_ctx_mem(struct bnxt *bp)
+ 		ena |= FUNC_BACKING_STORE_CFG_REQ_ENABLES_TQM_SP << i;
+ 	ena |= FUNC_BACKING_STORE_CFG_REQ_DFLT_ENABLES;
+ 
++skip_legacy:
+ 	if (bp->fw_cap & BNXT_FW_CAP_BACKING_STORE_V2)
+ 		rc = bnxt_backing_store_cfg_v2(bp, ena);
+ 	else
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index 119d4ef6ef660..2317172166c7d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1968,10 +1968,11 @@ struct bnxt_ctx_mem_type {
+ #define BNXT_CTX_CA1	FUNC_BACKING_STORE_QCAPS_V2_REQ_TYPE_CA1_TRACE
+ #define BNXT_CTX_CA2	FUNC_BACKING_STORE_QCAPS_V2_REQ_TYPE_CA2_TRACE
+ #define BNXT_CTX_RIGP1	FUNC_BACKING_STORE_QCAPS_V2_REQ_TYPE_RIGP1_TRACE
++#define BNXT_CTX_KONG	FUNC_BACKING_STORE_QCAPS_V2_REQ_TYPE_AFM_KONG_HWRM_TRACE
+ 
+ #define BNXT_CTX_MAX	(BNXT_CTX_TIM + 1)
+ #define BNXT_CTX_L2_MAX	(BNXT_CTX_FTQM + 1)
+-#define BNXT_CTX_V2_MAX	(BNXT_CTX_RIGP1 + 1)
++#define BNXT_CTX_V2_MAX	(BNXT_CTX_KONG + 1)
+ #define BNXT_CTX_INV	((u16)-1)
+ 
+ struct bnxt_ctx_mem_info {
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c
+index 18d6c94d5cb82..a0a37216efb3b 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.c
+@@ -36,6 +36,7 @@ static const u16 bnxt_bstore_to_seg_id[] = {
+ 	[BNXT_CTX_CA1]			= BNXT_CTX_MEM_SEG_CA1,
+ 	[BNXT_CTX_CA2]			= BNXT_CTX_MEM_SEG_CA2,
+ 	[BNXT_CTX_RIGP1]		= BNXT_CTX_MEM_SEG_RIGP1,
++	[BNXT_CTX_KONG]			= BNXT_CTX_MEM_SEG_KONG,
+ };
+ 
+ static int bnxt_dbg_hwrm_log_buffer_flush(struct bnxt *bp, u16 type, u32 flags,
+@@ -359,7 +360,7 @@ static u32 bnxt_get_ctx_coredump(struct bnxt *bp, void *buf, u32 offset,
+ 
+ 	if (buf)
+ 		buf += offset;
+-	for (type = 0 ; type <= BNXT_CTX_RIGP1; type++) {
++	for (type = 0; type <= BNXT_CTX_KONG; type++) {
+ 		struct bnxt_ctx_mem_type *ctxm = &ctx->ctx_arr[type];
+ 		bool trace = bnxt_bs_trace_avail(bp, type);
+ 		u32 seg_id = bnxt_bstore_to_seg_id[type];
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h
+index d1cd6387f3ab4..8d0f58c74cc32 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_coredump.h
+@@ -102,6 +102,7 @@ struct bnxt_driver_segment_record {
+ #define BNXT_CTX_MEM_SEG_CA1	0x9
+ #define BNXT_CTX_MEM_SEG_CA2	0xa
+ #define BNXT_CTX_MEM_SEG_RIGP1	0xb
++#define BNXT_CTX_MEM_SEG_KONG	0xd
+ 
+ #define BNXT_CRASH_DUMP_LEN	(8 << 20)
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/bnxt_en-add-hyper-v-vf-id.patch b/queue-6.17/bnxt_en-add-hyper-v-vf-id.patch
new file mode 100644
index 0000000000..1f5e4330d4
--- /dev/null
+++ b/queue-6.17/bnxt_en-add-hyper-v-vf-id.patch
@@ -0,0 +1,69 @@
+From 31dd030189ad9438fa6f4a5432a8a81c787f5674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 09:39:19 -0700
+Subject: bnxt_en: Add Hyper-V VF ID
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+[ Upstream commit 5be7cb805bd9a6680b863a1477dbc6e7986cc223 ]
+
+VFs of the P7 chip family created by Hyper-V will have the device ID of
+0x181b.
+
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://patch.msgid.link/20250819163919.104075-6-michael.chan@broadcom.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 ++++-
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 0daa08cecaf28..0f3cc21ab0320 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -142,6 +142,7 @@ static const struct {
+ 	[NETXTREME_E_P5_VF] = { "Broadcom BCM5750X NetXtreme-E Ethernet Virtual Function" },
+ 	[NETXTREME_E_P5_VF_HV] = { "Broadcom BCM5750X NetXtreme-E Virtual Function for Hyper-V" },
+ 	[NETXTREME_E_P7_VF] = { "Broadcom BCM5760X Virtual Function" },
++	[NETXTREME_E_P7_VF_HV] = { "Broadcom BCM5760X Virtual Function for Hyper-V" },
+ };
+ 
+ static const struct pci_device_id bnxt_pci_tbl[] = {
+@@ -217,6 +218,7 @@ static const struct pci_device_id bnxt_pci_tbl[] = {
+ 	{ PCI_VDEVICE(BROADCOM, 0x1808), .driver_data = NETXTREME_E_P5_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0x1809), .driver_data = NETXTREME_E_P5_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0x1819), .driver_data = NETXTREME_E_P7_VF },
++	{ PCI_VDEVICE(BROADCOM, 0x181b), .driver_data = NETXTREME_E_P7_VF_HV },
+ 	{ PCI_VDEVICE(BROADCOM, 0xd800), .driver_data = NETXTREME_S_VF },
+ #endif
+ 	{ 0 }
+@@ -315,7 +317,8 @@ static bool bnxt_vf_pciid(enum board_idx idx)
+ 	return (idx == NETXTREME_C_VF || idx == NETXTREME_E_VF ||
+ 		idx == NETXTREME_S_VF || idx == NETXTREME_C_VF_HV ||
+ 		idx == NETXTREME_E_VF_HV || idx == NETXTREME_E_P5_VF ||
+-		idx == NETXTREME_E_P5_VF_HV || idx == NETXTREME_E_P7_VF);
++		idx == NETXTREME_E_P5_VF_HV || idx == NETXTREME_E_P7_VF ||
++		idx == NETXTREME_E_P7_VF_HV);
+ }
+ 
+ #define DB_CP_REARM_FLAGS	(DB_KEY_CP | DB_IDX_VALID)
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index fda0d3cc6227c..119d4ef6ef660 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -2130,6 +2130,7 @@ enum board_idx {
+ 	NETXTREME_E_P5_VF,
+ 	NETXTREME_E_P5_VF_HV,
+ 	NETXTREME_E_P7_VF,
++	NETXTREME_E_P7_VF_HV,
+ };
+ 
+ #define BNXT_TRACE_BUF_MAGIC_BYTE ((u8)0xbc)
+-- 
+2.51.0
+
diff --git a/queue-6.17/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-6.17/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..19d3b68e2f
--- /dev/null
+++ b/queue-6.17/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From a7727029f678b9310625fed76b9d99a0c71ac4e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index 29097e984b4f7..870bdf2e082c4 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-6.17/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch b/queue-6.17/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
new file mode 100644
index 0000000000..941bf67880
--- /dev/null
+++ b/queue-6.17/bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
@@ -0,0 +1,56 @@
+From 53a5fb5c9bcdf9b391b571f0d16931c1df5d3f20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 18:18:09 +0530
+Subject: bus: mhi: core: Improve mhi_sync_power_up handling for SYS_ERR state
+
+From: Vivek Pernamitta <quic_vpernami@quicinc.com>
+
+[ Upstream commit aa1a0e93ed21a06acb7ca9d4a4a9fce75ea53d0c ]
+
+Allow mhi_sync_power_up to handle SYS_ERR during power-up, reboot,
+or recovery. This is to avoid premature exit when MHI_PM_IN_ERROR_STATE is
+observed during above mentioned system states.
+
+To achieve this, treat SYS_ERR as a valid state and let its handler process
+the error and queue the next transition to Mission Mode instead of aborting
+early.
+
+Signed-off-by: Vivek Pernamitta <quic_vpernami@quicinc.com>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250912-uevent_vdev_next-20250911-v4-5-fa2f6ccd301b@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/host/internal.h | 2 ++
+ drivers/bus/mhi/host/pm.c       | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/bus/mhi/host/internal.h b/drivers/bus/mhi/host/internal.h
+index 034be33565b78..9f815cfac763e 100644
+--- a/drivers/bus/mhi/host/internal.h
++++ b/drivers/bus/mhi/host/internal.h
+@@ -170,6 +170,8 @@ enum mhi_pm_state {
+ 							MHI_PM_IN_ERROR_STATE(pm_state))
+ #define MHI_PM_IN_SUSPEND_STATE(pm_state)		(pm_state & \
+ 							(MHI_PM_M3_ENTER | MHI_PM_M3))
++#define MHI_PM_FATAL_ERROR(pm_state)			((pm_state == MHI_PM_FW_DL_ERR) || \
++							(pm_state >= MHI_PM_SYS_ERR_FAIL))
+ 
+ #define NR_OF_CMD_RINGS					1
+ #define CMD_EL_PER_RING					128
+diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c
+index 33d92bf2fc3ed..31b20c07de9ee 100644
+--- a/drivers/bus/mhi/host/pm.c
++++ b/drivers/bus/mhi/host/pm.c
+@@ -1279,7 +1279,7 @@ int mhi_sync_power_up(struct mhi_controller *mhi_cntrl)
+ 		mhi_cntrl->ready_timeout_ms : mhi_cntrl->timeout_ms;
+ 	wait_event_timeout(mhi_cntrl->state_event,
+ 			   MHI_IN_MISSION_MODE(mhi_cntrl->ee) ||
+-			   MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state),
++			   MHI_PM_FATAL_ERROR(mhi_cntrl->pm_state),
+ 			   msecs_to_jiffies(timeout_ms));
+ 
+ 	ret = (MHI_IN_MISSION_MODE(mhi_cntrl->ee)) ? 0 : -ETIMEDOUT;
+-- 
+2.51.0
+
diff --git a/queue-6.17/bus-mhi-host-pci_generic-add-support-for-all-foxconn.patch b/queue-6.17/bus-mhi-host-pci_generic-add-support-for-all-foxconn.patch
new file mode 100644
index 0000000000..a1fbf0523d
--- /dev/null
+++ b/queue-6.17/bus-mhi-host-pci_generic-add-support-for-all-foxconn.patch
@@ -0,0 +1,53 @@
+From 0f4983cc765cb7364b7f393c35f53c4af6ea794a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 10:00:13 +0800
+Subject: bus: mhi: host: pci_generic: Add support for all Foxconn T99W696 SKU
+ variants
+
+From: Slark Xiao <slark_xiao@163.com>
+
+[ Upstream commit 376358bb9770e5313d22d8784511497096cdb75f ]
+
+Since there are too many variants available for Foxconn T99W696 modem, and
+they all share the same configuration, use PCI_ANY_ID as the subsystem
+device ID to match each possible SKUs and support all of them.
+
+Signed-off-by: Slark Xiao <slark_xiao@163.com>
+[mani: reworded subject/description and dropped the fixes tag]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250819020013.122162-1-slark_xiao@163.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/mhi/host/pci_generic.c | 16 ++--------------
+ 1 file changed, 2 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
+index 4edb5bb476baf..4564e2528775e 100644
+--- a/drivers/bus/mhi/host/pci_generic.c
++++ b/drivers/bus/mhi/host/pci_generic.c
+@@ -917,20 +917,8 @@ static const struct pci_device_id mhi_pci_id_table[] = {
+ 	/* Telit FE990A */
+ 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, 0x1c5d, 0x2015),
+ 		.driver_data = (kernel_ulong_t) &mhi_telit_fe990a_info },
+-	/* Foxconn T99W696.01, Lenovo Generic SKU */
+-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, 0xe142),
+-		.driver_data = (kernel_ulong_t) &mhi_foxconn_t99w696_info },
+-	/* Foxconn T99W696.02, Lenovo X1 Carbon SKU */
+-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, 0xe143),
+-		.driver_data = (kernel_ulong_t) &mhi_foxconn_t99w696_info },
+-	/* Foxconn T99W696.03, Lenovo X1 2in1 SKU */
+-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, 0xe144),
+-		.driver_data = (kernel_ulong_t) &mhi_foxconn_t99w696_info },
+-	/* Foxconn T99W696.04, Lenovo PRC SKU */
+-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, 0xe145),
+-		.driver_data = (kernel_ulong_t) &mhi_foxconn_t99w696_info },
+-	/* Foxconn T99W696.00, Foxconn SKU */
+-	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, 0xe146),
++	/* Foxconn T99W696, all variants */
++	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_QCOM, 0x0308, PCI_VENDOR_ID_FOXCONN, PCI_ANY_ID),
+ 		.driver_data = (kernel_ulong_t) &mhi_foxconn_t99w696_info },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_QCOM, 0x0308),
+ 		.driver_data = (kernel_ulong_t) &mhi_qcom_sdx65_info },
+-- 
+2.51.0
+
diff --git a/queue-6.17/can-rcar_canfd-update-bit-rate-constants-for-rz-g3e-.patch b/queue-6.17/can-rcar_canfd-update-bit-rate-constants-for-rz-g3e-.patch
new file mode 100644
index 0000000000..8869343f43
--- /dev/null
+++ b/queue-6.17/can-rcar_canfd-update-bit-rate-constants-for-rz-g3e-.patch
@@ -0,0 +1,42 @@
+From 24111f8a8483e91aeb28c02f1307a761c589db7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:09:30 +0100
+Subject: can: rcar_canfd: Update bit rate constants for RZ/G3E and R-Car Gen4
+
+From: Biju Das <biju.das.jz@bp.renesas.com>
+
+[ Upstream commit 100fafc3e46138cb5a6526ddc03dcede8b020c8c ]
+
+The calculation formula for nominal bit rate of classical CAN is the same as
+that of nominal bit rate of CANFD on the RZ/G3E and R-Car Gen4 SoCs
+compared to other SoCs. Update nominal bit rate constants.
+
+Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250908120940.147196-2-biju.das.jz@bp.renesas.com
+[mkl: slightly improve wording of commit message]
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar/rcar_canfd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c
+index 7e8b1d2f1af65..4f3ce948d74da 100644
+--- a/drivers/net/can/rcar/rcar_canfd.c
++++ b/drivers/net/can/rcar/rcar_canfd.c
+@@ -1913,7 +1913,10 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch,
+ 		priv->can.fd.do_get_auto_tdcv = rcar_canfd_get_auto_tdcv;
+ 	} else {
+ 		/* Controller starts in Classical CAN only mode */
+-		priv->can.bittiming_const = &rcar_canfd_bittiming_const;
++		if (gpriv->info->shared_can_regs)
++			priv->can.bittiming_const = gpriv->info->nom_bittiming;
++		else
++			priv->can.bittiming_const = &rcar_canfd_bittiming_const;
+ 		priv->can.ctrlmode_supported = CAN_CTRLMODE_BERR_REPORTING;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-6.17/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..5e384583cc
--- /dev/null
+++ b/queue-6.17/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From 6df33b19a4a2ddf7956d282b0d5d854b3c77d2c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 255a164eec86d..4c276b8066ff8 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -132,7 +132,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		break;
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -144,10 +145,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 			new_fops = fops_get(iter->fops);
+ 			break;
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-6.17/char-misc-make-misc_register-reentry-for-miscdevice-.patch b/queue-6.17/char-misc-make-misc_register-reentry-for-miscdevice-.patch
new file mode 100644
index 0000000000..4fa4027838
--- /dev/null
+++ b/queue-6.17/char-misc-make-misc_register-reentry-for-miscdevice-.patch
@@ -0,0 +1,71 @@
+From 0fab77de432734fed620e9fffb0c33bdeb9403cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:16 +0800
+Subject: char: misc: Make misc_register() reentry for miscdevice who wants
+ dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 52e2bb5ff089d65e2c7d982fe2826dc88e473d50 ]
+
+For miscdevice who wants dynamic minor, it may fail to be registered again
+without reinitialization after being de-registered, which is illustrated
+by kunit test case miscdev_test_dynamic_reentry() newly added.
+
+There is a real case found by cascardo when a part of minor range were
+contained by range [0, 255):
+
+1) wmi/dell-smbios registered minor 122, and acpi_thermal_rel registered
+   minor 123
+2) unbind "int3400 thermal" driver from its device, this will de-register
+   acpi_thermal_rel
+3) rmmod then insmod dell_smbios again, now wmi/dell-smbios is using minor
+   123
+4) bind the device to "int3400 thermal" driver again, acpi_thermal_rel
+   fails to register.
+
+Some drivers may reuse the miscdevice structure after they are deregistered
+If the intention is to allocate a dynamic minor, if the minor number is not
+reset to MISC_DYNAMIC_MINOR before calling misc_register(), it will try to
+register a previously dynamically allocated minor number, which may have
+been registered by a different driver.
+
+One such case is the acpi_thermal_rel misc device, registered by the
+int3400 thermal driver. If the device is unbound from the driver and later
+bound, if there was another dynamic misc device registered in between, it
+would fail to register the acpi_thermal_rel misc device. Other drivers
+behave similarly.
+
+Actually, this kind of issue is prone to happen if APIs
+misc_register()/misc_deregister() are invoked by driver's
+probe()/remove() separately.
+
+Instead of fixing all the drivers, just reset the minor member to
+MISC_DYNAMIC_MINOR in misc_deregister() in case it was a dynamically
+allocated minor number, as error handling of misc_register() does.
+
+Cc: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-5-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 558302a64dd90..255a164eec86d 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -282,6 +282,8 @@ void misc_deregister(struct miscdevice *misc)
+ 	list_del(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
++	if (misc->minor > MISC_DYNAMIC_MINOR)
++		misc->minor = MISC_DYNAMIC_MINOR;
+ 	mutex_unlock(&misc_mtx);
+ }
+ EXPORT_SYMBOL(misc_deregister);
+-- 
+2.51.0
+
diff --git a/queue-6.17/char-use-list_del_init-in-misc_deregister-to-reiniti.patch b/queue-6.17/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
new file mode 100644
index 0000000000..61b7b179ee
--- /dev/null
+++ b/queue-6.17/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
@@ -0,0 +1,52 @@
+From 3770db9bd69a5d1d1fde7e5413ef3fc3b38c0633 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 14:37:04 +0800
+Subject: char: Use list_del_init() in misc_deregister() to reinitialize list
+ pointer
+
+From: Xion Wang <xion.wang@mediatek.com>
+
+[ Upstream commit e28022873c0d051e980c4145f1965cab5504b498 ]
+
+Currently, misc_deregister() uses list_del() to remove the device
+from the list. After list_del(), the list pointers are set to
+LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs,
+but does not reset the list head.
+If misc_deregister() is called more than once on the same device,
+list_empty() will not return true, and list_del() may be called again,
+leading to undefined behavior.
+
+Replace list_del() with list_del_init() to reinitialize the list head
+after deletion. This makes the code more robust against double
+deregistration and allows safe usage of list_empty() on the miscdevice
+after deregistration.
+
+[ Note, this seems to keep broken out-of-tree drivers from doing foolish
+  things.  While this does not matter for any in-kernel drivers,
+  external drivers could use a bit of help to show them they shouldn't
+  be doing stuff like re-registering misc devices - gregkh ]
+
+Signed-off-by: Xion Wang <xion.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 4c276b8066ff8..ea5b4975347a0 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -281,7 +281,7 @@ void misc_deregister(struct miscdevice *misc)
+ 		return;
+ 
+ 	mutex_lock(&misc_mtx);
+-	list_del(&misc->list);
++	list_del_init(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
+ 	if (misc->minor > MISC_DYNAMIC_MINOR)
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-caam-double-the-entropy-delay-interval-for-re.patch b/queue-6.17/crypto-caam-double-the-entropy-delay-interval-for-re.patch
new file mode 100644
index 0000000000..b6a936e6a2
--- /dev/null
+++ b/queue-6.17/crypto-caam-double-the-entropy-delay-interval-for-re.patch
@@ -0,0 +1,49 @@
+From 6f8a5a65a3f063ab7e1655ea2cf226c195d46cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:41:48 +0530
+Subject: crypto: caam - double the entropy delay interval for retry
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit 9048beca9c5614d486e2b492c0a7867164bf56a8 ]
+
+during entropy evaluation, if the generated samples fail
+any statistical test, then, all of the bits will be discarded,
+and a second set of samples will be generated and tested.
+
+the entropy delay interval should be doubled before performing the
+retry.
+
+also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG
+status register, but only inst_handles is updated before every retry.
+so only check inst_handles and removing ctrlpriv->rng4_sh_init
+
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/ctrl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index a93be395c878c..18a850cf0f971 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -703,12 +703,12 @@ static int caam_ctrl_rng_init(struct device *dev)
+ 			 */
+ 			if (needs_entropy_delay_adjustment())
+ 				ent_delay = 12000;
+-			if (!(ctrlpriv->rng4_sh_init || inst_handles)) {
++			if (!inst_handles) {
+ 				dev_info(dev,
+ 					 "Entropy delay = %u\n",
+ 					 ent_delay);
+ 				kick_trng(dev, ent_delay);
+-				ent_delay += 400;
++				ent_delay = ent_delay * 2;
+ 			}
+ 			/*
+ 			 * if instantiate_rng(...) fails, the loop will rerun
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch b/queue-6.17/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
new file mode 100644
index 0000000000..b1d51af4db
--- /dev/null
+++ b/queue-6.17/crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
@@ -0,0 +1,44 @@
+From af02e4f0f5c963d1e6c0c6e01bb0cf314685b3ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 22:16:43 +0900
+Subject: crypto: ccp - Fix incorrect payload size calculation in
+ psp_poulate_hsti()
+
+From: Yunseong Kim <ysk@kzalloc.com>
+
+[ Upstream commit 2b0dc40ac6ca16ee0c489927f4856cf9cd3874c7 ]
+
+payload_size field of the request header is incorrectly calculated using
+sizeof(req). Since 'req' is a pointer (struct hsti_request *), sizeof(req)
+returns the size of the pointer itself (e.g., 8 bytes on a 64-bit system),
+rather than the size of the structure it points to. This leads to an
+incorrect payload size being sent to the Platform Security Processor (PSP),
+potentially causing the HSTI query command to fail.
+
+Fix this by using sizeof(*req) to correctly calculate the size of the
+struct hsti_request.
+
+Signed-off-by: Yunseong Kim <ysk@kzalloc.com>
+Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>> ---
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/hsti.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/hsti.c b/drivers/crypto/ccp/hsti.c
+index 1b39a4fb55c06..0e6b73b55dbf7 100644
+--- a/drivers/crypto/ccp/hsti.c
++++ b/drivers/crypto/ccp/hsti.c
+@@ -88,7 +88,7 @@ static int psp_poulate_hsti(struct psp_device *psp)
+ 	if (!req)
+ 		return -ENOMEM;
+ 
+-	req->header.payload_size = sizeof(req);
++	req->header.payload_size = sizeof(*req);
+ 
+ 	ret = psp_send_platform_access_msg(PSP_CMD_HSTI_QUERY, (struct psp_request *)req);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch b/queue-6.17/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
new file mode 100644
index 0000000000..a7675aade7
--- /dev/null
+++ b/queue-6.17/crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
@@ -0,0 +1,58 @@
+From 026bc57672701b0efd31e0aa41776b8add103b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:38 +0000
+Subject: crypto: ccp: Skip SEV and SNP INIT for kdump boot
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 8c571019d8a817b701888926529a5d7a826b947b ]
+
+Since SEV or SNP may already be initialized in the previous kernel,
+attempting to initialize them again in the kdump kernel can result
+in SNP initialization failures, which in turn lead to IOMMU
+initialization failures. Moreover, SNP/SEV guests are not run under a
+kdump kernel, so there is no need to initialize SEV or SNP during
+kdump boot.
+
+Skip SNP and SEV INIT if doing kdump boot.
+
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/d884eff5f6180d8b8c6698a6168988118cf9cba1.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/sev-dev.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
+index 9f5ccc1720cbc..651346db6909d 100644
+--- a/drivers/crypto/ccp/sev-dev.c
++++ b/drivers/crypto/ccp/sev-dev.c
+@@ -28,6 +28,7 @@
+ #include <linux/fs_struct.h>
+ #include <linux/psp.h>
+ #include <linux/amd-iommu.h>
++#include <linux/crash_dump.h>
+ 
+ #include <asm/smp.h>
+ #include <asm/cacheflush.h>
+@@ -1345,6 +1346,15 @@ static int _sev_platform_init_locked(struct sev_platform_init_args *args)
+ 	if (!psp_master || !psp_master->sev_data)
+ 		return -ENODEV;
+ 
++	/*
++	 * Skip SNP/SEV initialization under a kdump kernel as SEV/SNP
++	 * may already be initialized in the previous kernel. Since no
++	 * SNP/SEV guests are run under a kdump kernel, there is no
++	 * need to initialize SNP or SEV during kdump boot.
++	 */
++	if (is_kdump_kernel())
++		return 0;
++
+ 	sev = psp_master->sev_data;
+ 
+ 	if (sev->state == SEV_STATE_INIT)
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch b/queue-6.17/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
new file mode 100644
index 0000000000..b911785f86
--- /dev/null
+++ b/queue-6.17/crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
@@ -0,0 +1,87 @@
+From 49dbb7505b7ae9c796015ae5b8b39dcdf9c0e19a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:53 +0800
+Subject: crypto: hisilicon/qm - clear all VF configurations in the hardware
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 64b9642fc29a14e1fe67842be9c69c7b90a3bcd6 ]
+
+When disabling SR-IOV, clear the configuration of each VF
+in the hardware. Do not exit the configuration clearing process
+due to the failure of a single VF. Additionally, Clear the VF
+configurations before decrementing the PM counter.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 822202e0f11b6..f9bf102b2b37d 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -3646,19 +3646,19 @@ static int qm_vf_q_assign(struct hisi_qm *qm, u32 num_vfs)
+ 	return 0;
+ }
+ 
+-static int qm_clear_vft_config(struct hisi_qm *qm)
++static void qm_clear_vft_config(struct hisi_qm *qm)
+ {
+-	int ret;
+ 	u32 i;
+ 
+-	for (i = 1; i <= qm->vfs_num; i++) {
+-		ret = hisi_qm_set_vft(qm, i, 0, 0);
+-		if (ret)
+-			return ret;
+-	}
+-	qm->vfs_num = 0;
++	/*
++	 * When disabling SR-IOV, clear the configuration of each VF in the hardware
++	 * sequentially. Failure to clear a single VF should not affect the clearing
++	 * operation of other VFs.
++	 */
++	for (i = 1; i <= qm->vfs_num; i++)
++		(void)hisi_qm_set_vft(qm, i, 0, 0);
+ 
+-	return 0;
++	qm->vfs_num = 0;
+ }
+ 
+ static int qm_func_shaper_enable(struct hisi_qm *qm, u32 fun_index, u32 qos)
+@@ -3993,13 +3993,13 @@ int hisi_qm_sriov_enable(struct pci_dev *pdev, int max_vfs)
+ 		goto err_put_sync;
+ 	}
+ 
++	qm->vfs_num = num_vfs;
+ 	ret = pci_enable_sriov(pdev, num_vfs);
+ 	if (ret) {
+ 		pci_err(pdev, "Can't enable VF!\n");
+ 		qm_clear_vft_config(qm);
+ 		goto err_put_sync;
+ 	}
+-	qm->vfs_num = num_vfs;
+ 
+ 	pci_info(pdev, "VF enabled, vfs_num(=%d)!\n", num_vfs);
+ 
+@@ -4034,11 +4034,10 @@ int hisi_qm_sriov_disable(struct pci_dev *pdev, bool is_frozen)
+ 	}
+ 
+ 	pci_disable_sriov(pdev);
+-
+-	qm->vfs_num = 0;
++	qm_clear_vft_config(qm);
+ 	qm_pm_put_sync(qm);
+ 
+-	return qm_clear_vft_config(qm);
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_sriov_disable);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-hisilicon-qm-invalidate-queues-in-use.patch b/queue-6.17/crypto-hisilicon-qm-invalidate-queues-in-use.patch
new file mode 100644
index 0000000000..357027ee55
--- /dev/null
+++ b/queue-6.17/crypto-hisilicon-qm-invalidate-queues-in-use.patch
@@ -0,0 +1,145 @@
+From f02b3cce0c90332da984d72aff4d2059b1cb0f93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Sep 2025 18:57:50 +0800
+Subject: crypto: hisilicon/qm - invalidate queues in use
+
+From: Weili Qian <qianweili@huawei.com>
+
+[ Upstream commit 85acd1b26b8f5b838887dc965dc3aa2c0253f4d1 ]
+
+Before the device reset, although the driver has set the queue
+status to intercept doorbells sent by the task process, the reset
+thread is isolated from the user-mode task process, so the task process
+may still send doorbells. Therefore, before the reset, the queue is
+directly invalidated, and the device directly discards the doorbells
+sent by the process.
+
+Signed-off-by: Weili Qian <qianweili@huawei.com>
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 53 ++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 102aff9ea19a0..822202e0f11b6 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -45,6 +45,8 @@
+ 
+ #define QM_SQ_TYPE_MASK			GENMASK(3, 0)
+ #define QM_SQ_TAIL_IDX(sqc)		((le16_to_cpu((sqc).w11) >> 6) & 0x1)
++#define QM_SQC_DISABLE_QP		(1U << 6)
++#define QM_XQC_RANDOM_DATA		0xaaaa
+ 
+ /* cqc shift */
+ #define QM_CQ_HOP_NUM_SHIFT		0
+@@ -3179,6 +3181,9 @@ static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm)
+ 
+ 	qm_init_eq_aeq_status(qm);
+ 
++	/* Before starting the dev, clear the memory and then configure to device using. */
++	memset(qm->qdma.va, 0, qm->qdma.size);
++
+ 	ret = qm_eq_ctx_cfg(qm);
+ 	if (ret) {
+ 		dev_err(dev, "Set eqc failed!\n");
+@@ -3190,9 +3195,13 @@ static int qm_eq_aeq_ctx_cfg(struct hisi_qm *qm)
+ 
+ static int __hisi_qm_start(struct hisi_qm *qm)
+ {
++	struct device *dev = &qm->pdev->dev;
+ 	int ret;
+ 
+-	WARN_ON(!qm->qdma.va);
++	if (!qm->qdma.va) {
++		dev_err(dev, "qm qdma is NULL!\n");
++		return -EINVAL;
++	}
+ 
+ 	if (qm->fun_type == QM_HW_PF) {
+ 		ret = hisi_qm_set_vft(qm, 0, qm->qp_base, qm->qp_num);
+@@ -3266,7 +3275,7 @@ static int qm_restart(struct hisi_qm *qm)
+ 	for (i = 0; i < qm->qp_num; i++) {
+ 		qp = &qm->qp_array[i];
+ 		if (atomic_read(&qp->qp_status.flags) == QP_STOP &&
+-		    qp->is_resetting == true) {
++		    qp->is_resetting == true && qp->is_in_kernel == true) {
+ 			ret = qm_start_qp_nolock(qp, 0);
+ 			if (ret < 0) {
+ 				dev_err(dev, "Failed to start qp%d!\n", i);
+@@ -3298,24 +3307,44 @@ static void qm_stop_started_qp(struct hisi_qm *qm)
+ }
+ 
+ /**
+- * qm_clear_queues() - Clear all queues memory in a qm.
+- * @qm: The qm in which the queues will be cleared.
++ * qm_invalid_queues() - invalid all queues in use.
++ * @qm: The qm in which the queues will be invalidated.
+  *
+- * This function clears all queues memory in a qm. Reset of accelerator can
+- * use this to clear queues.
++ * This function invalid all queues in use. If the doorbell command is sent
++ * to device in user space after the device is reset, the device discards
++ * the doorbell command.
+  */
+-static void qm_clear_queues(struct hisi_qm *qm)
++static void qm_invalid_queues(struct hisi_qm *qm)
+ {
+ 	struct hisi_qp *qp;
++	struct qm_sqc *sqc;
++	struct qm_cqc *cqc;
+ 	int i;
+ 
++	/*
++	 * Normal stop queues is no longer used and does not need to be
++	 * invalid queues.
++	 */
++	if (qm->status.stop_reason == QM_NORMAL)
++		return;
++
++	if (qm->status.stop_reason == QM_DOWN)
++		hisi_qm_cache_wb(qm);
++
+ 	for (i = 0; i < qm->qp_num; i++) {
+ 		qp = &qm->qp_array[i];
+-		if (qp->is_in_kernel && qp->is_resetting)
++		if (!qp->is_resetting)
++			continue;
++
++		/* Modify random data and set sqc close bit to invalid queue. */
++		sqc = qm->sqc + i;
++		cqc = qm->cqc + i;
++		sqc->w8 = cpu_to_le16(QM_XQC_RANDOM_DATA);
++		sqc->w13 = cpu_to_le16(QM_SQC_DISABLE_QP);
++		cqc->w8 = cpu_to_le16(QM_XQC_RANDOM_DATA);
++		if (qp->is_in_kernel)
+ 			memset(qp->qdma.va, 0, qp->qdma.size);
+ 	}
+-
+-	memset(qm->qdma.va, 0, qm->qdma.size);
+ }
+ 
+ /**
+@@ -3372,7 +3401,7 @@ int hisi_qm_stop(struct hisi_qm *qm, enum qm_stop_reason r)
+ 		}
+ 	}
+ 
+-	qm_clear_queues(qm);
++	qm_invalid_queues(qm);
+ 	qm->status.stop_reason = QM_NORMAL;
+ 
+ err_unlock:
+@@ -4770,8 +4799,6 @@ void hisi_qm_dev_shutdown(struct pci_dev *pdev)
+ 	ret = hisi_qm_stop(qm, QM_DOWN);
+ 	if (ret)
+ 		dev_err(&pdev->dev, "Fail to stop qm in shutdown!\n");
+-
+-	hisi_qm_cache_wb(qm);
+ }
+ EXPORT_SYMBOL_GPL(hisi_qm_dev_shutdown);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch b/queue-6.17/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
new file mode 100644
index 0000000000..680fbfcad8
--- /dev/null
+++ b/queue-6.17/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
@@ -0,0 +1,43 @@
+From 770ea7e22b79eb32bb73632bb4d05e20ebf694b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 22:20:26 +0800
+Subject: crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4c634b6b3c77bba237ee64bca172e73f9cee0cb2 ]
+
+As noted in the kernel documentation [1], open-coded multiplication in
+allocator arguments is discouraged because it can lead to integer overflow.
+
+Use kcalloc() to gain built-in overflow protection, making memory
+allocation safer when calculating allocation size compared to explicit
+multiplication.  Similarly, use size_add() instead of explicit addition
+for 'uobj_chunk_num + sobj_chunk_num'.
+
+Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/qat_uclo.c b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+index 21d652a1c8ef3..18c3e4416dc51 100644
+--- a/drivers/crypto/intel/qat/qat_common/qat_uclo.c
++++ b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+@@ -1900,7 +1900,7 @@ static int qat_uclo_map_objs_from_mof(struct icp_qat_mof_handle *mobj_handle)
+ 	if (sobj_hdr)
+ 		sobj_chunk_num = sobj_hdr->num_chunks;
+ 
+-	mobj_hdr = kzalloc((uobj_chunk_num + sobj_chunk_num) *
++	mobj_hdr = kcalloc(size_add(uobj_chunk_num, sobj_chunk_num),
+ 			   sizeof(*mobj_hdr), GFP_KERNEL);
+ 	if (!mobj_hdr)
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.17/crypto-sun8i-ce-remove-channel-timeout-field.patch b/queue-6.17/crypto-sun8i-ce-remove-channel-timeout-field.patch
new file mode 100644
index 0000000000..7299bdfccb
--- /dev/null
+++ b/queue-6.17/crypto-sun8i-ce-remove-channel-timeout-field.patch
@@ -0,0 +1,120 @@
+From 44053afd0da03535edf32c7470ee79ca1c7923a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:21:26 +0300
+Subject: crypto: sun8i-ce - remove channel timeout field
+
+From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+
+[ Upstream commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e ]
+
+Using the number of bytes in the request as DMA timeout is really
+inconsistent, as large requests could possibly set a timeout of
+hundreds of seconds.
+
+Remove the per-channel timeout field and use a single, static DMA
+timeout of 3 seconds for all requests.
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+Tested-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Reviewed-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c   | 5 ++---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c   | 2 --
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h        | 2 +-
+ 6 files changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+index 5663df49dd817..113a1100f2aeb 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+@@ -276,7 +276,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req
+ 		goto theend_sgs;
+ 	}
+ 
+-	chan->timeout = areq->cryptlen;
+ 	rctx->nr_sgs = ns;
+ 	rctx->nr_sgd = nd;
+ 	return 0;
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+index 658f520cee0ca..79ec172e5c995 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+@@ -210,11 +210,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name)
+ 	mutex_unlock(&ce->mlock);
+ 
+ 	wait_for_completion_interruptible_timeout(&ce->chanlist[flow].complete,
+-			msecs_to_jiffies(ce->chanlist[flow].timeout));
++			msecs_to_jiffies(CE_DMA_TIMEOUT_MS));
+ 
+ 	if (ce->chanlist[flow].status == 0) {
+-		dev_err(ce->dev, "DMA timeout for %s (tm=%d) on flow %d\n", name,
+-			ce->chanlist[flow].timeout, flow);
++		dev_err(ce->dev, "DMA timeout for %s on flow %d\n", name, flow);
+ 		err = -EFAULT;
+ 	}
+ 	/* No need to lock for this read, the channel is locked so
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+index 13bdfb8a2c627..b26f5427c1e06 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+@@ -446,8 +446,6 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 	else
+ 		cet->t_dlen = cpu_to_le32(areq->nbytes / 4 + j);
+ 
+-	chan->timeout = areq->nbytes;
+-
+ 	err = sun8i_ce_run_task(ce, flow, crypto_ahash_alg_name(tfm));
+ 
+ 	dma_unmap_single(ce->dev, addr_pad, j * 4, DMA_TO_DEVICE);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+index 762459867b6c5..d0a1ac66738bf 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+@@ -137,7 +137,6 @@ int sun8i_ce_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ 
+ 	cet->t_dst[0].addr = desc_addr_val_le32(ce, dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = 2000;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "PRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+index e1e8bc15202e0..244529bf06162 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+@@ -79,7 +79,6 @@ static int sun8i_ce_trng_read(struct hwrng *rng, void *data, size_t max, bool wa
+ 
+ 	cet->t_dst[0].addr = desc_addr_val_le32(ce, dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = todo;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "TRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+index 0f9a890670167..f12c32d1843f2 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+@@ -106,6 +106,7 @@
+ #define MAX_SG 8
+ 
+ #define CE_MAX_CLOCKS 4
++#define CE_DMA_TIMEOUT_MS	3000
+ 
+ #define MAXFLOW 4
+ 
+@@ -196,7 +197,6 @@ struct sun8i_ce_flow {
+ 	struct completion complete;
+ 	int status;
+ 	dma_addr_t t_phy;
+-	int timeout;
+ 	struct ce_task *tl;
+ 	void *backup_iv;
+ 	void *bounce_iv;
+-- 
+2.51.0
+
diff --git a/queue-6.17/dm-error-mark-as-dm_target_passes_integrity.patch b/queue-6.17/dm-error-mark-as-dm_target_passes_integrity.patch
new file mode 100644
index 0000000000..3767ec653a
--- /dev/null
+++ b/queue-6.17/dm-error-mark-as-dm_target_passes_integrity.patch
@@ -0,0 +1,41 @@
+From 6e627725d287dded04ff09d7c9494204021600a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 06:58:21 +0200
+Subject: dm error: mark as DM_TARGET_PASSES_INTEGRITY
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 499cbe0f2fb0641cf07a1a8ac9f7317674295fea ]
+
+Mark dm error as DM_TARGET_PASSES_INTEGRITY so that it can be stacked on
+top of PI capable devices.  The claim is strictly speaking as lie as dm
+error fails all I/O and doesn't pass anything on, but doing the same for
+integrity I/O work just fine :)
+
+This helps to make about two dozen xfstests test cases pass on PI capable
+devices.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-target.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
+index 2af5a9514c05e..8fede41adec00 100644
+--- a/drivers/md/dm-target.c
++++ b/drivers/md/dm-target.c
+@@ -263,7 +263,8 @@ static long io_err_dax_direct_access(struct dm_target *ti, pgoff_t pgoff,
+ static struct target_type error_target = {
+ 	.name = "error",
+ 	.version = {1, 7, 0},
+-	.features = DM_TARGET_WILDCARD | DM_TARGET_ZONED_HM,
++	.features = DM_TARGET_WILDCARD | DM_TARGET_ZONED_HM |
++		DM_TARGET_PASSES_INTEGRITY,
+ 	.ctr  = io_err_ctr,
+ 	.dtr  = io_err_dtr,
+ 	.map  = io_err_map,
+-- 
+2.51.0
+
diff --git a/queue-6.17/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-6.17/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..5245980bef
--- /dev/null
+++ b/queue-6.17/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From 0a9713049c83bb199f30bb14c91507d558445e6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index b43255f914f33..8e5f7defa6b67 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -584,6 +584,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -597,6 +616,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -633,6 +654,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/dmaengine-idxd-add-a-new-iaa-device-id-for-wildcat-l.patch b/queue-6.17/dmaengine-idxd-add-a-new-iaa-device-id-for-wildcat-l.patch
new file mode 100644
index 0000000000..915ea2abd4
--- /dev/null
+++ b/queue-6.17/dmaengine-idxd-add-a-new-iaa-device-id-for-wildcat-l.patch
@@ -0,0 +1,52 @@
+From c30759b7b0bc3301fe6beb4db47bd7bcfdd27c54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 14:59:35 -0700
+Subject: dmaengine: idxd: Add a new IAA device ID for Wildcat Lake family
+ platforms
+
+From: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+
+[ Upstream commit c937969a503ebf45e0bebafee4122db22b0091bd ]
+
+A new IAA device ID, 0xfd2d, is introduced across all Wildcat Lake
+family platforms. Add the device ID to the IDXD driver.
+
+Signed-off-by: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20250801215936.188555-1-vinicius.gomes@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/idxd/init.c      | 2 ++
+ drivers/dma/idxd/registers.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/dma/idxd/init.c b/drivers/dma/idxd/init.c
+index 8c4725ad1f648..2acc34b3daff8 100644
+--- a/drivers/dma/idxd/init.c
++++ b/drivers/dma/idxd/init.c
+@@ -80,6 +80,8 @@ static struct pci_device_id idxd_pci_tbl[] = {
+ 	{ PCI_DEVICE_DATA(INTEL, IAA_DMR, &idxd_driver_data[IDXD_TYPE_IAX]) },
+ 	/* IAA PTL platforms */
+ 	{ PCI_DEVICE_DATA(INTEL, IAA_PTL, &idxd_driver_data[IDXD_TYPE_IAX]) },
++	/* IAA WCL platforms */
++	{ PCI_DEVICE_DATA(INTEL, IAA_WCL, &idxd_driver_data[IDXD_TYPE_IAX]) },
+ 	{ 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, idxd_pci_tbl);
+diff --git a/drivers/dma/idxd/registers.h b/drivers/dma/idxd/registers.h
+index 9c1c546fe443e..0d84bd7a680b7 100644
+--- a/drivers/dma/idxd/registers.h
++++ b/drivers/dma/idxd/registers.h
+@@ -10,6 +10,7 @@
+ #define PCI_DEVICE_ID_INTEL_DSA_DMR	0x1212
+ #define PCI_DEVICE_ID_INTEL_IAA_DMR	0x1216
+ #define PCI_DEVICE_ID_INTEL_IAA_PTL	0xb02d
++#define PCI_DEVICE_ID_INTEL_IAA_WCL	0xfd2d
+ 
+ #define DEVICE_VERSION_1		0x100
+ #define DEVICE_VERSION_2		0x200
+-- 
+2.51.0
+
diff --git a/queue-6.17/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-6.17/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..4b7327ad69
--- /dev/null
+++ b/queue-6.17/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From 3395950419f10077c67403a739189743b1df8ef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 1fdcb0f5c9e72..5e83862960461 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-6.17/dmaengine-sh-setup_xref-error-handling.patch b/queue-6.17/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..e8b8d0a3a7
--- /dev/null
+++ b/queue-6.17/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From bd7db48aa00c172ef8711eeb0070f26c7ae2b269 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 6b4fce453c85c..834741adadaad 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 093e449e19eee..603e15102e45e 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -300,21 +300,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-6.17/docs-kernel-doc-avoid-script-crash-on-ancient-python.patch b/queue-6.17/docs-kernel-doc-avoid-script-crash-on-ancient-python.patch
new file mode 100644
index 0000000000..1c252d0775
--- /dev/null
+++ b/queue-6.17/docs-kernel-doc-avoid-script-crash-on-ancient-python.patch
@@ -0,0 +1,146 @@
+From 667b48285d14dc16a7d15165cf3dde20dc90a3a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 18:43:03 +0200
+Subject: docs: kernel-doc: avoid script crash on ancient Python
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fc973dcd73f242480c61eccb1aa7306adafd2907 ]
+
+While we do need at least 3.6 for kernel-doc to work, and at least
+3.7 for it to output functions and structs with parameters at the
+right order, let the python binary be compatible with legacy
+versions.
+
+The rationale is that the Kernel build nowadays calls kernel-doc
+with -none on some places. Better not to bail out when older
+versions are found.
+
+With that, potentially this will run with python 2.7 and 3.2+,
+according with vermin:
+
+	$ vermin --no-tips -v ./scripts/kernel-doc
+	Detecting python files..
+	Analyzing using 24 processes..
+	2.7, 3.2     /new_devel/v4l/docs/scripts/kernel-doc
+	Minimum required versions: 2.7, 3.2
+
+3.2 minimal requirement is due to argparse.
+
+The minimal version I could check was version 3.4
+(using anaconda). Anaconda doesn't support 3.2 or 3.3
+anymore, and 3.2 doesn't even compile (I tested compiling
+Python 3.2 on Fedora 42 and on Fedora 32 - no show).
+
+With 3.4, the script didn't crash and emitted the right warning:
+
+	$ conda create -n py34 python=3.4
+	$ conda activate py34
+	python --version
+        Python 3.4.5
+        $ python ./scripts/kernel-doc --none include/media
+	Error: Python 3.6 or later is required by kernel-doc
+	$ conda deactivate
+
+	$ python --version
+	Python 3.13.5
+        $ python ./scripts/kernel-doc --none include/media
+	(no warnings and script ran properly)
+
+Supporting 2.7 is out of scope, as it is EOL for 5 years, and
+changing shebang to point to "python" instead of "python3"
+would have a wider impact.
+
+I did some extra checks about the differences from 3.2 and
+3.4, and didn't find anything that would cause troubles:
+
+	grep -rE "yield from|asyncio|pathlib|async|await|enum" scripts/kernel-doc
+
+Also, it doesn't use "@" operator. So, I'm confident that it
+should run (producing the exit warning) since Python 3.2.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Link: https://lore.kernel.org/r/87d55e76b0b1391cb7a83e3e965dbddb83fa9786.1753806485.git.mchehab+huawei@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kernel-doc.py | 34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/scripts/kernel-doc.py b/scripts/kernel-doc.py
+index fc3d46ef519f8..d9fe2bcbd39cc 100755
+--- a/scripts/kernel-doc.py
++++ b/scripts/kernel-doc.py
+@@ -2,8 +2,17 @@
+ # SPDX-License-Identifier: GPL-2.0
+ # Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+ #
+-# pylint: disable=C0103,R0915
+-#
++# pylint: disable=C0103,R0912,R0914,R0915
++
++# NOTE: While kernel-doc requires at least version 3.6 to run, the
++#       command line should work with Python 3.2+ (tested with 3.4).
++#       The rationale is that it shall fail gracefully during Kernel
++#       compilation with older Kernel versions. Due to that:
++#       - encoding line is needed here;
++#       - no f-strings can be used on this file.
++#       - the libraries that require newer versions can only be included
++#         after Python version is checked.
++
+ # Converted from the kernel-doc script originally written in Perl
+ # under GPLv2, copyrighted since 1998 by the following authors:
+ #
+@@ -107,9 +116,6 @@ SRC_DIR = os.path.dirname(os.path.realpath(__file__))
+ 
+ sys.path.insert(0, os.path.join(SRC_DIR, LIB_DIR))
+ 
+-from kdoc_files import KernelFiles                      # pylint: disable=C0413
+-from kdoc_output import RestFormat, ManFormat           # pylint: disable=C0413
+-
+ DESC = """
+ Read C language source or header FILEs, extract embedded documentation comments,
+ and print formatted documentation to standard output.
+@@ -273,14 +279,22 @@ def main():
+ 
+     python_ver = sys.version_info[:2]
+     if python_ver < (3,6):
+-        logger.warning("Python 3.6 or later is required by kernel-doc")
++        # Depending on Kernel configuration, kernel-doc --none is called at
++        # build time. As we don't want to break compilation due to the
++        # usage of an old Python version, return 0 here.
++        if args.none:
++            logger.error("Python 3.6 or later is required by kernel-doc. skipping checks")
++            sys.exit(0)
+ 
+-        # Return 0 here to avoid breaking compilation
+-        sys.exit(0)
++        sys.exit("Python 3.6 or later is required by kernel-doc. Aborting.")
+ 
+     if python_ver < (3,7):
+         logger.warning("Python 3.7 or later is required for correct results")
+ 
++    # Import kernel-doc libraries only after checking Python version
++    from kdoc_files import KernelFiles                  # pylint: disable=C0415
++    from kdoc_output import RestFormat, ManFormat       # pylint: disable=C0415
++
+     if args.man:
+         out_style = ManFormat(modulename=args.modulename)
+     elif args.none:
+@@ -308,11 +322,11 @@ def main():
+         sys.exit(0)
+ 
+     if args.werror:
+-        print(f"{error_count} warnings as errors")
++        print("%s warnings as errors" % error_count)    # pylint: disable=C0209
+         sys.exit(error_count)
+ 
+     if args.verbose:
+-        print(f"{error_count} errors")
++        print("%s errors" % error_count)                # pylint: disable=C0209
+ 
+     if args.none:
+         sys.exit(0)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-add-more-cyan-skillfish-pci-ids.patch b/queue-6.17/drm-amd-add-more-cyan-skillfish-pci-ids.patch
new file mode 100644
index 0000000000..c4a259f8f2
--- /dev/null
+++ b/queue-6.17/drm-amd-add-more-cyan-skillfish-pci-ids.patch
@@ -0,0 +1,36 @@
+From 8173add02d3b23ca90d204151a9f353c8502bb84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:09:06 -0400
+Subject: drm/amd: add more cyan skillfish PCI ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
+
+Add additional PCI IDs to the cyan skillfish family.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 5e81ff3ffdc3f..e60043ac9841e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2172,6 +2172,11 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
+ 
+ 	/* CYAN_SKILLFISH */
++	{0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch b/queue-6.17/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
new file mode 100644
index 0000000000..f0f7ed785f
--- /dev/null
+++ b/queue-6.17/drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
@@ -0,0 +1,147 @@
+From d56d7cb6a6d14cc4aea14c220a4a398269e72a92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 May 2025 13:44:24 +0800
+Subject: drm/amd/amdgpu: Release xcp drm memory after unplug
+
+From: Meng Li <li.meng@amd.com>
+
+[ Upstream commit e6c2b0f23221ed43c4cc6f636e9ab7862954d562 ]
+
+Add a new API amdgpu_xcp_drm_dev_free().
+After unplug xcp device, need to release xcp drm memory etc.
+
+Co-developed-by: Jiang Liu <gerry@linux.alibaba.com>
+Signed-off-by: Jiang Liu <gerry@linux.alibaba.com>
+Signed-off-by: Meng Li <li.meng@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c     |  1 +
+ drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c | 56 +++++++++++++++++----
+ drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h |  1 +
+ 3 files changed, 49 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+index c417f86892207..699acc1b46b59 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xcp.c
+@@ -406,6 +406,7 @@ void amdgpu_xcp_dev_unplug(struct amdgpu_device *adev)
+ 		p_ddev->primary->dev = adev->xcp_mgr->xcp[i].pdev;
+ 		p_ddev->driver =  adev->xcp_mgr->xcp[i].driver;
+ 		p_ddev->vma_offset_manager = adev->xcp_mgr->xcp[i].vma_offset_manager;
++		amdgpu_xcp_drm_dev_free(p_ddev);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
+index 8bc36f04b1b71..44009aa8216ed 100644
+--- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
++++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.c
+@@ -46,18 +46,29 @@ static const struct drm_driver amdgpu_xcp_driver = {
+ 
+ static int8_t pdev_num;
+ static struct xcp_device *xcp_dev[MAX_XCP_PLATFORM_DEVICE];
++static DEFINE_MUTEX(xcp_mutex);
+ 
+ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ {
+ 	struct platform_device *pdev;
+ 	struct xcp_device *pxcp_dev;
+ 	char dev_name[20];
+-	int ret;
++	int ret, i;
++
++	guard(mutex)(&xcp_mutex);
+ 
+ 	if (pdev_num >= MAX_XCP_PLATFORM_DEVICE)
+ 		return -ENODEV;
+ 
+-	snprintf(dev_name, sizeof(dev_name), "amdgpu_xcp_%d", pdev_num);
++	for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		if (!xcp_dev[i])
++			break;
++	}
++
++	if (i >= MAX_XCP_PLATFORM_DEVICE)
++		return -ENODEV;
++
++	snprintf(dev_name, sizeof(dev_name), "amdgpu_xcp_%d", i);
+ 	pdev = platform_device_register_simple(dev_name, -1, NULL, 0);
+ 	if (IS_ERR(pdev))
+ 		return PTR_ERR(pdev);
+@@ -73,8 +84,8 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ 		goto out_devres;
+ 	}
+ 
+-	xcp_dev[pdev_num] = pxcp_dev;
+-	xcp_dev[pdev_num]->pdev = pdev;
++	xcp_dev[i] = pxcp_dev;
++	xcp_dev[i]->pdev = pdev;
+ 	*ddev = &pxcp_dev->drm;
+ 	pdev_num++;
+ 
+@@ -89,16 +100,43 @@ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev)
+ }
+ EXPORT_SYMBOL(amdgpu_xcp_drm_dev_alloc);
+ 
+-void amdgpu_xcp_drv_release(void)
++static void free_xcp_dev(int8_t index)
+ {
+-	for (--pdev_num; pdev_num >= 0; --pdev_num) {
+-		struct platform_device *pdev = xcp_dev[pdev_num]->pdev;
++	if ((index < MAX_XCP_PLATFORM_DEVICE) && (xcp_dev[index])) {
++		struct platform_device *pdev = xcp_dev[index]->pdev;
+ 
+ 		devres_release_group(&pdev->dev, NULL);
+ 		platform_device_unregister(pdev);
+-		xcp_dev[pdev_num] = NULL;
++
++		xcp_dev[index] = NULL;
++		pdev_num--;
++	}
++}
++
++void amdgpu_xcp_drm_dev_free(struct drm_device *ddev)
++{
++	int8_t i;
++
++	guard(mutex)(&xcp_mutex);
++
++	for (i = 0; i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		if ((xcp_dev[i]) && (&xcp_dev[i]->drm == ddev)) {
++			free_xcp_dev(i);
++			break;
++		}
++	}
++}
++EXPORT_SYMBOL(amdgpu_xcp_drm_dev_free);
++
++void amdgpu_xcp_drv_release(void)
++{
++	int8_t i;
++
++	guard(mutex)(&xcp_mutex);
++
++	for (i = 0; pdev_num && i < MAX_XCP_PLATFORM_DEVICE; i++) {
++		free_xcp_dev(i);
+ 	}
+-	pdev_num = 0;
+ }
+ EXPORT_SYMBOL(amdgpu_xcp_drv_release);
+ 
+diff --git a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
+index c1c4b679bf95c..580a1602c8e36 100644
+--- a/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
++++ b/drivers/gpu/drm/amd/amdxcp/amdgpu_xcp_drv.h
+@@ -25,5 +25,6 @@
+ #define _AMDGPU_XCP_DRV_H_
+ 
+ int amdgpu_xcp_drm_dev_alloc(struct drm_device **ddev);
++void amdgpu_xcp_drm_dev_free(struct drm_device *ddev);
+ void amdgpu_xcp_drv_release(void);
+ #endif /* _AMDGPU_XCP_DRV_H_ */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-avoid-evicting-resources-at-s5.patch b/queue-6.17/drm-amd-avoid-evicting-resources-at-s5.patch
new file mode 100644
index 0000000000..c71fa61bd3
--- /dev/null
+++ b/queue-6.17/drm-amd-avoid-evicting-resources-at-s5.patch
@@ -0,0 +1,48 @@
+From 0df6ddf7bd3c7098b506e143974257edb52bbd6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 12:00:06 -0500
+Subject: drm/amd: Avoid evicting resources at S5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
+
+Normally resources are evicted on dGPUs at suspend or hibernate and
+on APUs at hibernate.  These steps are unnecessary when using the S4
+callbacks to put the system into S5.
+
+Cc: AceLan Kao <acelan.kao@canonical.com>
+Cc: Kai-Heng Feng <kaihengf@nvidia.com>
+Cc: Mark Pearson <mpearson-lenovo@squebb.ca>
+Cc: Denis Benato <benato.denis96@gmail.com>
+Cc: Merthan Karakaş <m3rthn.k@gmail.com>
+Tested-by: Eric Naim <dnaim@cachyos.org>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 56a737df87cc7..1115af343e013 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -5016,6 +5016,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
+ 	if (!adev->in_s4 && (adev->flags & AMD_IS_APU))
+ 		return 0;
+ 
++	/* No need to evict when going to S5 through S4 callbacks */
++	if (system_state == SYSTEM_POWER_OFF)
++		return 0;
++
+ 	ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM);
+ 	if (ret) {
+ 		dev_warn(adev->dev, "evicting device resources failed\n");
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch b/queue-6.17/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
new file mode 100644
index 0000000000..9d39864a34
--- /dev/null
+++ b/queue-6.17/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
@@ -0,0 +1,105 @@
+From e1a9b17580a709abc6013369f5fe0d4e3644ee79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:16:27 +0200
+Subject: drm/amd/display: Add AVI infoframe copy in
+ copy_stream_update_to_stream
+
+From: Karthi Kandasamy <karthi.kandasamy@amd.com>
+
+[ Upstream commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 ]
+
+[WHY]
+Ensure AVI infoframe updates from stream updates are applied to the active
+stream so OS overrides are not lost.
+
+[HOW]
+Copy avi_infopacket to stream when valid flag is set.
+Follow existing infopacket copy pattern and perform a basic validity check before assignment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Karthi Kandasamy <karthi.kandasamy@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c          | 7 ++++++-
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 ++++++
+ drivers/gpu/drm/amd/display/dc/dc_stream.h        | 3 +++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 74efd50b7c23a..77a842cf84e08 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3307,6 +3307,9 @@ static void copy_stream_update_to_stream(struct dc *dc,
+ 	if (update->adaptive_sync_infopacket)
+ 		stream->adaptive_sync_infopacket = *update->adaptive_sync_infopacket;
+ 
++	if (update->avi_infopacket)
++		stream->avi_infopacket = *update->avi_infopacket;
++
+ 	if (update->dither_option)
+ 		stream->dither_option = *update->dither_option;
+ 
+@@ -3601,7 +3604,8 @@ static void commit_planes_do_stream_update(struct dc *dc,
+ 					stream_update->vsp_infopacket ||
+ 					stream_update->hfvsif_infopacket ||
+ 					stream_update->adaptive_sync_infopacket ||
+-					stream_update->vtem_infopacket) {
++					stream_update->vtem_infopacket ||
++					stream_update->avi_infopacket) {
+ 				resource_build_info_frame(pipe_ctx);
+ 				dc->hwss.update_info_frame(pipe_ctx);
+ 
+@@ -5073,6 +5077,7 @@ static bool full_update_required(struct dc *dc,
+ 			stream_update->hfvsif_infopacket ||
+ 			stream_update->vtem_infopacket ||
+ 			stream_update->adaptive_sync_infopacket ||
++			stream_update->avi_infopacket ||
+ 			stream_update->dpms_off ||
+ 			stream_update->allow_freesync ||
+ 			stream_update->vrr_active_variable ||
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index d712548b1927d..d37fc14e27dbf 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -4417,8 +4417,14 @@ static void set_avi_info_frame(
+ 	unsigned int fr_ind = pipe_ctx->stream->timing.fr_index;
+ 	enum dc_timing_3d_format format;
+ 
++	if (stream->avi_infopacket.valid) {
++		*info_packet = stream->avi_infopacket;
++		return;
++	}
++
+ 	memset(&hdmi_info, 0, sizeof(union hdmi_info_packet));
+ 
++
+ 	color_space = pipe_ctx->stream->output_color_space;
+ 	if (color_space == COLOR_SPACE_UNKNOWN)
+ 		color_space = (stream->timing.pixel_encoding == PIXEL_ENCODING_RGB) ?
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+index 5fc6fea211de3..76cf9fdedab0e 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+@@ -203,6 +203,7 @@ struct dc_stream_state {
+ 	struct dc_info_packet hfvsif_infopacket;
+ 	struct dc_info_packet vtem_infopacket;
+ 	struct dc_info_packet adaptive_sync_infopacket;
++	struct dc_info_packet avi_infopacket;
+ 	uint8_t dsc_packed_pps[128];
+ 	struct rect src; /* composition area */
+ 	struct rect dst; /* stream addressable area */
+@@ -335,6 +336,8 @@ struct dc_stream_update {
+ 	struct dc_info_packet *hfvsif_infopacket;
+ 	struct dc_info_packet *vtem_infopacket;
+ 	struct dc_info_packet *adaptive_sync_infopacket;
++	struct dc_info_packet *avi_infopacket;
++
+ 	bool *dpms_off;
+ 	bool integer_scaling_update;
+ 	bool *allow_freesync;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-add-fallback-path-for-ycbcr422.patch b/queue-6.17/drm-amd-display-add-fallback-path-for-ycbcr422.patch
new file mode 100644
index 0000000000..b3c26b11d4
--- /dev/null
+++ b/queue-6.17/drm-amd-display-add-fallback-path-for-ycbcr422.patch
@@ -0,0 +1,121 @@
+From 7f1bb9a9496583e6e1b9978f5754c81d6677c2a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 12:17:19 -0500
+Subject: drm/amd/display: Add fallback path for YCBCR422
+
+From: Mario Limonciello <Mario.Limonciello@amd.com>
+
+[ Upstream commit db291ed1732e02e79dca431838713bbf602bda1c ]
+
+[Why]
+DP validation may fail with multiple displays and higher color depths.
+The sink may support others though.
+
+[How]
+When DP bandwidth validation fails, progressively fallback through:
+- YUV422 8bpc (bandwidth efficient)
+- YUV422 6bpc (reduced color depth)
+- YUV420 (last resort)
+
+This resolves cases where displays would show no image due to insufficient
+DP link bandwidth for the requested RGB mode.
+
+Suggested-by: Mauri Carvalho <mcarvalho3@lenovo.com>
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Mario Limonciello <Mario.Limonciello@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 45 +++++++++++++++----
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h |  1 +
+ 2 files changed, 37 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 60eb2c2c79b77..e3e9faa4aaeb7 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6405,7 +6405,8 @@ static void fill_stream_properties_from_drm_display_mode(
+ 			&& aconnector->force_yuv420_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR422)
+-			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
++			&& aconnector
++			&& aconnector->force_yuv422_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR422;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444)
+ 			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+@@ -7665,6 +7666,7 @@ create_validate_stream_for_sink(struct drm_connector *connector,
+ 		bpc_limit = 8;
+ 
+ 	do {
++		drm_dbg_kms(connector->dev, "Trying with %d bpc\n", requested_bpc);
+ 		stream = create_stream_for_sink(connector, drm_mode,
+ 						dm_state, old_stream,
+ 						requested_bpc);
+@@ -7700,16 +7702,41 @@ create_validate_stream_for_sink(struct drm_connector *connector,
+ 
+ 	} while (stream == NULL && requested_bpc >= bpc_limit);
+ 
+-	if ((dc_result == DC_FAIL_ENC_VALIDATE ||
+-	     dc_result == DC_EXCEED_DONGLE_CAP) &&
+-	     !aconnector->force_yuv420_output) {
+-		DRM_DEBUG_KMS("%s:%d Retry forcing yuv420 encoding\n",
+-				     __func__, __LINE__);
+-
+-		aconnector->force_yuv420_output = true;
++	switch (dc_result) {
++	/*
++	 * If we failed to validate DP bandwidth stream with the requested RGB color depth,
++	 * we try to fallback and configure in order:
++	 * YUV422 (8bpc, 6bpc)
++	 * YUV420 (8bpc, 6bpc)
++	 */
++	case DC_FAIL_ENC_VALIDATE:
++	case DC_EXCEED_DONGLE_CAP:
++	case DC_NO_DP_LINK_BANDWIDTH:
++		/* recursively entered twice and already tried both YUV422 and YUV420 */
++		if (aconnector->force_yuv422_output && aconnector->force_yuv420_output)
++			break;
++		/* first failure; try YUV422 */
++		if (!aconnector->force_yuv422_output) {
++			drm_dbg_kms(connector->dev, "%s:%d Validation failed with %d, retrying w/ YUV422\n",
++				    __func__, __LINE__, dc_result);
++			aconnector->force_yuv422_output = true;
++		/* recursively entered and YUV422 failed, try YUV420 */
++		} else if (!aconnector->force_yuv420_output) {
++			drm_dbg_kms(connector->dev, "%s:%d Validation failed with %d, retrying w/ YUV420\n",
++				    __func__, __LINE__, dc_result);
++			aconnector->force_yuv420_output = true;
++		}
+ 		stream = create_validate_stream_for_sink(connector, drm_mode,
+-						dm_state, old_stream);
++							 dm_state, old_stream);
++		aconnector->force_yuv422_output = false;
+ 		aconnector->force_yuv420_output = false;
++		break;
++	case DC_OK:
++		break;
++	default:
++		drm_dbg_kms(connector->dev, "%s:%d Unhandled validation failure %d\n",
++			    __func__, __LINE__, dc_result);
++		break;
+ 	}
+ 
+ 	return stream;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index 42801caf57b69..bb0ed81bcacdf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -790,6 +790,7 @@ struct amdgpu_dm_connector {
+ 
+ 	bool fake_enable;
+ 	bool force_yuv420_output;
++	bool force_yuv422_output;
+ 	struct dsc_preferred_settings dsc_settings;
+ 	union dp_downstream_port_present mst_downstream_port_present;
+ 	/* Cached display modes */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-add-fast-sync-field-in-ultra-sleep-m.patch b/queue-6.17/drm-amd-display-add-fast-sync-field-in-ultra-sleep-m.patch
new file mode 100644
index 0000000000..4a9d6dc3e2
--- /dev/null
+++ b/queue-6.17/drm-amd-display-add-fast-sync-field-in-ultra-sleep-m.patch
@@ -0,0 +1,64 @@
+From 1f1bfd1d54c75e2aa2f9849f77778bb6974a886e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 16:58:38 +0800
+Subject: drm/amd/display: Add fast sync field in ultra sleep more for DMUB
+
+From: Allen Li <wei-guang.li@amd.com>
+
+[ Upstream commit b65cf4baeb24bdb5fee747679ee88f1ade5c1d6c ]
+
+[Why&How]
+We need to inform DMUB whether fast sync in ultra sleep mode is supported,
+so that it can disable desync error detection when the it is not enabled.
+This helps prevent unexpected desync errors when transitioning out of
+ultra sleep mode.
+
+Add fast sync in ultra sleep mode field in replay copy setting command.
+
+Reviewed-by: Robin Chen <robin.chen@amd.com>
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Allen Li <wei-guang.li@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c | 1 +
+ drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h  | 6 +++++-
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
+index fcd3d86ad5173..727ce832b5bb8 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
++++ b/drivers/gpu/drm/amd/display/dc/dce/dmub_replay.c
+@@ -168,6 +168,7 @@ static bool dmub_replay_copy_settings(struct dmub_replay *dmub,
+ 	copy_settings_data->max_deviation_line			= link->dpcd_caps.pr_info.max_deviation_line;
+ 	copy_settings_data->smu_optimizations_en		= link->replay_settings.replay_smu_opt_enable;
+ 	copy_settings_data->replay_timing_sync_supported = link->replay_settings.config.replay_timing_sync_supported;
++	copy_settings_data->replay_support_fast_resync_in_ultra_sleep_mode = link->replay_settings.config.replay_support_fast_resync_in_ultra_sleep_mode;
+ 
+ 	copy_settings_data->debug.bitfields.enable_ips_visual_confirm = dc->dc->debug.enable_ips_visual_confirm;
+ 
+diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+index 6fa25b0375858..5c9deb41ac7e6 100644
+--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
++++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+@@ -4104,10 +4104,14 @@ struct dmub_cmd_replay_copy_settings_data {
+ 	 * @hpo_link_enc_inst: HPO link encoder instance
+ 	 */
+ 	uint8_t hpo_link_enc_inst;
++	/**
++	 * Determines if fast sync in ultra sleep mode is enabled/disabled.
++	 */
++	uint8_t replay_support_fast_resync_in_ultra_sleep_mode;
+ 	/**
+ 	 * @pad: Align structure to 4 byte boundary.
+ 	 */
+-	uint8_t pad[2];
++	uint8_t pad[1];
+ };
+ 
+ /**
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-add-missing-post-flip-calls.patch b/queue-6.17/drm-amd-display-add-missing-post-flip-calls.patch
new file mode 100644
index 0000000000..edb3f7e7af
--- /dev/null
+++ b/queue-6.17/drm-amd-display-add-missing-post-flip-calls.patch
@@ -0,0 +1,70 @@
+From 54c90251f2e5c7038189fc38c2c4392bf87ecd72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:35:37 -0400
+Subject: drm/amd/display: Add missing post flip calls
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit 54980f3c63ed3e5cca3d251416581193c90eae76 ]
+
+[WHY&HOW]
+dc_post_update_surfaces_to_stream needs to be called after a full update
+completes in order to optimize clocks and watermarks for power. Add
+missing calls before idle entry is requested to ensure optimal power.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c      | 3 +--
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 8 ++++++--
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 57b46572fba27..d66c9609efd8d 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -427,8 +427,7 @@ static inline bool update_planes_and_stream_adapter(struct dc *dc,
+ 	/*
+ 	 * Previous frame finished and HW is ready for optimization.
+ 	 */
+-	if (update_type == UPDATE_TYPE_FAST)
+-		dc_post_update_surfaces_to_stream(dc);
++	dc_post_update_surfaces_to_stream(dc);
+ 
+ 	return dc_update_planes_and_stream(dc,
+ 					   array_of_surface_update,
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+index 2047ac51f1b66..2e7ee77c010e1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -218,8 +218,10 @@ static void amdgpu_dm_idle_worker(struct work_struct *work)
+ 			break;
+ 		}
+ 
+-		if (idle_work->enable)
++		if (idle_work->enable) {
++			dc_post_update_surfaces_to_stream(idle_work->dm->dc);
+ 			dc_allow_idle_optimizations(idle_work->dm->dc, true);
++		}
+ 		mutex_unlock(&idle_work->dm->dc_lock);
+ 	}
+ 	idle_work->dm->idle_workqueue->running = false;
+@@ -273,8 +275,10 @@ static void amdgpu_dm_crtc_vblank_control_worker(struct work_struct *work)
+ 			vblank_work->acrtc->dm_irq_params.allow_sr_entry);
+ 	}
+ 
+-	if (dm->active_vblank_irq_count == 0)
++	if (dm->active_vblank_irq_count == 0) {
++		dc_post_update_surfaces_to_stream(dm->dc);
+ 		dc_allow_idle_optimizations(dm->dc, true);
++	}
+ 
+ 	mutex_unlock(&dm->dc_lock);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-add-more-cyan-skillfish-devices.patch b/queue-6.17/drm-amd-display-add-more-cyan-skillfish-devices.patch
new file mode 100644
index 0000000000..fff3c10e88
--- /dev/null
+++ b/queue-6.17/drm-amd-display-add-more-cyan-skillfish-devices.patch
@@ -0,0 +1,58 @@
+From 662d0b1aba7328f85fa47d87107d61918e187660 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:10:31 -0400
+Subject: drm/amd/display: add more cyan skillfish devices
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
+
+Add PCI IDs to support display probe for cyan skillfish
+family of SOCs.
+
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
+ drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 4d6181e7c612b..d712548b1927d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -165,7 +165,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)
+ 
+ 	case FAMILY_NV:
+ 		dc_version = DCN_VERSION_2_0;
+-		if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) {
++		if (asic_id.chip_id == DEVICE_ID_NV_13FE ||
++		    asic_id.chip_id == DEVICE_ID_NV_143F ||
++		    asic_id.chip_id == DEVICE_ID_NV_13F9 ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FA ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FB ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FC ||
++		    asic_id.chip_id == DEVICE_ID_NV_13DB) {
+ 			dc_version = DCN_VERSION_2_01;
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+index 5fc29164e4b45..8aea50aa95330 100644
+--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+@@ -213,6 +213,11 @@ enum {
+ #endif
+ #define DEVICE_ID_NV_13FE 0x13FE  // CYAN_SKILLFISH
+ #define DEVICE_ID_NV_143F 0x143F
++#define DEVICE_ID_NV_13F9 0x13F9
++#define DEVICE_ID_NV_13FA 0x13FA
++#define DEVICE_ID_NV_13FB 0x13FB
++#define DEVICE_ID_NV_13FC 0x13FC
++#define DEVICE_ID_NV_13DB 0x13DB
+ #define FAMILY_VGH 144
+ #define DEVICE_ID_VGH_163F 0x163F
+ #define DEVICE_ID_VGH_1435 0x1435
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-cache-streams-targeting-link-when-pe.patch b/queue-6.17/drm-amd-display-cache-streams-targeting-link-when-pe.patch
new file mode 100644
index 0000000000..d7ca6a65d8
--- /dev/null
+++ b/queue-6.17/drm-amd-display-cache-streams-targeting-link-when-pe.patch
@@ -0,0 +1,69 @@
+From e4a63e290e405125735bfec72d3511db01a1d8fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 16:18:58 -0400
+Subject: drm/amd/display: Cache streams targeting link when performing LT
+ automation
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit f5b69101f956f5b89605a13cb15f093a7906f2a1 ]
+
+[WHY]
+Last LT automation update can cause crash by referencing current_state and
+calling into dc_update_planes_and_stream which may clobber current_state.
+
+[HOW]
+Cache relevant stream pointers and iterate through them instead of relying
+on the current_state.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/link/accessories/link_dp_cts.c  | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+index b12d61701d4d9..23f41c99fa38c 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
++++ b/drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c
+@@ -76,6 +76,9 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
+ 	uint8_t count;
+ 	int i;
+ 
++	struct dc_stream_state *streams_on_link[MAX_PIPES];
++	int num_streams_on_link = 0;
++
+ 	needs_divider_update = (link->dc->link_srv->dp_get_encoding_format(link_setting) !=
+ 	link->dc->link_srv->dp_get_encoding_format((const struct dc_link_settings *) &link->cur_link_settings));
+ 
+@@ -138,12 +141,19 @@ static void dp_retrain_link_dp_test(struct dc_link *link,
+ 		pipes[i]->stream_res.tg->funcs->enable_crtc(pipes[i]->stream_res.tg);
+ 
+ 	// Set DPMS on with stream update
+-	for (i = 0; i < state->stream_count; i++)
+-		if (state->streams[i] && state->streams[i]->link && state->streams[i]->link == link) {
+-			stream_update.stream = state->streams[i];
++	// Cache all streams on current link since dc_update_planes_and_stream might kill current_state
++	for (i = 0; i < MAX_PIPES; i++) {
++		if (state->streams[i] && state->streams[i]->link && state->streams[i]->link == link)
++			streams_on_link[num_streams_on_link++] = state->streams[i];
++	}
++
++	for (i = 0; i < num_streams_on_link; i++) {
++		if (streams_on_link[i] && streams_on_link[i]->link && streams_on_link[i]->link == link) {
++			stream_update.stream = streams_on_link[i];
+ 			stream_update.dpms_off = &dpms_off;
+-			dc_update_planes_and_stream(state->clk_mgr->ctx->dc, NULL, 0, state->streams[i], &stream_update);
++			dc_update_planes_and_stream(state->clk_mgr->ctx->dc, NULL, 0, streams_on_link[i], &stream_update);
+ 		}
++	}
+ }
+ 
+ static void dp_test_send_link_training(struct dc_link *link)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-change-dc-stream-color-settings-only.patch b/queue-6.17/drm-amd-display-change-dc-stream-color-settings-only.patch
new file mode 100644
index 0000000000..1cc312da0e
--- /dev/null
+++ b/queue-6.17/drm-amd-display-change-dc-stream-color-settings-only.patch
@@ -0,0 +1,218 @@
+From 87fe0b67d6d8340123e563e7156fbdf070a2954d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 14:21:20 -0300
+Subject: drm/amd/display: change dc stream color settings only in atomic
+ commit
+
+From: Melissa Wen <mwen@igalia.com>
+
+[ Upstream commit 51cb93aa0c4a9bb126b76f6e9fd640d88de25cee ]
+
+Don't update DC stream color components during atomic check. The driver
+will continue validating the new CRTC color state but will not change DC
+stream color components. The DC stream color state will only be
+programmed at commit time in the `atomic_setup_commit` stage.
+
+It fixes gamma LUT loss reported by KDE users when changing brightness
+quickly or changing Display settings (such as overscan) with nightlight
+on and HDR. As KWin can do a test commit with color settings different
+from those that should be applied in a non-test-only commit, if the
+driver changes DC stream color state in atomic check, this state can be
+eventually HW programmed in commit tail, instead of the respective state
+set by the non-blocking commit.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4444
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |  2 +-
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h |  2 +
+ .../amd/display/amdgpu_dm/amdgpu_dm_color.c   | 86 ++++++++++++++-----
+ 3 files changed, 66 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index d66c9609efd8d..60eb2c2c79b77 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -11105,7 +11105,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	if (dm_new_crtc_state->base.color_mgmt_changed ||
+ 	    dm_old_crtc_state->regamma_tf != dm_new_crtc_state->regamma_tf ||
+ 	    drm_atomic_crtc_needs_modeset(new_crtc_state)) {
+-		ret = amdgpu_dm_update_crtc_color_mgmt(dm_new_crtc_state);
++		ret = amdgpu_dm_check_crtc_color_mgmt(dm_new_crtc_state, true);
+ 		if (ret)
+ 			goto fail;
+ 	}
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index c18a6b43c76f6..42801caf57b69 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -1037,6 +1037,8 @@ void amdgpu_dm_init_color_mod(void);
+ int amdgpu_dm_create_color_properties(struct amdgpu_device *adev);
+ int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state);
+ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc);
++int amdgpu_dm_check_crtc_color_mgmt(struct dm_crtc_state *crtc,
++				    bool check_only);
+ int amdgpu_dm_update_plane_color_mgmt(struct dm_crtc_state *crtc,
+ 				      struct drm_plane_state *plane_state,
+ 				      struct dc_plane_state *dc_plane_state);
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+index c0dfe2d8b3bec..d4739b6334c24 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c
+@@ -566,12 +566,11 @@ static int __set_output_tf(struct dc_transfer_func *func,
+ 	return res ? 0 : -ENOMEM;
+ }
+ 
+-static int amdgpu_dm_set_atomic_regamma(struct dc_stream_state *stream,
++static int amdgpu_dm_set_atomic_regamma(struct dc_transfer_func *out_tf,
+ 					const struct drm_color_lut *regamma_lut,
+ 					uint32_t regamma_size, bool has_rom,
+ 					enum dc_transfer_func_predefined tf)
+ {
+-	struct dc_transfer_func *out_tf = &stream->out_transfer_func;
+ 	int ret = 0;
+ 
+ 	if (regamma_size || tf != TRANSFER_FUNCTION_LINEAR) {
+@@ -885,33 +884,33 @@ int amdgpu_dm_verify_lut_sizes(const struct drm_crtc_state *crtc_state)
+ }
+ 
+ /**
+- * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream.
++ * amdgpu_dm_check_crtc_color_mgmt: Check if DRM color props are programmable by DC.
+  * @crtc: amdgpu_dm crtc state
++ * @check_only: only check color state without update dc stream
+  *
+- * With no plane level color management properties we're free to use any
+- * of the HW blocks as long as the CRTC CTM always comes before the
+- * CRTC RGM and after the CRTC DGM.
+- *
+- * - The CRTC RGM block will be placed in the RGM LUT block if it is non-linear.
+- * - The CRTC DGM block will be placed in the DGM LUT block if it is non-linear.
+- * - The CRTC CTM will be placed in the gamut remap block if it is non-linear.
++ * This function just verifies CRTC LUT sizes, if there is enough space for
++ * output transfer function and if its parameters can be calculated by AMD
++ * color module. It also adjusts some settings for programming CRTC degamma at
++ * plane stage, using plane DGM block.
+  *
+  * The RGM block is typically more fully featured and accurate across
+  * all ASICs - DCE can't support a custom non-linear CRTC DGM.
+  *
+  * For supporting both plane level color management and CRTC level color
+- * management at once we have to either restrict the usage of CRTC properties
+- * or blend adjustments together.
++ * management at once we have to either restrict the usage of some CRTC
++ * properties or blend adjustments together.
+  *
+  * Returns:
+- * 0 on success. Error code if setup fails.
++ * 0 on success. Error code if validation fails.
+  */
+-int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
++
++int amdgpu_dm_check_crtc_color_mgmt(struct dm_crtc_state *crtc,
++				    bool check_only)
+ {
+ 	struct dc_stream_state *stream = crtc->stream;
+ 	struct amdgpu_device *adev = drm_to_adev(crtc->base.state->dev);
+ 	bool has_rom = adev->asic_type <= CHIP_RAVEN;
+-	struct drm_color_ctm *ctm = NULL;
++	struct dc_transfer_func *out_tf;
+ 	const struct drm_color_lut *degamma_lut, *regamma_lut;
+ 	uint32_t degamma_size, regamma_size;
+ 	bool has_regamma, has_degamma;
+@@ -940,6 +939,14 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 	crtc->cm_has_degamma = false;
+ 	crtc->cm_is_degamma_srgb = false;
+ 
++	if (check_only) {
++		out_tf = kvzalloc(sizeof(*out_tf), GFP_KERNEL);
++		if (!out_tf)
++			return -ENOMEM;
++	} else {
++		out_tf = &stream->out_transfer_func;
++	}
++
+ 	/* Setup regamma and degamma. */
+ 	if (is_legacy) {
+ 		/*
+@@ -954,8 +961,8 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 		 * inverse color ramp in legacy userspace.
+ 		 */
+ 		crtc->cm_is_degamma_srgb = true;
+-		stream->out_transfer_func.type = TF_TYPE_DISTRIBUTED_POINTS;
+-		stream->out_transfer_func.tf = TRANSFER_FUNCTION_SRGB;
++		out_tf->type = TF_TYPE_DISTRIBUTED_POINTS;
++		out_tf->tf = TRANSFER_FUNCTION_SRGB;
+ 		/*
+ 		 * Note: although we pass has_rom as parameter here, we never
+ 		 * actually use ROM because the color module only takes the ROM
+@@ -963,16 +970,12 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 		 *
+ 		 * See more in mod_color_calculate_regamma_params()
+ 		 */
+-		r = __set_legacy_tf(&stream->out_transfer_func, regamma_lut,
++		r = __set_legacy_tf(out_tf, regamma_lut,
+ 				    regamma_size, has_rom);
+-		if (r)
+-			return r;
+ 	} else {
+ 		regamma_size = has_regamma ? regamma_size : 0;
+-		r = amdgpu_dm_set_atomic_regamma(stream, regamma_lut,
++		r = amdgpu_dm_set_atomic_regamma(out_tf, regamma_lut,
+ 						 regamma_size, has_rom, tf);
+-		if (r)
+-			return r;
+ 	}
+ 
+ 	/*
+@@ -981,6 +984,43 @@ int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
+ 	 * have to place the CTM in the OCSC in that case.
+ 	 */
+ 	crtc->cm_has_degamma = has_degamma;
++	if (check_only)
++		kvfree(out_tf);
++
++	return r;
++}
++
++/**
++ * amdgpu_dm_update_crtc_color_mgmt: Maps DRM color management to DC stream.
++ * @crtc: amdgpu_dm crtc state
++ *
++ * With no plane level color management properties we're free to use any
++ * of the HW blocks as long as the CRTC CTM always comes before the
++ * CRTC RGM and after the CRTC DGM.
++ *
++ * - The CRTC RGM block will be placed in the RGM LUT block if it is non-linear.
++ * - The CRTC DGM block will be placed in the DGM LUT block if it is non-linear.
++ * - The CRTC CTM will be placed in the gamut remap block if it is non-linear.
++ *
++ * The RGM block is typically more fully featured and accurate across
++ * all ASICs - DCE can't support a custom non-linear CRTC DGM.
++ *
++ * For supporting both plane level color management and CRTC level color
++ * management at once we have to either restrict the usage of CRTC properties
++ * or blend adjustments together.
++ *
++ * Returns:
++ * 0 on success. Error code if setup fails.
++ */
++int amdgpu_dm_update_crtc_color_mgmt(struct dm_crtc_state *crtc)
++{
++	struct dc_stream_state *stream = crtc->stream;
++	struct drm_color_ctm *ctm = NULL;
++	int ret;
++
++	ret = amdgpu_dm_check_crtc_color_mgmt(crtc, false);
++	if (ret)
++		return ret;
+ 
+ 	/* Setup CRTC CTM. */
+ 	if (crtc->base.ctm) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-consider-sink-max-slice-width-limita.patch b/queue-6.17/drm-amd-display-consider-sink-max-slice-width-limita.patch
new file mode 100644
index 0000000000..3db8a3ddd4
--- /dev/null
+++ b/queue-6.17/drm-amd-display-consider-sink-max-slice-width-limita.patch
@@ -0,0 +1,44 @@
+From 4d5fc229b46853ad5275f89eb72d9cdcbf1f3dea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 12:01:15 -0400
+Subject: drm/amd/display: Consider sink max slice width limitation for dsc
+
+From: Dillon Varone <Dillon.Varone@amd.com>
+
+[ Upstream commit 6b34e7ed4ba583ee77032a4c850ff97ba16ad870 ]
+
+[WHY&HOW]
+The sink max slice width limitation should be considered for DSC, but
+was removed in "refactor DSC cap calculations".
+This patch adds it back and takes the valid minimum between the sink and
+source.
+
+Signed-off-by: Dillon Varone <Dillon.Varone@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c b/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
+index 1f53a9f0c0ac3..e4144b2443324 100644
+--- a/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
++++ b/drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c
+@@ -1157,6 +1157,11 @@ static bool setup_dsc_config(
+ 	if (!is_dsc_possible)
+ 		goto done;
+ 
++	/* increase miniumum slice count to meet sink slice width limitations */
++	min_slices_h = dc_fixpt_ceil(dc_fixpt_max(
++			dc_fixpt_div_int(dc_fixpt_from_int(pic_width), dsc_common_caps.max_slice_width), // sink min
++			dc_fixpt_from_int(min_slices_h))); // source min
++
+ 	min_slices_h = fit_num_slices_up(dsc_common_caps.slice_caps, min_slices_h);
+ 
+ 	/* increase minimum slice count to meet sink throughput limitations */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-disable-vrr-on-dce-6.patch b/queue-6.17/drm-amd-display-disable-vrr-on-dce-6.patch
new file mode 100644
index 0000000000..0b7f06738f
--- /dev/null
+++ b/queue-6.17/drm-amd-display-disable-vrr-on-dce-6.patch
@@ -0,0 +1,79 @@
+From 83a0782001611a98fb2b27cb2a4cecd43ffc1c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:30 +0200
+Subject: drm/amd/display: Disable VRR on DCE 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 043c87d7d56e135393f8aab927148096e2d17589 ]
+
+DCE 6 was not advertised as being able to support VRR,
+so let's mark it as unsupported for now.
+
+The VRR implementation in amdgpu_dm depends on the VUPDATE
+interrupt which is not registered for DCE 6.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ drivers/gpu/drm/amd/display/dc/dc_helper.c        | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dm_services.h      | 2 ++
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index f450bcb43c9c1..57b46572fba27 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10787,6 +10787,8 @@ static void get_freesync_config_for_crtc(
+ 		} else {
+ 			config.state = VRR_STATE_INACTIVE;
+ 		}
++	} else {
++		config.state = VRR_STATE_UNSUPPORTED;
+ 	}
+ out:
+ 	new_crtc_state->freesync_config = config;
+@@ -12688,7 +12690,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector,
+ 
+ 	dm_con_state = to_dm_connector_state(connector->state);
+ 
+-	if (!adev->dm.freesync_module)
++	if (!adev->dm.freesync_module || !dc_supports_vrr(sink->ctx->dce_version))
+ 		goto update;
+ 
+ 	edid = drm_edid_raw(drm_edid); // FIXME: Get rid of drm_edid_raw()
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+index 7217de2588511..4d2e5c89577d0 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_helper.c
++++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+@@ -755,3 +755,8 @@ char *dce_version_to_string(const int version)
+ 		return "Unknown";
+ 	}
+ }
++
++bool dc_supports_vrr(const enum dce_version v)
++{
++	return v >= DCE_VERSION_8_0;
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h
+index 7b9c22c45453d..7b398d4f44398 100644
+--- a/drivers/gpu/drm/amd/display/dc/dm_services.h
++++ b/drivers/gpu/drm/amd/display/dc/dm_services.h
+@@ -311,4 +311,6 @@ void dm_dtn_log_end(struct dc_context *ctx,
+ 
+ char *dce_version_to_string(const int version);
+ 
++bool dc_supports_vrr(const enum dce_version v);
++
+ #endif /* __DM_SERVICES_H__ */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch b/queue-6.17/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
new file mode 100644
index 0000000000..cbd1350e98
--- /dev/null
+++ b/queue-6.17/drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
@@ -0,0 +1,71 @@
+From 5de43f37c85b62231325fc586e7ff8bdf39876bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 16:52:11 +0800
+Subject: drm/amd/display/dml2: Guard dml21_map_dc_state_into_dml_display_cfg
+ with DC_FP_START
+
+From: Xi Ruoyao <xry111@xry111.site>
+
+[ Upstream commit c97a7dccb3ed680031011cfc1457506e6de49c9a ]
+
+dml21_map_dc_state_into_dml_display_cfg calls (the call is usually
+inlined by the compiler) populate_dml21_surface_config_from_plane_state
+and populate_dml21_plane_config_from_plane_state which may use FPU.  In
+a x86-64 build:
+
+    $ objdump --disassemble=dml21_map_dc_state_into_dml_display_cfg \
+    > drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.o |
+    > grep %xmm -c
+    63
+
+Thus it needs to be guarded with DC_FP_START.  But we must note that the
+current code quality of the in-kernel FPU use in AMD dml2 is very much
+problematic: we are actually calling DC_FP_START in dml21_wrapper.c
+here, and this translation unit is built with CC_FLAGS_FPU.  Strictly
+speaking this does not make any sense: with CC_FLAGS_FPU the compiler is
+allowed to generate FPU uses anywhere in the translated code, perhaps
+out of the DC_FP_START guard.  This problematic pattern also occurs in
+at least dml2_wrapper.c, dcn35_fpu.c, and dcn351_fpu.c.  Thus we really
+need a careful audit and refactor for the in-kernel FPU uses, and this
+patch is simply whacking a mole.  However per the reporter, whacking
+this mole is enough to make a 9060XT "just work."
+
+Reported-by: Asiacn <710187964@qq.com>
+Closes: https://github.com/loongson-community/discussions/issues/102
+Tested-by: Asiacn <710187964@qq.com>
+Signed-off-by: Xi Ruoyao <xry111@xry111.site>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
+index 03de3cf06ae59..059ede6ff2561 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_wrapper.c
+@@ -224,7 +224,9 @@ static bool dml21_mode_check_and_programming(const struct dc *in_dc, struct dc_s
+ 	dml_ctx->config.svp_pstate.callbacks.release_phantom_streams_and_planes(in_dc, context);
+ 
+ 	/* Populate stream, plane mappings and other fields in display config. */
++	DC_FP_START();
+ 	result = dml21_map_dc_state_into_dml_display_cfg(in_dc, context, dml_ctx);
++	DC_FP_END();
+ 	if (!result)
+ 		return false;
+ 
+@@ -279,7 +281,9 @@ static bool dml21_check_mode_support(const struct dc *in_dc, struct dc_state *co
+ 	dml_ctx->config.svp_pstate.callbacks.release_phantom_streams_and_planes(in_dc, context);
+ 
+ 	mode_support->dml2_instance = dml_init->dml2_instance;
++	DC_FP_START();
+ 	dml21_map_dc_state_into_dml_display_cfg(in_dc, context, dml_ctx);
++	DC_FP_END();
+ 	dml_ctx->v21.mode_programming.dml2_instance->scratch.build_mode_programming_locals.mode_programming_params.programming = dml_ctx->v21.mode_programming.programming;
+ 	DC_FP_START();
+ 	is_supported = dml2_check_mode_supported(mode_support);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-don-t-use-non-registered-vupdate-on-.patch b/queue-6.17/drm-amd-display-don-t-use-non-registered-vupdate-on-.patch
new file mode 100644
index 0000000000..1c9bde8abe
--- /dev/null
+++ b/queue-6.17/drm-amd-display-don-t-use-non-registered-vupdate-on-.patch
@@ -0,0 +1,92 @@
+From 4ffc8c5b062d557ebcc532c3eea43dc9306b24cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:31 +0200
+Subject: drm/amd/display: Don't use non-registered VUPDATE on DCE 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 6cbe6e072c5d088101cd542ad8ef8541edeea5c3 ]
+
+The VUPDATE interrupt isn't registered on DCE 6, so don't try
+to use that.
+
+This fixes a page flip timeout after sleep/resume on DCE 6.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 22 ++++++++++++-------
+ .../amd/display/amdgpu_dm/amdgpu_dm_crtc.c    | 16 +++++++++-----
+ 2 files changed, 24 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 3762b3c0ef983..f450bcb43c9c1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -3050,14 +3050,20 @@ static void dm_gpureset_toggle_interrupts(struct amdgpu_device *adev,
+ 				drm_warn(adev_to_drm(adev), "Failed to %s pflip interrupts\n",
+ 					 enable ? "enable" : "disable");
+ 
+-			if (enable) {
+-				if (amdgpu_dm_crtc_vrr_active(to_dm_crtc_state(acrtc->base.state)))
+-					rc = amdgpu_dm_crtc_set_vupdate_irq(&acrtc->base, true);
+-			} else
+-				rc = amdgpu_dm_crtc_set_vupdate_irq(&acrtc->base, false);
+-
+-			if (rc)
+-				drm_warn(adev_to_drm(adev), "Failed to %sable vupdate interrupt\n", enable ? "en" : "dis");
++			if (dc_supports_vrr(adev->dm.dc->ctx->dce_version)) {
++				if (enable) {
++					if (amdgpu_dm_crtc_vrr_active(
++							to_dm_crtc_state(acrtc->base.state)))
++						rc = amdgpu_dm_crtc_set_vupdate_irq(
++							&acrtc->base, true);
++				} else
++					rc = amdgpu_dm_crtc_set_vupdate_irq(
++							&acrtc->base, false);
++
++				if (rc)
++					drm_warn(adev_to_drm(adev), "Failed to %sable vupdate interrupt\n",
++						enable ? "en" : "dis");
++			}
+ 
+ 			irq_source = IRQ_TYPE_VBLANK + acrtc->otg_inst;
+ 			/* During gpu-reset we disable and then enable vblank irq, so
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+index 80205c9bc9403..2047ac51f1b66 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+@@ -321,13 +321,17 @@ static inline int amdgpu_dm_crtc_set_vblank(struct drm_crtc *crtc, bool enable)
+ 			dc->config.disable_ips != DMUB_IPS_DISABLE_ALL &&
+ 			sr_supported && vblank->config.disable_immediate)
+ 			drm_crtc_vblank_restore(crtc);
++	}
+ 
+-		/* vblank irq on -> Only need vupdate irq in vrr mode */
+-		if (amdgpu_dm_crtc_vrr_active(acrtc_state))
+-			rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, true);
+-	} else {
+-		/* vblank irq off -> vupdate irq off */
+-		rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, false);
++	if (dc_supports_vrr(dm->dc->ctx->dce_version)) {
++		if (enable) {
++			/* vblank irq on -> Only need vupdate irq in vrr mode */
++			if (amdgpu_dm_crtc_vrr_active(acrtc_state))
++				rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, true);
++		} else {
++			/* vblank irq off -> vupdate irq off */
++			rc = amdgpu_dm_crtc_set_vupdate_irq(crtc, false);
++		}
+ 	}
+ 
+ 	if (rc)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-dont-wait-for-pipe-update-during-med.patch b/queue-6.17/drm-amd-display-dont-wait-for-pipe-update-during-med.patch
new file mode 100644
index 0000000000..430e1d75d3
--- /dev/null
+++ b/queue-6.17/drm-amd-display-dont-wait-for-pipe-update-during-med.patch
@@ -0,0 +1,40 @@
+From 12d8dc0ef04e444505748ebd5c64a7f1cab82fc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 18:11:54 -0400
+Subject: drm/amd/display: dont wait for pipe update during medupdate/highirq
+
+From: Ausef Yousof <Ausef.Yousof@amd.com>
+
+[ Upstream commit 895b61395eefd28376250778a741f11e12715a39 ]
+
+[why&how]
+control flag for the wait during pipe update wait for vupdate should
+be set if update type is not fast or med to prevent an invalid sleep
+operation
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 2d2f4c4bdc97e..74efd50b7c23a 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -4163,7 +4163,7 @@ static void commit_planes_for_stream(struct dc *dc,
+ 	}
+ 
+ 	if (dc->hwseq->funcs.wait_for_pipe_update_if_needed)
+-		dc->hwseq->funcs.wait_for_pipe_update_if_needed(dc, top_pipe_to_program, update_type == UPDATE_TYPE_FAST);
++		dc->hwseq->funcs.wait_for_pipe_update_if_needed(dc, top_pipe_to_program, update_type < UPDATE_TYPE_FULL);
+ 
+ 	if (should_lock_all_pipes && dc->hwss.interdependent_update_lock) {
+ 		if (dc->hwss.subvp_pipe_control_lock)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-ensure-committing-streams-is-seamles.patch b/queue-6.17/drm-amd-display-ensure-committing-streams-is-seamles.patch
new file mode 100644
index 0000000000..f03d72994b
--- /dev/null
+++ b/queue-6.17/drm-amd-display-ensure-committing-streams-is-seamles.patch
@@ -0,0 +1,53 @@
+From d5647e4a45ee303aa6ae193342c2d2db2e46def4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 13:21:30 -0400
+Subject: drm/amd/display: ensure committing streams is seamless
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit ca74cc428f2b9d0170c56b473dbcfd7fa01daf2d ]
+
+[Why]
+When transitioning between topologies such as multi-display to single
+display ODM 2:1, pipes might not be freed before use.
+
+[How]
+In dc_commit_streams, commit an additional, minimal transition if
+original transition is not seamless to ensure pipes are freed.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index bb189f6773397..bc364792d9d31 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2413,6 +2413,18 @@ enum dc_status dc_commit_streams(struct dc *dc, struct dc_commit_streams_params
+ 		goto fail;
+ 	}
+ 
++	/*
++	 * If not already seamless, make transition seamless by inserting intermediate minimal transition
++	 */
++	if (dc->hwss.is_pipe_topology_transition_seamless &&
++			!dc->hwss.is_pipe_topology_transition_seamless(dc, dc->current_state, context)) {
++		res = commit_minimal_transition_state(dc, context);
++		if (res != DC_OK) {
++			BREAK_TO_DEBUGGER();
++			goto fail;
++		}
++	}
++
+ 	res = dc_commit_state_no_check(dc, context);
+ 
+ 	for (i = 0; i < params->stream_count; i++) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-condition-for-setting-timing_adj.patch b/queue-6.17/drm-amd-display-fix-condition-for-setting-timing_adj.patch
new file mode 100644
index 0000000000..05637f967e
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-condition-for-setting-timing_adj.patch
@@ -0,0 +1,43 @@
+From 4c839402cef167dabe8284ddac9a365de0c3a8bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jun 2025 10:11:22 -0400
+Subject: drm/amd/display: fix condition for setting timing_adjust_pending
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit 1a6a3374ecb9899ccf0d209b5783a796bdba8cec ]
+
+timing_adjust_pending is used to defer certain programming sequences
+when OTG timing is about to be changed, like with VRR. Insufficient
+checking for timing change in this case caused a regression which
+reduces PSR Replay residency.
+
+Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Robin Chen <robin.chen@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index dcc48b5238e53..bb189f6773397 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -459,7 +459,9 @@ bool dc_stream_adjust_vmin_vmax(struct dc *dc,
+ 	 * avoid conflicting with firmware updates.
+ 	 */
+ 	if (dc->ctx->dce_version > DCE_VERSION_MAX) {
+-		if (dc->optimized_required || dc->wm_optimized_required) {
++		if ((dc->optimized_required || dc->wm_optimized_required) &&
++			(stream->adjust.v_total_max != adjust->v_total_max ||
++			stream->adjust.v_total_min != adjust->v_total_min)) {
+ 			stream->adjust.timing_adjust_pending = true;
+ 			return false;
+ 		}
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-dmcub-loading-sequence-for-dcn3..patch b/queue-6.17/drm-amd-display-fix-dmcub-loading-sequence-for-dcn3..patch
new file mode 100644
index 0000000000..f9f08060da
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-dmcub-loading-sequence-for-dcn3..patch
@@ -0,0 +1,178 @@
+From 5de0360b5a9256a82881a85be8f73482aa8e1bb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 10:26:22 -0400
+Subject: drm/amd/display: Fix DMCUB loading sequence for DCN3.2
+
+From: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+
+[ Upstream commit 18e755155caa57a6e6c4aa4a40b0db0fba015289 ]
+
+[Why]
+New sequence from HW for reset and firmware reloading has been
+provided that aims to stabilize the reload sequence in the case the
+firmware is hung or has outstanding requests.
+
+[How]
+Update the sequence to remove the DMUIF reset and the redundant
+writes in the release.
+
+Reviewed-by: Sreeja Golui <sreeja.golui@amd.com>
+Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dmub/src/dmub_dcn32.c | 53 ++++++++++---------
+ .../gpu/drm/amd/display/dmub/src/dmub_dcn32.h |  8 ++-
+ 2 files changed, 35 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+index e7056205b0506..ce041f6239dc7 100644
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.c
+@@ -89,44 +89,50 @@ static inline void dmub_dcn32_translate_addr(const union dmub_addr *addr_in,
+ void dmub_dcn32_reset(struct dmub_srv *dmub)
+ {
+ 	union dmub_gpint_data_register cmd;
+-	const uint32_t timeout = 30;
+-	uint32_t in_reset, scratch, i;
++	const uint32_t timeout = 100000;
++	uint32_t in_reset, is_enabled, scratch, i, pwait_mode;
+ 
+ 	REG_GET(DMCUB_CNTL2, DMCUB_SOFT_RESET, &in_reset);
++	REG_GET(DMCUB_CNTL, DMCUB_ENABLE, &is_enabled);
+ 
+-	if (in_reset == 0) {
++	if (in_reset == 0 && is_enabled != 0) {
+ 		cmd.bits.status = 1;
+ 		cmd.bits.command_code = DMUB_GPINT__STOP_FW;
+ 		cmd.bits.param = 0;
+ 
+ 		dmub->hw_funcs.set_gpint(dmub, cmd);
+ 
+-		/**
+-		 * Timeout covers both the ACK and the wait
+-		 * for remaining work to finish.
+-		 *
+-		 * This is mostly bound by the PHY disable sequence.
+-		 * Each register check will be greater than 1us, so
+-		 * don't bother using udelay.
+-		 */
+-
+ 		for (i = 0; i < timeout; ++i) {
+ 			if (dmub->hw_funcs.is_gpint_acked(dmub, cmd))
+ 				break;
++
++			udelay(1);
+ 		}
+ 
+ 		for (i = 0; i < timeout; ++i) {
+-			scratch = dmub->hw_funcs.get_gpint_response(dmub);
++			scratch = REG_READ(DMCUB_SCRATCH7);
+ 			if (scratch == DMUB_GPINT__STOP_FW_RESPONSE)
+ 				break;
++
++			udelay(1);
+ 		}
+ 
++		for (i = 0; i < timeout; ++i) {
++			REG_GET(DMCUB_CNTL, DMCUB_PWAIT_MODE_STATUS, &pwait_mode);
++			if (pwait_mode & (1 << 0))
++				break;
++
++			udelay(1);
++		}
+ 		/* Force reset in case we timed out, DMCUB is likely hung. */
+ 	}
+ 
+-	REG_UPDATE(DMCUB_CNTL2, DMCUB_SOFT_RESET, 1);
+-	REG_UPDATE(DMCUB_CNTL, DMCUB_ENABLE, 0);
+-	REG_UPDATE(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET, 1);
++	if (is_enabled) {
++		REG_UPDATE(DMCUB_CNTL2, DMCUB_SOFT_RESET, 1);
++		udelay(1);
++		REG_UPDATE(DMCUB_CNTL, DMCUB_ENABLE, 0);
++	}
++
+ 	REG_WRITE(DMCUB_INBOX1_RPTR, 0);
+ 	REG_WRITE(DMCUB_INBOX1_WPTR, 0);
+ 	REG_WRITE(DMCUB_OUTBOX1_RPTR, 0);
+@@ -135,7 +141,7 @@ void dmub_dcn32_reset(struct dmub_srv *dmub)
+ 	REG_WRITE(DMCUB_OUTBOX0_WPTR, 0);
+ 	REG_WRITE(DMCUB_SCRATCH0, 0);
+ 
+-	/* Clear the GPINT command manually so we don't reset again. */
++	/* Clear the GPINT command manually so we don't send anything during boot. */
+ 	cmd.all = 0;
+ 	dmub->hw_funcs.set_gpint(dmub, cmd);
+ }
+@@ -419,8 +425,8 @@ uint32_t dmub_dcn32_get_current_time(struct dmub_srv *dmub)
+ 
+ void dmub_dcn32_get_diagnostic_data(struct dmub_srv *dmub)
+ {
+-	uint32_t is_dmub_enabled, is_soft_reset, is_sec_reset;
+-	uint32_t is_traceport_enabled, is_cw0_enabled, is_cw6_enabled;
++	uint32_t is_dmub_enabled, is_soft_reset, is_pwait;
++	uint32_t is_traceport_enabled, is_cw6_enabled;
+ 	struct dmub_timeout_info timeout = {0};
+ 
+ 	if (!dmub)
+@@ -470,18 +476,15 @@ void dmub_dcn32_get_diagnostic_data(struct dmub_srv *dmub)
+ 	REG_GET(DMCUB_CNTL, DMCUB_ENABLE, &is_dmub_enabled);
+ 	dmub->debug.is_dmcub_enabled = is_dmub_enabled;
+ 
++	REG_GET(DMCUB_CNTL, DMCUB_PWAIT_MODE_STATUS, &is_pwait);
++	dmub->debug.is_pwait = is_pwait;
++
+ 	REG_GET(DMCUB_CNTL2, DMCUB_SOFT_RESET, &is_soft_reset);
+ 	dmub->debug.is_dmcub_soft_reset = is_soft_reset;
+ 
+-	REG_GET(DMCUB_SEC_CNTL, DMCUB_SEC_RESET_STATUS, &is_sec_reset);
+-	dmub->debug.is_dmcub_secure_reset = is_sec_reset;
+-
+ 	REG_GET(DMCUB_CNTL, DMCUB_TRACEPORT_EN, &is_traceport_enabled);
+ 	dmub->debug.is_traceport_en  = is_traceport_enabled;
+ 
+-	REG_GET(DMCUB_REGION3_CW0_TOP_ADDRESS, DMCUB_REGION3_CW0_ENABLE, &is_cw0_enabled);
+-	dmub->debug.is_cw0_enabled = is_cw0_enabled;
+-
+ 	REG_GET(DMCUB_REGION3_CW6_TOP_ADDRESS, DMCUB_REGION3_CW6_ENABLE, &is_cw6_enabled);
+ 	dmub->debug.is_cw6_enabled = is_cw6_enabled;
+ 
+diff --git a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.h b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.h
+index 1a229450c53db..daf81027d6631 100644
+--- a/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.h
++++ b/drivers/gpu/drm/amd/display/dmub/src/dmub_dcn32.h
+@@ -89,6 +89,9 @@ struct dmub_srv;
+ 	DMUB_SR(DMCUB_REGION5_OFFSET) \
+ 	DMUB_SR(DMCUB_REGION5_OFFSET_HIGH) \
+ 	DMUB_SR(DMCUB_REGION5_TOP_ADDRESS) \
++	DMUB_SR(DMCUB_REGION6_OFFSET) \
++	DMUB_SR(DMCUB_REGION6_OFFSET_HIGH) \
++	DMUB_SR(DMCUB_REGION6_TOP_ADDRESS) \
+ 	DMUB_SR(DMCUB_SCRATCH0) \
+ 	DMUB_SR(DMCUB_SCRATCH1) \
+ 	DMUB_SR(DMCUB_SCRATCH2) \
+@@ -155,6 +158,8 @@ struct dmub_srv;
+ 	DMUB_SF(DMCUB_REGION4_TOP_ADDRESS, DMCUB_REGION4_ENABLE) \
+ 	DMUB_SF(DMCUB_REGION5_TOP_ADDRESS, DMCUB_REGION5_TOP_ADDRESS) \
+ 	DMUB_SF(DMCUB_REGION5_TOP_ADDRESS, DMCUB_REGION5_ENABLE) \
++	DMUB_SF(DMCUB_REGION6_TOP_ADDRESS, DMCUB_REGION6_TOP_ADDRESS) \
++	DMUB_SF(DMCUB_REGION6_TOP_ADDRESS, DMCUB_REGION6_ENABLE) \
+ 	DMUB_SF(CC_DC_PIPE_DIS, DC_DMCUB_ENABLE) \
+ 	DMUB_SF(MMHUBBUB_SOFT_RESET, DMUIF_SOFT_RESET) \
+ 	DMUB_SF(DCN_VM_FB_LOCATION_BASE, FB_BASE) \
+@@ -162,7 +167,8 @@ struct dmub_srv;
+ 	DMUB_SF(DMCUB_INBOX0_WPTR, DMCUB_INBOX0_WPTR) \
+ 	DMUB_SF(DMCUB_REGION3_TMR_AXI_SPACE, DMCUB_REGION3_TMR_AXI_SPACE) \
+ 	DMUB_SF(DMCUB_INTERRUPT_ENABLE, DMCUB_GPINT_IH_INT_EN) \
+-	DMUB_SF(DMCUB_INTERRUPT_ACK, DMCUB_GPINT_IH_INT_ACK)
++	DMUB_SF(DMCUB_INTERRUPT_ACK, DMCUB_GPINT_IH_INT_ACK) \
++	DMUB_SF(DMCUB_CNTL, DMCUB_PWAIT_MODE_STATUS)
+ 
+ struct dmub_srv_dcn32_reg_offset {
+ #define DMUB_SR(reg) uint32_t reg;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-dml-ms-order-of-operations.patch b/queue-6.17/drm-amd-display-fix-dml-ms-order-of-operations.patch
new file mode 100644
index 0000000000..8e1960e4f4
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-dml-ms-order-of-operations.patch
@@ -0,0 +1,42 @@
+From 223bfeaaef7833a1a70b3682f988d3d6211867dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:10:18 -0400
+Subject: drm/amd/display: fix dml ms order of operations
+
+From: Ausef Yousof <Ausef.Yousof@amd.com>
+
+[ Upstream commit 02a6c2e4b28ff31f7a904c196a99fb2efe81e2cf ]
+
+[why&how]
+small error in order of operations in immediateflipbytes
+calculation on dml ms side that can result in dml ms
+and mp mismatch immediateflip support for a given pipe
+and thus an invalid hw state, correct the order to align
+with mp.
+
+Reviewed-by: Leo Chen <leo.chen@amd.com>
+Signed-off-by: Ausef Yousof <Ausef.Yousof@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+index 715f9019a33e2..4b9b2e84d3811 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c
+@@ -6529,7 +6529,7 @@ static noinline_for_stack void dml_prefetch_check(struct display_mode_lib_st *mo
+ 				mode_lib->ms.TotImmediateFlipBytes = 0;
+ 				for (k = 0; k <= mode_lib->ms.num_active_planes - 1; k++) {
+ 					if (!(mode_lib->ms.policy.ImmediateFlipRequirement[k] == dml_immediate_flip_not_required)) {
+-						mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * mode_lib->ms.PDEAndMetaPTEBytesPerFrame[j][k] + mode_lib->ms.MetaRowBytes[j][k];
++						mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * (mode_lib->ms.PDEAndMetaPTEBytesPerFrame[j][k] + mode_lib->ms.MetaRowBytes[j][k]);
+ 						if (mode_lib->ms.use_one_row_for_frame_flip[j][k]) {
+ 							mode_lib->ms.TotImmediateFlipBytes = mode_lib->ms.TotImmediateFlipBytes + mode_lib->ms.NoOfDPP[j][k] * (2 * mode_lib->ms.DPTEBytesPerRow[j][k]);
+ 						} else {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-dmub-access-race-condition.patch b/queue-6.17/drm-amd-display-fix-dmub-access-race-condition.patch
new file mode 100644
index 0000000000..eceee3e455
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-dmub-access-race-condition.patch
@@ -0,0 +1,139 @@
+From c42670ad2e12af0647fead1cc82cd2c81a0811fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 11:03:39 -0400
+Subject: drm/amd/display: fix dmub access race condition
+
+From: Aurabindo Pillai <aurabindo.pillai@amd.com>
+
+[ Upstream commit c210b757b400959577a5a17b783b5959b82baed8 ]
+
+Accessing DC from amdgpu_dm is usually preceded by acquisition of
+dc_lock mutex. Most of the DC API that DM calls are under a DC lock.
+However, there are a few that are not. Some DC API called from interrupt
+context end up sending DMUB commands via a DC API, while other threads were
+using DMUB. This was apparent from a race between calls for setting idle
+optimization enable/disable and the DC API to set vmin/vmax.
+
+Offload the call to dc_stream_adjust_vmin_vmax() to a thread instead
+of directly calling them from the interrupt handler such that it waits
+for dc_lock.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 55 +++++++++++++++++--
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 14 +++++
+ 2 files changed, 63 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 163780030eb16..aca57cc815514 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -541,6 +541,50 @@ static void dm_pflip_high_irq(void *interrupt_params)
+ 		      amdgpu_crtc->crtc_id, amdgpu_crtc, vrr_active, (int)!e);
+ }
+ 
++static void dm_handle_vmin_vmax_update(struct work_struct *offload_work)
++{
++	struct vupdate_offload_work *work = container_of(offload_work, struct vupdate_offload_work, work);
++	struct amdgpu_device *adev = work->adev;
++	struct dc_stream_state *stream = work->stream;
++	struct dc_crtc_timing_adjust *adjust = work->adjust;
++
++	mutex_lock(&adev->dm.dc_lock);
++	dc_stream_adjust_vmin_vmax(adev->dm.dc, stream, adjust);
++	mutex_unlock(&adev->dm.dc_lock);
++
++	dc_stream_release(stream);
++	kfree(work->adjust);
++	kfree(work);
++}
++
++static void schedule_dc_vmin_vmax(struct amdgpu_device *adev,
++	struct dc_stream_state *stream,
++	struct dc_crtc_timing_adjust *adjust)
++{
++	struct vupdate_offload_work *offload_work = kzalloc(sizeof(*offload_work), GFP_KERNEL);
++	if (!offload_work) {
++		drm_dbg_driver(adev_to_drm(adev), "Failed to allocate vupdate_offload_work\n");
++		return;
++	}
++
++	struct dc_crtc_timing_adjust *adjust_copy = kzalloc(sizeof(*adjust_copy), GFP_KERNEL);
++	if (!adjust_copy) {
++		drm_dbg_driver(adev_to_drm(adev), "Failed to allocate adjust_copy\n");
++		kfree(offload_work);
++		return;
++	}
++
++	dc_stream_retain(stream);
++	memcpy(adjust_copy, adjust, sizeof(*adjust_copy));
++
++	INIT_WORK(&offload_work->work, dm_handle_vmin_vmax_update);
++	offload_work->adev = adev;
++	offload_work->stream = stream;
++	offload_work->adjust = adjust_copy;
++
++	queue_work(system_wq, &offload_work->work);
++}
++
+ static void dm_vupdate_high_irq(void *interrupt_params)
+ {
+ 	struct common_irq_params *irq_params = interrupt_params;
+@@ -590,10 +634,9 @@ static void dm_vupdate_high_irq(void *interrupt_params)
+ 				    acrtc->dm_irq_params.stream,
+ 				    &acrtc->dm_irq_params.vrr_params);
+ 
+-				dc_stream_adjust_vmin_vmax(
+-				    adev->dm.dc,
+-				    acrtc->dm_irq_params.stream,
+-				    &acrtc->dm_irq_params.vrr_params.adjust);
++				schedule_dc_vmin_vmax(adev,
++					acrtc->dm_irq_params.stream,
++					&acrtc->dm_irq_params.vrr_params.adjust);
+ 				spin_unlock_irqrestore(&adev_to_drm(adev)->event_lock, flags);
+ 			}
+ 		}
+@@ -683,8 +726,8 @@ static void dm_crtc_high_irq(void *interrupt_params)
+ 					     acrtc->dm_irq_params.stream,
+ 					     &acrtc->dm_irq_params.vrr_params);
+ 
+-		dc_stream_adjust_vmin_vmax(adev->dm.dc, acrtc->dm_irq_params.stream,
+-					   &acrtc->dm_irq_params.vrr_params.adjust);
++		schedule_dc_vmin_vmax(adev, acrtc->dm_irq_params.stream,
++				&acrtc->dm_irq_params.vrr_params.adjust);
+ 	}
+ 
+ 	/*
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index b937da0a4e4a0..c18a6b43c76f6 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -152,6 +152,20 @@ struct idle_workqueue {
+ 	bool running;
+ };
+ 
++/**
++ * struct dm_vupdate_work - Work data for periodic action in idle
++ * @work: Kernel work data for the work event
++ * @adev: amdgpu_device back pointer
++ * @stream: DC stream associated with the crtc
++ * @adjust: DC CRTC timing adjust to be applied to the crtc
++ */
++struct vupdate_offload_work {
++	struct work_struct work;
++	struct amdgpu_device *adev;
++	struct dc_stream_state *stream;
++	struct dc_crtc_timing_adjust *adjust;
++};
++
+ #define MAX_LUMINANCE_DATA_POINTS 99
+ 
+ /**
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-dmub_cmd-header-alignment.patch b/queue-6.17/drm-amd-display-fix-dmub_cmd-header-alignment.patch
new file mode 100644
index 0000000000..66f9e6f183
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-dmub_cmd-header-alignment.patch
@@ -0,0 +1,59 @@
+From 94dd3b3b21407cfc74c7db0c53b847214734bbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 17:26:39 -0400
+Subject: drm/amd/display: Fix dmub_cmd header alignment
+
+From: Ovidiu Bunea <ovidiu.bunea@amd.com>
+
+[ Upstream commit 327aba7f558187e451636c77a1662a2858438dc9 ]
+
+[why & how]
+Header misalignment in struct dmub_cmd_replay_copy_settings_data and
+struct dmub_alpm_auxless_data causes incorrect data read between driver
+and dmub.
+Fix the misalignment and ensure that everything is aligned to 4-byte
+boundaries.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Ovidiu Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+index 6a69a788abe80..6fa25b0375858 100644
+--- a/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
++++ b/drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h
+@@ -4015,6 +4015,10 @@ struct dmub_alpm_auxless_data {
+ 	uint16_t lfps_t1_t2_override_us;
+ 	short lfps_t1_t2_offset_us;
+ 	uint8_t lttpr_count;
++	/*
++	 * Padding to align structure to 4 byte boundary.
++	 */
++	uint8_t pad[1];
+ };
+ 
+ /**
+@@ -4092,6 +4096,14 @@ struct dmub_cmd_replay_copy_settings_data {
+ 	 */
+ 	struct dmub_alpm_auxless_data auxless_alpm_data;
+ 
++	/**
++	 * @hpo_stream_enc_inst: HPO stream encoder instance
++	 */
++	uint8_t hpo_stream_enc_inst;
++	/**
++	 * @hpo_link_enc_inst: HPO link encoder instance
++	 */
++	uint8_t hpo_link_enc_inst;
+ 	/**
+ 	 * @pad: Align structure to 4 byte boundary.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-dvi-d-hdmi-adapters.patch b/queue-6.17/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
new file mode 100644
index 0000000000..136d485cc4
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
@@ -0,0 +1,57 @@
+From 5bac2dc39753116e201a543c3599b6093a7db432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:33:33 +0200
+Subject: drm/amd/display: Fix DVI-D/HDMI adapters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 489f0f600ce2c0dae640df9035e1d82677d2580f ]
+
+When the EDID has the HDMI bit, we should simply select
+the HDMI signal type even on DVI ports.
+
+For reference see, the legacy amdgpu display code:
+amdgpu_atombios_encoder_get_encoder_mode
+which selects ATOM_ENCODER_MODE_HDMI for the same case.
+
+This commit fixes DVI connectors to work with DVI-D/HDMI
+adapters so that they can now produce output over these
+connectors for HDMI monitors with higher bandwidth modes.
+With this change, even HDMI audio works through DVI.
+
+For testing, I used a CAA-DMDHFD3 DVI-D/HDMI adapter
+with the following GPUs:
+
+Tahiti (DCE 6) - DC can now output 4K 30 Hz over DVI
+Polaris 10 (DCE 11.2) - DC can now output 4K 60 Hz over DVI
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+index 827b630daf49a..18d0ef40f23fb 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -1140,6 +1140,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,
+ 		if (sink->sink_signal == SIGNAL_TYPE_HDMI_TYPE_A &&
+ 		    !sink->edid_caps.edid_hdmi)
+ 			sink->sink_signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
++		else if (dc_is_dvi_signal(sink->sink_signal) &&
++			 aud_support->hdmi_audio_native &&
++			 sink->edid_caps.edid_hdmi)
++			sink->sink_signal = SIGNAL_TYPE_HDMI_TYPE_A;
+ 
+ 		if (link->local_sink && dc_is_dp_signal(sink_caps.signal))
+ 			dp_trace_init(link);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch b/queue-6.17/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
new file mode 100644
index 0000000000..ad66221f8c
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
@@ -0,0 +1,39 @@
+From 865edb46fa01a9183182eb70b7e24ecf478fa2df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 11:04:07 -0400
+Subject: drm/amd/display: Fix for test crash due to power gating
+
+From: Sridevi Arvindekar <sarvinde@amd.com>
+
+[ Upstream commit 0bf6b216d4783cb51f9af05a49d3cce4fc22dc24 ]
+
+[Why/How]
+Call power gating routine only if it is defined.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Sridevi Arvindekar <sarvinde@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 9d3946065620a..f7b72b24b7509 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3129,7 +3129,8 @@ void dcn20_fpga_init_hw(struct dc *dc)
+ 		res_pool->dccg->funcs->dccg_init(res_pool->dccg);
+ 
+ 	//Enable ability to power gate / don't force power on permanently
+-	hws->funcs.enable_power_gating_plane(hws, true);
++	if (hws->funcs.enable_power_gating_plane)
++		hws->funcs.enable_power_gating_plane(hws, true);
+ 
+ 	// Specific to FPGA dccg and registers
+ 	REG_WRITE(RBBMIF_TIMEOUT_DIS, 0xFFFFFFFF);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-fix-pbn_div-calculation-error.patch b/queue-6.17/drm-amd-display-fix-pbn_div-calculation-error.patch
new file mode 100644
index 0000000000..5f7c8929b7
--- /dev/null
+++ b/queue-6.17/drm-amd-display-fix-pbn_div-calculation-error.patch
@@ -0,0 +1,96 @@
+From 5df491a68dc8306f8e67c8df9535b0b8a87e3152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Apr 2025 15:11:43 -0400
+Subject: drm/amd/display: Fix pbn_div Calculation Error
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+[ Upstream commit 12cdfb61b32a7be581ec5932e0b6a482cb098204 ]
+
+[Why]
+dm_mst_get_pbn_divider() returns value integer coming from
+the cast from fixed point, but the casted integer will then be used
+in dfixed_const to be multiplied by 4096. The cast from fixed point to integer
+causes the calculation error becomes bigger when multiplied by 4096.
+
+That makes the calculated pbn_div value becomes smaller than
+it should be, which leads to the req_slot number becomes bigger.
+
+Such error is getting reflected in 8k30 timing,
+where the correct and incorrect calculated req_slot 62.9 Vs 63.1.
+That makes the wrong calculation failed to light up 8k30
+after a dock under HBR3 x 4.
+
+[How]
+Restore the accuracy by keeping the fraction part
+calculated for the left shift operation.
+
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c   |  2 +-
+ .../drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 13 ++++++++++---
+ .../drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h |  2 +-
+ 3 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index aca57cc815514..afe3a8279c3a9 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -7974,7 +7974,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder,
+ 	if (IS_ERR(mst_state))
+ 		return PTR_ERR(mst_state);
+ 
+-	mst_state->pbn_div.full = dfixed_const(dm_mst_get_pbn_divider(aconnector->mst_root->dc_link));
++	mst_state->pbn_div.full = dm_mst_get_pbn_divider(aconnector->mst_root->dc_link);
+ 
+ 	if (!state->duplicated) {
+ 		int max_bpc = conn_state->max_requested_bpc;
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 77a9d2c7d3185..5412bf046062c 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -822,13 +822,20 @@ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
+ 	drm_connector_attach_dp_subconnector_property(&aconnector->base);
+ }
+ 
+-int dm_mst_get_pbn_divider(struct dc_link *link)
++uint32_t dm_mst_get_pbn_divider(struct dc_link *link)
+ {
++	uint32_t pbn_div_x100;
++	uint64_t dividend, divisor;
++
+ 	if (!link)
+ 		return 0;
+ 
+-	return dc_link_bandwidth_kbps(link,
+-			dc_link_get_link_cap(link)) / (8 * 1000 * 54);
++	dividend = (uint64_t)dc_link_bandwidth_kbps(link, dc_link_get_link_cap(link)) * 100;
++	divisor = 8 * 1000 * 54;
++
++	pbn_div_x100 = div64_u64(dividend, divisor);
++
++	return dfixed_const(pbn_div_x100) / 100;
+ }
+ 
+ struct dsc_mst_fairness_params {
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+index 600d6e2210111..179f622492dbf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.h
+@@ -59,7 +59,7 @@ enum mst_msg_ready_type {
+ struct amdgpu_display_manager;
+ struct amdgpu_dm_connector;
+ 
+-int dm_mst_get_pbn_divider(struct dc_link *link);
++uint32_t dm_mst_get_pbn_divider(struct dc_link *link);
+ 
+ void amdgpu_dm_initialize_dp_connector(struct amdgpu_display_manager *dm,
+ 				       struct amdgpu_dm_connector *aconnector,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-incorrect-conditions-for-failing-dto.patch b/queue-6.17/drm-amd-display-incorrect-conditions-for-failing-dto.patch
new file mode 100644
index 0000000000..bab54ee868
--- /dev/null
+++ b/queue-6.17/drm-amd-display-incorrect-conditions-for-failing-dto.patch
@@ -0,0 +1,41 @@
+From 9aea84fd97aae7149e13bd954055780bf099992f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 15:04:29 -0400
+Subject: drm/amd/display: incorrect conditions for failing dto calculations
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit 306cbcc6f687d791ab3cc8fbbe30f5286fd0d1e5 ]
+
+[Why & How]
+Previously, when calculating dto phase, we would incorrectly fail when phase
+<=0 without additionally checking for the integer value. This meant that
+calculations would incorrectly fail when the desired pixel clock was an exact
+multiple of the reference clock.
+
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c b/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
+index 668ee2d405fdf..0b8ed9b94d3c5 100644
+--- a/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
++++ b/drivers/gpu/drm/amd/display/dc/dccg/dcn401/dcn401_dccg.c
+@@ -619,7 +619,7 @@ void dccg401_set_dp_dto(
+ 		dto_integer = div_u64(params->pixclk_hz, dto_modulo_hz);
+ 		dto_phase_hz = params->pixclk_hz - dto_integer * dto_modulo_hz;
+ 
+-		if (dto_phase_hz <= 0) {
++		if (dto_phase_hz <= 0 && dto_integer <= 0) {
+ 			/* negative pixel rate should never happen */
+ 			BREAK_TO_DEBUGGER();
+ 			return;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch b/queue-6.17/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
new file mode 100644
index 0000000000..b3e22ba72b
--- /dev/null
+++ b/queue-6.17/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
@@ -0,0 +1,59 @@
+From b05e2ef8297793d7a9d6ba169746cdbd78f40199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 18:04:01 -0400
+Subject: drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit e3419e1e44b87d4176fb98679a77301b1ca40f63 ]
+
+[WHY]
+In the worst case, AUX intra-hop done can take hundreds of milliseconds as
+each retimer in a link might have to wait a full AUX_RD_INTERVAL to send
+LT abort downstream.
+
+[HOW]
+Wait 300ms for each retimer in a link to allow time to propagate a LT abort
+without infinitely waiting on intra-hop done.
+For no-retimer case, keep the max duration at 10ms.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/link/protocols/link_dp_training.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+index 2dc1a660e5045..134093ce5a8e8 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+@@ -1018,7 +1018,12 @@ static enum link_training_result dpcd_exit_training_mode(struct dc_link *link, e
+ {
+ 	enum dc_status status;
+ 	uint8_t sink_status = 0;
+-	uint8_t i;
++	uint32_t i;
++	uint8_t lttpr_count = dp_parse_lttpr_repeater_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt);
++	uint32_t intra_hop_disable_time_ms = (lttpr_count > 0 ? lttpr_count * 300 : 10);
++
++	// Each hop could theoretically take over 256ms (max 128b/132b AUX RD INTERVAL)
++	// To be safe, allow 300ms per LTTPR and 10ms for no LTTPR case
+ 
+ 	/* clear training pattern set */
+ 	status = dpcd_set_training_pattern(link, DP_TRAINING_PATTERN_VIDEOIDLE);
+@@ -1028,7 +1033,7 @@ static enum link_training_result dpcd_exit_training_mode(struct dc_link *link, e
+ 
+ 	if (encoding == DP_128b_132b_ENCODING) {
+ 		/* poll for intra-hop disable */
+-		for (i = 0; i < 10; i++) {
++		for (i = 0; i < intra_hop_disable_time_ms; i++) {
+ 			if ((core_link_read_dpcd(link, DP_SINK_STATUS, &sink_status, 1) == DC_OK) &&
+ 					(sink_status & DP_INTRA_HOP_AUX_REPLY_INDICATION) == 0)
+ 				break;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch b/queue-6.17/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
new file mode 100644
index 0000000000..8f9ef709a5
--- /dev/null
+++ b/queue-6.17/drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
@@ -0,0 +1,84 @@
+From 08d854b17d59b961013cbeb0570309b2519bae74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 11:33:22 -0400
+Subject: drm/amd/display: Increase minimum clock for TMDS 420 with pipe
+ splitting
+
+From: Relja Vojvodic <rvojvodi@amd.com>
+
+[ Upstream commit 002a612023c8b105bd3829d81862dee04368d6de ]
+
+[Why]
+-Pipe splitting allows for clocks to be reduced, but when using TMDS 420,
+reduced clocks lead to missed clocks cycles on clock resyncing
+
+[How]
+-Impose a minimum clock when using TMDS 420
+
+Reviewed-by: Chris Park <chris.park@amd.com>
+Signed-off-by: Relja Vojvodic <rvojvodi@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../src/dml2_core/dml2_core_dcn4_calcs.c      | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+index b9cff21985110..bf62d42b3f78b 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c
+@@ -1238,18 +1238,27 @@ static void CalculateDETBufferSize(
+ 
+ static double CalculateRequiredDispclk(
+ 	enum dml2_odm_mode ODMMode,
+-	double PixelClock)
++	double PixelClock,
++	bool isTMDS420)
+ {
++	double DispClk;
+ 
+ 	if (ODMMode == dml2_odm_mode_combine_4to1) {
+-		return PixelClock / 4.0;
++		DispClk = PixelClock / 4.0;
+ 	} else if (ODMMode == dml2_odm_mode_combine_3to1) {
+-		return PixelClock / 3.0;
++		DispClk = PixelClock / 3.0;
+ 	} else if (ODMMode == dml2_odm_mode_combine_2to1) {
+-		return PixelClock / 2.0;
++		DispClk = PixelClock / 2.0;
+ 	} else {
+-		return PixelClock;
++		DispClk = PixelClock;
++	}
++
++	if (isTMDS420) {
++		double TMDS420MinPixClock = PixelClock / 2.0;
++		DispClk = math_max2(DispClk, TMDS420MinPixClock);
+ 	}
++
++	return DispClk;
+ }
+ 
+ static double TruncToValidBPP(
+@@ -4122,11 +4131,12 @@ static noinline_for_stack void CalculateODMMode(
+ 	bool success;
+ 	bool UseDSC = DSCEnable && (NumberOfDSCSlices > 0);
+ 	enum dml2_odm_mode DecidedODMMode;
++	bool isTMDS420 = (OutFormat == dml2_420 && Output == dml2_hdmi);
+ 
+-	SurfaceRequiredDISPCLKWithoutODMCombine = CalculateRequiredDispclk(dml2_odm_mode_bypass, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineTwoToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_2to1, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineThreeToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_3to1, PixelClock);
+-	SurfaceRequiredDISPCLKWithODMCombineFourToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_4to1, PixelClock);
++	SurfaceRequiredDISPCLKWithoutODMCombine = CalculateRequiredDispclk(dml2_odm_mode_bypass, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineTwoToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_2to1, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineThreeToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_3to1, PixelClock, isTMDS420);
++	SurfaceRequiredDISPCLKWithODMCombineFourToOne = CalculateRequiredDispclk(dml2_odm_mode_combine_4to1, PixelClock, isTMDS420);
+ #ifdef __DML_VBA_DEBUG__
+ 	DML_LOG_VERBOSE("DML::%s: ODMUse = %d\n", __func__, ODMUse);
+ 	DML_LOG_VERBOSE("DML::%s: Output = %d\n", __func__, Output);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-indicate-when-custom-brightness-curv.patch b/queue-6.17/drm-amd-display-indicate-when-custom-brightness-curv.patch
new file mode 100644
index 0000000000..6f6fa90c78
--- /dev/null
+++ b/queue-6.17/drm-amd-display-indicate-when-custom-brightness-curv.patch
@@ -0,0 +1,48 @@
+From f6b9e19c486c996db7f9255d2845930983542879 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Aug 2025 15:20:58 -0500
+Subject: drm/amd/display: Indicate when custom brightness curves are in use
+
+From: Mario Limonciello <superm1@kernel.org>
+
+[ Upstream commit 68f3c044f37d9f50d67417fa8018d9cf16423458 ]
+
+[Why]
+There is a `scale` sysfs attribute that can be used to indicate when
+non-linear brightness scaling is in use.  As Custom brightness curves
+work by linear interpolation of points the scale is no longer linear.
+
+[How]
+Indicate non-linear scaling when custom brightness curves in use and
+linear scaling otherwise.
+
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Mario Limonciello <superm1@kernel.org>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index afe3a8279c3a9..8eb2fc4133487 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5032,8 +5032,11 @@ amdgpu_dm_register_backlight_device(struct amdgpu_dm_connector *aconnector)
+ 	} else
+ 		props.brightness = props.max_brightness = MAX_BACKLIGHT_LEVEL;
+ 
+-	if (caps->data_points && !(amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE))
++	if (caps->data_points && !(amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE)) {
+ 		drm_info(drm, "Using custom brightness curve\n");
++		props.scale = BACKLIGHT_SCALE_NON_LINEAR;
++	} else
++		props.scale = BACKLIGHT_SCALE_LINEAR;
+ 	props.type = BACKLIGHT_RAW;
+ 
+ 	snprintf(bl_name, sizeof(bl_name), "amdgpu_bl%d",
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch b/queue-6.17/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
new file mode 100644
index 0000000000..693f1878bc
--- /dev/null
+++ b/queue-6.17/drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
@@ -0,0 +1,271 @@
+From d8308a9f5f33174d6af7d953891e0de9ee47d1ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 18:16:24 +0800
+Subject: drm/amd/display: Init dispclk from bootup clock for DCN314
+
+From: Lo-an Chen <lo-an.chen@amd.com>
+
+[ Upstream commit f082daf08f2ff313bdf9cf929a28f6d888117986 ]
+
+[Why]
+Driver does not pick up and save vbios's clocks during init clocks,
+the dispclk in clk_mgr will keep 0 until the first update clocks.
+In some cases, OS changes the timing in the second set mode
+(lower the pixel clock), causing the driver to lower the dispclk
+in prepare bandwidth, which is illegal and causes grey screen.
+
+[How]
+1. Dump and save the vbios's clocks, and init the dispclk in
+dcn314_init_clocks.
+2. Fix the condition in dcn314_update_clocks, regarding a 0kHz value.
+
+Reviewed-by: Charlene Liu <charlene.liu@amd.com>
+Signed-off-by: Lo-an Chen <lo-an.chen@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.c        | 142 +++++++++++++++++-
+ .../dc/clk_mgr/dcn314/dcn314_clk_mgr.h        |   5 +
+ .../dc/resource/dcn314/dcn314_resource.c      |   1 +
+ 3 files changed, 143 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+index 91d872d6d392b..bc2ad0051b35b 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c
+@@ -77,6 +77,7 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #undef DC_LOGGER
+ #define DC_LOGGER \
+ 	clk_mgr->base.base.ctx->logger
++
+ #define regCLK1_CLK_PLL_REQ			0x0237
+ #define regCLK1_CLK_PLL_REQ_BASE_IDX		0
+ 
+@@ -87,8 +88,70 @@ static const struct IP_BASE CLK_BASE = { { { { 0x00016C00, 0x02401800, 0, 0, 0,
+ #define CLK1_CLK_PLL_REQ__PllSpineDiv_MASK	0x0000F000L
+ #define CLK1_CLK_PLL_REQ__FbMult_frac_MASK	0xFFFF0000L
+ 
++#define regCLK1_CLK0_DFS_CNTL				0x0269
++#define regCLK1_CLK0_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK1_DFS_CNTL				0x026c
++#define regCLK1_CLK1_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK2_DFS_CNTL				0x026f
++#define regCLK1_CLK2_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK3_DFS_CNTL				0x0272
++#define regCLK1_CLK3_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK4_DFS_CNTL				0x0275
++#define regCLK1_CLK4_DFS_CNTL_BASE_IDX		0
++#define regCLK1_CLK5_DFS_CNTL				0x0278
++#define regCLK1_CLK5_DFS_CNTL_BASE_IDX		0
++
++#define regCLK1_CLK0_CURRENT_CNT			0x02fb
++#define regCLK1_CLK0_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK1_CURRENT_CNT			0x02fc
++#define regCLK1_CLK1_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK2_CURRENT_CNT			0x02fd
++#define regCLK1_CLK2_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK3_CURRENT_CNT			0x02fe
++#define regCLK1_CLK3_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK4_CURRENT_CNT			0x02ff
++#define regCLK1_CLK4_CURRENT_CNT_BASE_IDX	0
++#define regCLK1_CLK5_CURRENT_CNT			0x0300
++#define regCLK1_CLK5_CURRENT_CNT_BASE_IDX	0
++
++#define regCLK1_CLK0_BYPASS_CNTL			0x028a
++#define regCLK1_CLK0_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK1_BYPASS_CNTL			0x0293
++#define regCLK1_CLK1_BYPASS_CNTL_BASE_IDX	0
+ #define regCLK1_CLK2_BYPASS_CNTL			0x029c
+ #define regCLK1_CLK2_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK3_BYPASS_CNTL			0x02a5
++#define regCLK1_CLK3_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK4_BYPASS_CNTL			0x02ae
++#define regCLK1_CLK4_BYPASS_CNTL_BASE_IDX	0
++#define regCLK1_CLK5_BYPASS_CNTL			0x02b7
++#define regCLK1_CLK5_BYPASS_CNTL_BASE_IDX	0
++
++#define regCLK1_CLK0_DS_CNTL				0x0283
++#define regCLK1_CLK0_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK1_DS_CNTL				0x028c
++#define regCLK1_CLK1_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK2_DS_CNTL				0x0295
++#define regCLK1_CLK2_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK3_DS_CNTL				0x029e
++#define regCLK1_CLK3_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK4_DS_CNTL				0x02a7
++#define regCLK1_CLK4_DS_CNTL_BASE_IDX		0
++#define regCLK1_CLK5_DS_CNTL				0x02b0
++#define regCLK1_CLK5_DS_CNTL_BASE_IDX		0
++
++#define regCLK1_CLK0_ALLOW_DS				0x0284
++#define regCLK1_CLK0_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK1_ALLOW_DS				0x028d
++#define regCLK1_CLK1_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK2_ALLOW_DS				0x0296
++#define regCLK1_CLK2_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK3_ALLOW_DS				0x029f
++#define regCLK1_CLK3_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK4_ALLOW_DS				0x02a8
++#define regCLK1_CLK4_ALLOW_DS_BASE_IDX		0
++#define regCLK1_CLK5_ALLOW_DS				0x02b1
++#define regCLK1_CLK5_ALLOW_DS_BASE_IDX		0
+ 
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_SEL__SHIFT	0x0
+ #define CLK1_CLK2_BYPASS_CNTL__CLK2_BYPASS_DIV__SHIFT	0x10
+@@ -185,6 +248,8 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ {
+ 	struct clk_mgr_internal *clk_mgr_int = TO_CLK_MGR_INTERNAL(clk_mgr);
+ 	uint32_t ref_dtbclk = clk_mgr->clks.ref_dtbclk_khz;
++	struct clk_mgr_dcn314 *clk_mgr_dcn314 = TO_CLK_MGR_DCN314(clk_mgr_int);
++	struct clk_log_info log_info = {0};
+ 
+ 	memset(&(clk_mgr->clks), 0, sizeof(struct dc_clocks));
+ 	// Assumption is that boot state always supports pstate
+@@ -200,6 +265,9 @@ void dcn314_init_clocks(struct clk_mgr *clk_mgr)
+ 			dce_adjust_dp_ref_freq_for_ss(clk_mgr_int, clk_mgr->dprefclk_khz);
+ 	else
+ 		clk_mgr->dp_dto_source_clock_in_khz = clk_mgr->dprefclk_khz;
++
++	dcn314_dump_clk_registers(&clk_mgr->boot_snapshot, &clk_mgr_dcn314->base.base, &log_info);
++	clk_mgr->clks.dispclk_khz =  clk_mgr->boot_snapshot.dispclk * 1000;
+ }
+ 
+ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+@@ -218,6 +286,8 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 	if (dc->work_arounds.skip_clock_update)
+ 		return;
+ 
++	display_count = dcn314_get_active_display_cnt_wa(dc, context);
++
+ 	/*
+ 	 * if it is safe to lower, but we are already in the lower state, we don't have to do anything
+ 	 * also if safe to lower is false, we just go in the higher state
+@@ -236,7 +306,6 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 		}
+ 		/* check that we're not already in lower */
+ 		if (clk_mgr_base->clks.pwr_state != DCN_PWR_STATE_LOW_POWER) {
+-			display_count = dcn314_get_active_display_cnt_wa(dc, context);
+ 			/* if we can go lower, go lower */
+ 			if (display_count == 0) {
+ 				union display_idle_optimization_u idle_info = { 0 };
+@@ -293,11 +362,19 @@ void dcn314_update_clocks(struct clk_mgr *clk_mgr_base,
+ 		update_dppclk = true;
+ 	}
+ 
+-	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz)) {
++	if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) &&
++	    (new_clocks->dispclk_khz > 0 || (safe_to_lower && display_count == 0))) {
++		int requested_dispclk_khz = new_clocks->dispclk_khz;
++
+ 		dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, true);
+ 
++		/* Clamp the requested clock to PMFW based on their limit. */
++		if (dc->debug.min_disp_clk_khz > 0 && requested_dispclk_khz < dc->debug.min_disp_clk_khz)
++			requested_dispclk_khz = dc->debug.min_disp_clk_khz;
++
++		dcn314_smu_set_dispclk(clk_mgr, requested_dispclk_khz);
+ 		clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz;
+-		dcn314_smu_set_dispclk(clk_mgr, clk_mgr_base->clks.dispclk_khz);
++
+ 		dcn314_disable_otg_wa(clk_mgr_base, context, safe_to_lower, false);
+ 
+ 		update_dispclk = true;
+@@ -385,10 +462,65 @@ bool dcn314_are_clock_states_equal(struct dc_clocks *a,
+ 	return true;
+ }
+ 
+-static void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
++
++static void dcn314_dump_clk_registers_internal(struct dcn35_clk_internal *internal, struct clk_mgr *clk_mgr_base)
++{
++	struct clk_mgr_internal *clk_mgr = TO_CLK_MGR_INTERNAL(clk_mgr_base);
++
++	// read dtbclk
++	internal->CLK1_CLK4_CURRENT_CNT = REG_READ(CLK1_CLK4_CURRENT_CNT);
++	internal->CLK1_CLK4_BYPASS_CNTL = REG_READ(CLK1_CLK4_BYPASS_CNTL);
++
++	// read dcfclk
++	internal->CLK1_CLK3_CURRENT_CNT = REG_READ(CLK1_CLK3_CURRENT_CNT);
++	internal->CLK1_CLK3_BYPASS_CNTL = REG_READ(CLK1_CLK3_BYPASS_CNTL);
++
++	// read dcf deep sleep divider
++	internal->CLK1_CLK3_DS_CNTL = REG_READ(CLK1_CLK3_DS_CNTL);
++	internal->CLK1_CLK3_ALLOW_DS = REG_READ(CLK1_CLK3_ALLOW_DS);
++
++	// read dppclk
++	internal->CLK1_CLK1_CURRENT_CNT = REG_READ(CLK1_CLK1_CURRENT_CNT);
++	internal->CLK1_CLK1_BYPASS_CNTL = REG_READ(CLK1_CLK1_BYPASS_CNTL);
++
++	// read dprefclk
++	internal->CLK1_CLK2_CURRENT_CNT = REG_READ(CLK1_CLK2_CURRENT_CNT);
++	internal->CLK1_CLK2_BYPASS_CNTL = REG_READ(CLK1_CLK2_BYPASS_CNTL);
++
++	// read dispclk
++	internal->CLK1_CLK0_CURRENT_CNT = REG_READ(CLK1_CLK0_CURRENT_CNT);
++	internal->CLK1_CLK0_BYPASS_CNTL = REG_READ(CLK1_CLK0_BYPASS_CNTL);
++}
++
++void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
+ 		struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info)
+ {
+-	return;
++
++	struct dcn35_clk_internal internal = {0};
++
++	dcn314_dump_clk_registers_internal(&internal, clk_mgr_base);
++
++	regs_and_bypass->dcfclk = internal.CLK1_CLK3_CURRENT_CNT / 10;
++	regs_and_bypass->dcf_deep_sleep_divider = internal.CLK1_CLK3_DS_CNTL / 10;
++	regs_and_bypass->dcf_deep_sleep_allow = internal.CLK1_CLK3_ALLOW_DS;
++	regs_and_bypass->dprefclk = internal.CLK1_CLK2_CURRENT_CNT / 10;
++	regs_and_bypass->dispclk = internal.CLK1_CLK0_CURRENT_CNT / 10;
++	regs_and_bypass->dppclk = internal.CLK1_CLK1_CURRENT_CNT / 10;
++	regs_and_bypass->dtbclk = internal.CLK1_CLK4_CURRENT_CNT / 10;
++
++	regs_and_bypass->dppclk_bypass = internal.CLK1_CLK1_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dppclk_bypass < 0 || regs_and_bypass->dppclk_bypass > 4)
++		regs_and_bypass->dppclk_bypass = 0;
++	regs_and_bypass->dcfclk_bypass = internal.CLK1_CLK3_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dcfclk_bypass < 0 || regs_and_bypass->dcfclk_bypass > 4)
++		regs_and_bypass->dcfclk_bypass = 0;
++	regs_and_bypass->dispclk_bypass = internal.CLK1_CLK0_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dispclk_bypass < 0 || regs_and_bypass->dispclk_bypass > 4)
++		regs_and_bypass->dispclk_bypass = 0;
++	regs_and_bypass->dprefclk_bypass = internal.CLK1_CLK2_BYPASS_CNTL & 0x0007;
++	if (regs_and_bypass->dprefclk_bypass < 0 || regs_and_bypass->dprefclk_bypass > 4)
++		regs_and_bypass->dprefclk_bypass = 0;
++
+ }
+ 
+ static struct clk_bw_params dcn314_bw_params = {
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+index 002c28e807208..0577eb527bc36 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.h
+@@ -65,4 +65,9 @@ void dcn314_clk_mgr_construct(struct dc_context *ctx,
+ 
+ void dcn314_clk_mgr_destroy(struct clk_mgr_internal *clk_mgr_int);
+ 
++
++void dcn314_dump_clk_registers(struct clk_state_registers_and_bypass *regs_and_bypass,
++		struct clk_mgr *clk_mgr_base, struct clk_log_info *log_info);
++
++
+ #endif //__DCN314_CLK_MGR_H__
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+index 663c49cce4aa3..d4917a35b991a 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn314/dcn314_resource.c
+@@ -927,6 +927,7 @@ static const struct dc_debug_options debug_defaults_drv = {
+ 	.enable_legacy_fast_update = true,
+ 	.using_dml2 = false,
+ 	.disable_dsc_power_gate = true,
++	.min_disp_clk_khz = 100000,
+ };
+ 
+ static const struct dc_panel_config panel_config_defaults = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-keep-pll0-running-on-dce-6.0-and-6.4.patch b/queue-6.17/drm-amd-display-keep-pll0-running-on-dce-6.0-and-6.4.patch
new file mode 100644
index 0000000000..c13eb84f39
--- /dev/null
+++ b/queue-6.17/drm-amd-display-keep-pll0-running-on-dce-6.0-and-6.4.patch
@@ -0,0 +1,67 @@
+From 8698841104d06c05fd0e8b4e6a554068cc31b2a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:28 +0200
+Subject: drm/amd/display: Keep PLL0 running on DCE 6.0 and 6.4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 0449726b58ea64ec96b95f95944f0a3650204059 ]
+
+DC can turn off the display clock when no displays are connected
+or when all displays are off, for reference see:
+- dce*_validate_bandwidth
+
+DC also assumes that the DP clock is always on and never powers
+it down, for reference see:
+- dce110_clock_source_power_down
+
+In case of DCE 6.0 and 6.4, PLL0 is the clock source for both
+the engine clock and DP clock, for reference see:
+- radeon_atom_pick_pll
+- atombios_crtc_set_disp_eng_pll
+
+Therefore, PLL0 should be always kept running on DCE 6.0 and 6.4.
+This commit achieves that by ensuring that by setting the display
+clock to the corresponding value in low power state instead of
+zero.
+
+This fixes a page flip timeout on SI with DC which happens when
+all connected displays are blanked.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/resource/dce60/dce60_resource.c    | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+index f887d59da7c6f..33c1b9b24bb9c 100644
+--- a/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dce60/dce60_resource.c
+@@ -881,7 +881,16 @@ static enum dc_status dce60_validate_bandwidth(
+ 		context->bw_ctx.bw.dce.dispclk_khz = 681000;
+ 		context->bw_ctx.bw.dce.yclk_khz = 250000 * MEMORY_TYPE_MULTIPLIER_CZ;
+ 	} else {
+-		context->bw_ctx.bw.dce.dispclk_khz = 0;
++		/* On DCE 6.0 and 6.4 the PLL0 is both the display engine clock and
++		 * the DP clock, and shouldn't be turned off. Just select the display
++		 * clock value from its low power mode.
++		 */
++		if (dc->ctx->dce_version == DCE_VERSION_6_0 ||
++			dc->ctx->dce_version == DCE_VERSION_6_4)
++			context->bw_ctx.bw.dce.dispclk_khz = 352000;
++		else
++			context->bw_ctx.bw.dce.dispclk_khz = 0;
++
+ 		context->bw_ctx.bw.dce.yclk_khz = 0;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-move-setup_stream_attribute.patch b/queue-6.17/drm-amd-display-move-setup_stream_attribute.patch
new file mode 100644
index 0000000000..4e765d9cd1
--- /dev/null
+++ b/queue-6.17/drm-amd-display-move-setup_stream_attribute.patch
@@ -0,0 +1,122 @@
+From 31e84f1f63bc0a4b0bfa4ba9a1f49f3a132b429c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2025 14:08:08 -0500
+Subject: drm/amd/display: Move setup_stream_attribute
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414 ]
+
+[WHY]
+If symclk RCO is enabled, stream encoder may not be receiving an ungated
+clock by the time we attempt to set stream attributes when setting dpms
+on. Since the clock is gated, register writes to the stream encoder fail.
+
+[HOW]
+Move set_stream_attribute call into enable_stream, just after the point
+where symclk32_se is ungated.
+Logically there is no need to set stream attributes as early as is
+currently done in link_set_dpms_on, so this should have no impact beyond
+the RCO fix.
+
+Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  | 1 +
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c    | 2 ++
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c  | 2 ++
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c            | 3 ---
+ .../drm/amd/display/dc/virtual/virtual_stream_encoder.c    | 7 +++++++
+ 5 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+index c69194e04ff93..32fd6bdc18d73 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -671,6 +671,7 @@ void dce110_enable_stream(struct pipe_ctx *pipe_ctx)
+ 	uint32_t early_control = 0;
+ 	struct timing_generator *tg = pipe_ctx->stream_res.tg;
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
+ 	link_hwss->setup_stream_encoder(pipe_ctx);
+ 
+ 	dc->hwss.update_info_frame(pipe_ctx);
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+index 5e57bd1a08e73..9d3946065620a 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3052,6 +3052,8 @@ void dcn20_enable_stream(struct pipe_ctx *pipe_ctx)
+ 						      link_enc->transmitter - TRANSMITTER_UNIPHY_A);
+ 	}
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
++
+ 	if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+ 		dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ 			dc->res_pool->dccg,
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+index b95b98cc25534..0fe7637049457 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -968,6 +968,8 @@ void dcn401_enable_stream(struct pipe_ctx *pipe_ctx)
+ 		}
+ 	}
+ 
++	link_hwss->setup_stream_attribute(pipe_ctx);
++
+ 	if (dc->res_pool->dccg->funcs->set_pixel_rate_div) {
+ 		dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ 			dc->res_pool->dccg,
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+index 8c8682f743d6f..cb80b45999360 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -2458,7 +2458,6 @@ void link_set_dpms_on(
+ 	struct link_encoder *link_enc = pipe_ctx->link_res.dio_link_enc;
+ 	enum otg_out_mux_dest otg_out_dest = OUT_MUX_DIO;
+ 	struct vpg *vpg = pipe_ctx->stream_res.stream_enc->vpg;
+-	const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
+ 	bool apply_edp_fast_boot_optimization =
+ 		pipe_ctx->stream->apply_edp_fast_boot_optimization;
+ 
+@@ -2502,8 +2501,6 @@ void link_set_dpms_on(
+ 		pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, otg_out_dest);
+ 	}
+ 
+-	link_hwss->setup_stream_attribute(pipe_ctx);
+-
+ 	pipe_ctx->stream->apply_edp_fast_boot_optimization = false;
+ 
+ 	// Enable VPG before building infoframe
+diff --git a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
+index ad088d70e1893..6ffc74fc9dcd8 100644
+--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
+@@ -44,6 +44,11 @@ static void virtual_stream_encoder_dvi_set_stream_attribute(
+ 	struct dc_crtc_timing *crtc_timing,
+ 	bool is_dual_link) {}
+ 
++static void virtual_stream_encoder_lvds_set_stream_attribute(
++	struct stream_encoder *enc,
++	struct dc_crtc_timing *crtc_timing)
++{}
++
+ static void virtual_stream_encoder_set_throttled_vcp_size(
+ 	struct stream_encoder *enc,
+ 	struct fixed31_32 avg_time_slots_per_mtp)
+@@ -115,6 +120,8 @@ static const struct stream_encoder_funcs virtual_str_enc_funcs = {
+ 		virtual_stream_encoder_hdmi_set_stream_attribute,
+ 	.dvi_set_stream_attribute =
+ 		virtual_stream_encoder_dvi_set_stream_attribute,
++	.lvds_set_stream_attribute =
++		virtual_stream_encoder_lvds_set_stream_attribute,
+ 	.set_throttled_vcp_size =
+ 		virtual_stream_encoder_set_throttled_vcp_size,
+ 	.update_hdmi_info_packets =
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-remove-check-dpia-hpd-status-for-bw-.patch b/queue-6.17/drm-amd-display-remove-check-dpia-hpd-status-for-bw-.patch
new file mode 100644
index 0000000000..e24dee8e91
--- /dev/null
+++ b/queue-6.17/drm-amd-display-remove-check-dpia-hpd-status-for-bw-.patch
@@ -0,0 +1,137 @@
+From 21610ac786873343a354aa05b982db324f4839b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jul 2025 19:04:31 +0800
+Subject: drm/amd/display: Remove check DPIA HPD status for BW Allocation
+
+From: Cruise Hung <Cruise.Hung@amd.com>
+
+[ Upstream commit d0e164f72e6a16e64f660023dc7ad25b31b8b08d ]
+
+[Why & How]
+Link hpd_status is for embedded DPIA only.
+Do not check hpd_status for BW allocation logic.
+
+Reviewed-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com>
+Signed-off-by: Cruise Hung <Cruise.Hung@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/link/link_validation.c |  6 +-
+ .../dc/link/protocols/link_dp_dpia_bw.c       | 60 +++++++++----------
+ 2 files changed, 32 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_validation.c b/drivers/gpu/drm/amd/display/dc/link/link_validation.c
+index aecaf37eee352..acdc162de5353 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_validation.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_validation.c
+@@ -408,8 +408,10 @@ enum dc_status link_validate_dp_tunnel_bandwidth(const struct dc *dc, const stru
+ 		link = stream->link;
+ 
+ 		if (!(link && (stream->signal == SIGNAL_TYPE_DISPLAY_PORT
+-				|| stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+-				&& link->hpd_status))
++				|| stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)))
++			continue;
++
++		if ((link->ep_type == DISPLAY_ENDPOINT_USB4_DPIA) && (link->hpd_status == false))
+ 			continue;
+ 
+ 		dp_tunnel_settings = get_dp_tunnel_settings(new_ctx, stream);
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+index 819bf2d8ba530..906d85ca89569 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c
+@@ -48,8 +48,7 @@
+  */
+ static bool link_dp_is_bw_alloc_available(struct dc_link *link)
+ {
+-	return (link && link->hpd_status
+-		&& link->dpcd_caps.usb4_dp_tun_info.dp_tun_cap.bits.dp_tunneling
++	return (link && link->dpcd_caps.usb4_dp_tun_info.dp_tun_cap.bits.dp_tunneling
+ 		&& link->dpcd_caps.usb4_dp_tun_info.dp_tun_cap.bits.dpia_bw_alloc
+ 		&& link->dpcd_caps.usb4_dp_tun_info.driver_bw_cap.bits.driver_bw_alloc_support);
+ }
+@@ -226,35 +225,35 @@ bool link_dpia_enable_usb4_dp_bw_alloc_mode(struct dc_link *link)
+ 	bool ret = false;
+ 	uint8_t val;
+ 
+-	if (link->hpd_status) {
+-		val = DPTX_BW_ALLOC_MODE_ENABLE | DPTX_BW_ALLOC_UNMASK_IRQ;
++	val = DPTX_BW_ALLOC_MODE_ENABLE | DPTX_BW_ALLOC_UNMASK_IRQ;
+ 
+-		if (core_link_write_dpcd(link, DPTX_BW_ALLOCATION_MODE_CONTROL, &val, sizeof(uint8_t)) == DC_OK) {
+-			DC_LOG_DEBUG("%s:  link[%d] DPTX BW allocation mode enabled", __func__, link->link_index);
++	if (core_link_write_dpcd(link, DPTX_BW_ALLOCATION_MODE_CONTROL, &val, sizeof(uint8_t)) == DC_OK) {
++		DC_LOG_DEBUG("%s:  link[%d] DPTX BW allocation mode enabled", __func__, link->link_index);
+ 
+-			retrieve_usb4_dp_bw_allocation_info(link);
++		retrieve_usb4_dp_bw_allocation_info(link);
+ 
+-			if (link->dpia_bw_alloc_config.nrd_max_link_rate && link->dpia_bw_alloc_config.nrd_max_lane_count) {
+-				link->reported_link_cap.link_rate = link->dpia_bw_alloc_config.nrd_max_link_rate;
+-				link->reported_link_cap.lane_count = link->dpia_bw_alloc_config.nrd_max_lane_count;
+-			}
++		if (
++				link->dpia_bw_alloc_config.nrd_max_link_rate
++				&& link->dpia_bw_alloc_config.nrd_max_lane_count) {
++			link->reported_link_cap.link_rate = link->dpia_bw_alloc_config.nrd_max_link_rate;
++			link->reported_link_cap.lane_count = link->dpia_bw_alloc_config.nrd_max_lane_count;
++		}
+ 
+-			link->dpia_bw_alloc_config.bw_alloc_enabled = true;
+-			ret = true;
+-
+-			if (link->dc->debug.dpia_debug.bits.enable_usb4_bw_zero_alloc_patch) {
+-				/*
+-				 * During DP tunnel creation, the CM preallocates BW
+-				 * and reduces the estimated BW of other DPIAs.
+-				 * The CM releases the preallocation only when the allocation is complete.
+-				 * Perform a zero allocation to make the CM release the preallocation
+-				 * and correctly update the estimated BW for all DPIAs per host router.
+-				 */
+-				link_dp_dpia_allocate_usb4_bandwidth_for_stream(link, 0);
+-			}
+-		} else
+-			DC_LOG_DEBUG("%s:  link[%d] failed to enable DPTX BW allocation mode", __func__, link->link_index);
+-	}
++		link->dpia_bw_alloc_config.bw_alloc_enabled = true;
++		ret = true;
++
++		if (link->dc->debug.dpia_debug.bits.enable_usb4_bw_zero_alloc_patch) {
++			/*
++			 * During DP tunnel creation, the CM preallocates BW
++			 * and reduces the estimated BW of other DPIAs.
++			 * The CM releases the preallocation only when the allocation is complete.
++			 * Perform a zero allocation to make the CM release the preallocation
++			 * and correctly update the estimated BW for all DPIAs per host router.
++			 */
++			link_dp_dpia_allocate_usb4_bandwidth_for_stream(link, 0);
++		}
++	} else
++		DC_LOG_DEBUG("%s:  link[%d] failed to enable DPTX BW allocation mode", __func__, link->link_index);
+ 
+ 	return ret;
+ }
+@@ -297,15 +296,12 @@ void dpia_handle_usb4_bandwidth_allocation_for_link(struct dc_link *link, int pe
+ {
+ 	if (link && link->dpcd_caps.usb4_dp_tun_info.dp_tun_cap.bits.dp_tunneling
+ 			&& link->dpia_bw_alloc_config.bw_alloc_enabled) {
+-		//1. Hot Plug
+-		if (link->hpd_status && peak_bw > 0) {
++		if (peak_bw > 0) {
+ 			// If DP over USB4 then we need to check BW allocation
+ 			link->dpia_bw_alloc_config.link_max_bw = peak_bw;
+ 
+ 			link_dpia_send_bw_alloc_request(link, peak_bw);
+-		}
+-		//2. Cold Unplug
+-		else if (!link->hpd_status)
++		} else
+ 			dpia_bw_alloc_unplug(link);
+ 	}
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch b/queue-6.17/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
new file mode 100644
index 0000000000..7086b9aaf5
--- /dev/null
+++ b/queue-6.17/drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
@@ -0,0 +1,44 @@
+From b54686f5271db715cf45bf889b17bf586126966e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 13:58:21 +0800
+Subject: drm/amd/display: Reset apply_eamless_boot_optimization when dpms_off
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Danny Wang <Danny.Wang@amd.com>
+
+[ Upstream commit ad335b5fc9ed1cdeb33fbe97d2969b3a2eedaf3e ]
+
+[WHY&HOW]
+The user closed the lid while the system was powering on and opened it
+again before the “apply_seamless_boot_optimization” was set to false,
+resulting in the eDP remaining blank.
+Reset the “apply_seamless_boot_optimization” to false when dpms off.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Danny Wang <Danny.Wang@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index bc364792d9d31..2d2f4c4bdc97e 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -3404,7 +3404,7 @@ static void update_seamless_boot_flags(struct dc *dc,
+ 		int surface_count,
+ 		struct dc_stream_state *stream)
+ {
+-	if (get_seamless_boot_stream_count(context) > 0 && surface_count > 0) {
++	if (get_seamless_boot_stream_count(context) > 0 && (surface_count > 0 || stream->dpms_off)) {
+ 		/* Optimize seamless boot flag keeps clocks and watermarks high until
+ 		 * first flip. After first flip, optimization is required to lower
+ 		 * bandwidth. Important to note that it is expected UEFI will
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch b/queue-6.17/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
new file mode 100644
index 0000000000..38c5e308a4
--- /dev/null
+++ b/queue-6.17/drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
@@ -0,0 +1,45 @@
+From dc3dd63d13e5d46b89a110f9163334a6e96b66c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 20:18:22 -0500
+Subject: drm/amd/display: Set up pixel encoding for YCBCR422
+
+From: Mario Limonciello <Mario.Limonciello@amd.com>
+
+[ Upstream commit 5e76bc677cb7c92b37d8bc66bb67a18922895be2 ]
+
+[Why]
+fill_stream_properties_from_drm_display_mode() will not configure pixel
+encoding to YCBCR422 when the DRM color format supports YCBCR422 but not
+YCBCR420 or YCBCR4444.  Instead it will fallback to RGB.
+
+[How]
+Add support for YCBCR422 in pixel encoding mapping.
+
+Suggested-by: Mauri Carvalho <mcarvalho3@lenovo.com>
+Reviewed-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Mario Limonciello <Mario.Limonciello@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8eb2fc4133487..3762b3c0ef983 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6399,6 +6399,9 @@ static void fill_stream_properties_from_drm_display_mode(
+ 			&& aconnector
+ 			&& aconnector->force_yuv420_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
++	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR422)
++			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
++		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR422;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444)
+ 			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR444;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch b/queue-6.17/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
new file mode 100644
index 0000000000..c0a8320608
--- /dev/null
+++ b/queue-6.17/drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
@@ -0,0 +1,162 @@
+From f65e08127df45749813a4292d5bdabbf76746c41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 09:45:26 -0400
+Subject: drm/amd/display: Support HW cursor 180 rot for any number of pipe
+ splits
+
+From: Ivan Lipski <ivan.lipski@amd.com>
+
+[ Upstream commit 8a359f0f138d5ac7ceffd21b73279be50e516c0a ]
+
+[Why]
+For the HW cursor, its current position in the pipe_ctx->stream struct is
+not affected by the 180 rotation, i. e. the top left corner is still at
+0,0. However, the DPP & HUBP set_cursor_position functions require rotated
+position.
+
+The current approach is hard-coded for ODM 2:1, thus it's failing for
+ODM 4:1, resulting in a double cursor.
+
+[How]
+Instead of calculating the new cursor position relatively to the
+viewports, we calculate it using a viewavable clip_rect of each plane.
+
+The clip_rects are first offset and scaled to the same space as the
+src_rect, i. e. Stream space -> Plane space.
+
+In case of a pipe split, which divides the plane into 2 or more viewports,
+the clip_rect is the union of all the viewports of the given plane.
+
+With the assumption that the viewports in HUBP's set_cursor_position are
+in the Plane space as well, it should produce a correct cursor position
+for any number of pipe splits.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../amd/display/dc/hwss/dcn10/dcn10_hwseq.c   | 73 +++++++------------
+ 1 file changed, 27 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+index 39910f73ecd06..6a2fdbe974b53 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+@@ -3628,6 +3628,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	int y_plane = pipe_ctx->plane_state->dst_rect.y;
+ 	int x_pos = pos_cpy.x;
+ 	int y_pos = pos_cpy.y;
++	int clip_x = pipe_ctx->plane_state->clip_rect.x;
++	int clip_width = pipe_ctx->plane_state->clip_rect.width;
+ 
+ 	if ((pipe_ctx->top_pipe != NULL) || (pipe_ctx->bottom_pipe != NULL)) {
+ 		if ((pipe_ctx->plane_state->src_rect.width != pipe_ctx->plane_res.scl_data.viewport.width) ||
+@@ -3646,7 +3648,7 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	 */
+ 
+ 	/**
+-	 * Translate cursor from stream space to plane space.
++	 * Translate cursor and clip offset from stream space to plane space.
+ 	 *
+ 	 * If the cursor is scaled then we need to scale the position
+ 	 * to be in the approximately correct place. We can't do anything
+@@ -3663,6 +3665,10 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 				pipe_ctx->plane_state->dst_rect.width;
+ 		y_pos = (y_pos - y_plane) * pipe_ctx->plane_state->src_rect.height /
+ 				pipe_ctx->plane_state->dst_rect.height;
++		clip_x = (clip_x - x_plane) * pipe_ctx->plane_state->src_rect.width /
++				pipe_ctx->plane_state->dst_rect.width;
++		clip_width = clip_width * pipe_ctx->plane_state->src_rect.width /
++				pipe_ctx->plane_state->dst_rect.width;
+ 	}
+ 
+ 	/**
+@@ -3709,30 +3715,18 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 
+ 
+ 	if (param.rotation == ROTATION_ANGLE_0) {
+-		int viewport_width =
+-			pipe_ctx->plane_res.scl_data.viewport.width;
+-		int viewport_x =
+-			pipe_ctx->plane_res.scl_data.viewport.x;
+ 
+ 		if (param.mirror) {
+-			if (pipe_split_on || odm_combine_on) {
+-				if (pos_cpy.x >= viewport_width + viewport_x) {
+-					pos_cpy.x = 2 * viewport_width
+-							- pos_cpy.x + 2 * viewport_x;
+-				} else {
+-					uint32_t temp_x = pos_cpy.x;
+-
+-					pos_cpy.x = 2 * viewport_x - pos_cpy.x;
+-					if (temp_x >= viewport_x +
+-						(int)hubp->curs_attr.width || pos_cpy.x
+-						<= (int)hubp->curs_attr.width +
+-						pipe_ctx->plane_state->src_rect.x) {
+-						pos_cpy.x = 2 * viewport_width - temp_x;
+-					}
+-				}
+-			} else {
+-				pos_cpy.x = viewport_width - pos_cpy.x + 2 * viewport_x;
+-			}
++			/*
++			 * The plane is split into multiple viewports.
++			 * The combination of all viewports span the
++			 * entirety of the clip rect.
++			 *
++			 * For no pipe_split, viewport_width is represents
++			 * the full width of the clip_rect, so we can just
++			 * mirror it.
++			 */
++			pos_cpy.x = clip_width - pos_cpy.x + 2 * clip_x;
+ 		}
+ 	}
+ 	// Swap axis and mirror horizontally
+@@ -3802,30 +3796,17 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
+ 	}
+ 	// Mirror horizontally and vertically
+ 	else if (param.rotation == ROTATION_ANGLE_180) {
+-		int viewport_width =
+-			pipe_ctx->plane_res.scl_data.viewport.width;
+-		int viewport_x =
+-			pipe_ctx->plane_res.scl_data.viewport.x;
+-
+ 		if (!param.mirror) {
+-			if (pipe_split_on || odm_combine_on) {
+-				if (pos_cpy.x >= viewport_width + viewport_x) {
+-					pos_cpy.x = 2 * viewport_width
+-							- pos_cpy.x + 2 * viewport_x;
+-				} else {
+-					uint32_t temp_x = pos_cpy.x;
+-
+-					pos_cpy.x = 2 * viewport_x - pos_cpy.x;
+-					if (temp_x >= viewport_x +
+-						(int)hubp->curs_attr.width || pos_cpy.x
+-						<= (int)hubp->curs_attr.width +
+-						pipe_ctx->plane_state->src_rect.x) {
+-						pos_cpy.x = temp_x + viewport_width;
+-					}
+-				}
+-			} else {
+-				pos_cpy.x = viewport_width - pos_cpy.x + 2 * viewport_x;
+-			}
++			/*
++			 * The plane is split into multiple viewports.
++			 * The combination of all viewports span the
++			 * entirety of the clip rect.
++			 *
++			 * For no pipe_split, viewport_width is represents
++			 * the full width of the clip_rect, so we can just
++			 * mirror it.
++			 */
++			pos_cpy.x = clip_width - pos_cpy.x + 2 * clip_x;
+ 		}
+ 
+ 		/**
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch b/queue-6.17/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
new file mode 100644
index 0000000000..aa69c35480
--- /dev/null
+++ b/queue-6.17/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
@@ -0,0 +1,123 @@
+From cab2f7f75a8e71f764afeaaefe299f35e4409623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 11:51:42 +0800
+Subject: drm/amd/display: update dpp/disp clock from smu clock table
+
+From: Paul Hsieh <Paul.Hsieh@amd.com>
+
+[ Upstream commit 2e72fdba8a32ce062a86571edff4592710c26215 ]
+
+[Why]
+The reason some high-resolution monitors fail to display properly
+is that this platform does not support sufficiently high DPP and
+DISP clock frequencies
+
+[How]
+Update DISP and DPP clocks from the smu clock table then DML can
+filter these mode if not support.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Paul Hsieh <Paul.Hsieh@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c    | 16 +++++++++++++++
+ .../amd/display/dc/dml/dcn301/dcn301_fpu.c    | 20 ++++++++++++++++---
+ 2 files changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+index 9e2ef0e724fcf..7aee02d562923 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+@@ -563,6 +563,7 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ {
+ 	int i, j;
+ 	struct clk_bw_params *bw_params = clk_mgr->base.bw_params;
++	uint32_t max_dispclk = 0, max_dppclk = 0;
+ 
+ 	j = -1;
+ 
+@@ -584,6 +585,15 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		return;
+ 	}
+ 
++	/* dispclk and dppclk can be max at any voltage, same number of levels for both */
++	if (clock_table->NumDispClkLevelsEnabled <= VG_NUM_DISPCLK_DPM_LEVELS &&
++	    clock_table->NumDispClkLevelsEnabled <= VG_NUM_DPPCLK_DPM_LEVELS) {
++		max_dispclk = find_max_clk_value(clock_table->DispClocks, clock_table->NumDispClkLevelsEnabled);
++		max_dppclk = find_max_clk_value(clock_table->DppClocks, clock_table->NumDispClkLevelsEnabled);
++	} else {
++		ASSERT(0);
++	}
++
+ 	bw_params->clk_table.num_entries = j + 1;
+ 
+ 	for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) {
+@@ -591,11 +601,17 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 		bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 		bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage);
++
++		/* Now update clocks we do read */
++		bw_params->clk_table.entries[i].dispclk_mhz = max_dispclk;
++		bw_params->clk_table.entries[i].dppclk_mhz = max_dppclk;
+ 	}
+ 	bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk;
+ 	bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 	bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 	bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dispclk_mhz = find_max_clk_value(clock_table->DispClocks, VG_NUM_DISPCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dppclk_mhz = find_max_clk_value(clock_table->DppClocks, VG_NUM_DPPCLK_DPM_LEVELS);
+ 
+ 	bw_params->vram_type = bios_info->memory_type;
+ 	bw_params->num_channels = bios_info->ma_channel_number;
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+index 0c0b2d67c9cd9..2066a65c69bbc 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+@@ -326,7 +326,7 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 	struct dcn301_resource_pool *pool = TO_DCN301_RES_POOL(dc->res_pool);
+ 	struct clk_limit_table *clk_table = &bw_params->clk_table;
+ 	unsigned int i, closest_clk_lvl;
+-	int j;
++	int j = 0, max_dispclk_mhz = 0, max_dppclk_mhz = 0;
+ 
+ 	dc_assert_fp_enabled();
+ 
+@@ -338,6 +338,15 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 	dcn3_01_soc.num_chans = bw_params->num_channels;
+ 
+ 	ASSERT(clk_table->num_entries);
++
++	/* Prepass to find max clocks independent of voltage level. */
++	for (i = 0; i < clk_table->num_entries; ++i) {
++		if (clk_table->entries[i].dispclk_mhz > max_dispclk_mhz)
++			max_dispclk_mhz = clk_table->entries[i].dispclk_mhz;
++		if (clk_table->entries[i].dppclk_mhz > max_dppclk_mhz)
++			max_dppclk_mhz = clk_table->entries[i].dppclk_mhz;
++	}
++
+ 	for (i = 0; i < clk_table->num_entries; i++) {
+ 		/* loop backwards*/
+ 		for (closest_clk_lvl = 0, j = dcn3_01_soc.num_states - 1; j >= 0; j--) {
+@@ -353,8 +362,13 @@ void dcn301_fpu_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_p
+ 		s[i].socclk_mhz = clk_table->entries[i].socclk_mhz;
+ 		s[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 2;
+ 
+-		s[i].dispclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
+-		s[i].dppclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++		/* Clocks independent of voltage level. */
++		s[i].dispclk_mhz = max_dispclk_mhz ? max_dispclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
++
++		s[i].dppclk_mhz = max_dppclk_mhz ? max_dppclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++
+ 		s[i].dram_bw_per_chan_gbps =
+ 			dcn3_01_soc.clock_limits[closest_clk_lvl].dram_bw_per_chan_gbps;
+ 		s[i].dscclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dscclk_mhz;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-update-tiled-to-tiled-copy-command.patch b/queue-6.17/drm-amd-display-update-tiled-to-tiled-copy-command.patch
new file mode 100644
index 0000000000..4da711ed2e
--- /dev/null
+++ b/queue-6.17/drm-amd-display-update-tiled-to-tiled-copy-command.patch
@@ -0,0 +1,40 @@
+From 368cfdacf36492fa6e5759cfa0fb343454aedfac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 14:13:53 +0200
+Subject: drm/amd/display: Update tiled to tiled copy command
+
+From: Ostrowski Rafal <rostrows@amd.com>
+
+[ Upstream commit 19f76f2390be5abe8d5ed986780b73564ba2baca ]
+
+[Why & How]
+Tiled command rect dimensions is 1 based, do rect_x/y - 1 internally
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Ostrowski Rafal <rostrows@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+index f5ef1a07078e5..714c468c010d3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
++++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c
+@@ -2072,8 +2072,8 @@ bool dmub_lsdma_send_tiled_to_tiled_copy_command(
+ 	lsdma_data->u.tiled_copy_data.dst_swizzle_mode = params.swizzle_mode;
+ 	lsdma_data->u.tiled_copy_data.src_element_size = params.element_size;
+ 	lsdma_data->u.tiled_copy_data.dst_element_size = params.element_size;
+-	lsdma_data->u.tiled_copy_data.rect_x           = params.rect_x;
+-	lsdma_data->u.tiled_copy_data.rect_y           = params.rect_y;
++	lsdma_data->u.tiled_copy_data.rect_x           = params.rect_x - 1;
++	lsdma_data->u.tiled_copy_data.rect_y           = params.rect_y - 1;
+ 	lsdma_data->u.tiled_copy_data.dcc              = params.dcc;
+ 	lsdma_data->u.tiled_copy_data.tmz              = params.tmz;
+ 	lsdma_data->u.tiled_copy_data.read_compress    = params.read_compress;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-wait-for-otg-update-pending-latch-be.patch b/queue-6.17/drm-amd-display-wait-for-otg-update-pending-latch-be.patch
new file mode 100644
index 0000000000..38f281a8c0
--- /dev/null
+++ b/queue-6.17/drm-amd-display-wait-for-otg-update-pending-latch-be.patch
@@ -0,0 +1,110 @@
+From 208a6d082e3238eb42774f523a7ee17c5c57eba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 16:05:10 -0400
+Subject: drm/amd/display: wait for otg update pending latch before clock
+ optimization
+
+From: Yihan Zhu <Yihan.Zhu@amd.com>
+
+[ Upstream commit f382e2d0faad0e0d73f626dbd71f2a4fce03975b ]
+
+[WHY & HOW]
+OTG pending update unlatched will cause system fail, wait OTG fully disabled to
+avoid this error.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Yihan Zhu <Yihan.Zhu@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/core/dc_hw_sequencer.c  |  2 ++
+ .../amd/display/dc/inc/hw/timing_generator.h   |  1 +
+ .../drm/amd/display/dc/optc/dcn32/dcn32_optc.h |  1 +
+ .../drm/amd/display/dc/optc/dcn35/dcn35_optc.c | 18 ++++++++++++++++++
+ 4 files changed, 22 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+index ec4e80e5b6eb2..d82b1cb467f4b 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+@@ -1177,6 +1177,8 @@ void hwss_wait_for_odm_update_pending_complete(struct dc *dc, struct dc_state *c
+ 		tg = otg_master->stream_res.tg;
+ 		if (tg->funcs->wait_odm_doublebuffer_pending_clear)
+ 			tg->funcs->wait_odm_doublebuffer_pending_clear(tg);
++		if (tg->funcs->wait_otg_disable)
++			tg->funcs->wait_otg_disable(tg);
+ 	}
+ 
+ 	/* ODM update may require to reprogram blank pattern for each OPP */
+diff --git a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+index 267ace4eef8a3..f2de2cf23859e 100644
+--- a/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
++++ b/drivers/gpu/drm/amd/display/dc/inc/hw/timing_generator.h
+@@ -374,6 +374,7 @@ struct timing_generator_funcs {
+ 	void (*wait_drr_doublebuffer_pending_clear)(struct timing_generator *tg);
+ 	void (*set_long_vtotal)(struct timing_generator *optc, const struct long_vtotal_params *params);
+ 	void (*wait_odm_doublebuffer_pending_clear)(struct timing_generator *tg);
++	void (*wait_otg_disable)(struct timing_generator *optc);
+ 	bool (*get_optc_double_buffer_pending)(struct timing_generator *tg);
+ 	bool (*get_otg_double_buffer_pending)(struct timing_generator *tg);
+ 	bool (*get_pipe_update_pending)(struct timing_generator *tg);
+diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h b/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h
+index d159e3ed3bb3c..ead92ad78a234 100644
+--- a/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h
++++ b/drivers/gpu/drm/amd/display/dc/optc/dcn32/dcn32_optc.h
+@@ -62,6 +62,7 @@
+ 	SF(OTG0_OTG_CONTROL, OTG_DISABLE_POINT_CNTL, mask_sh),\
+ 	SF(OTG0_OTG_CONTROL, OTG_FIELD_NUMBER_CNTL, mask_sh),\
+ 	SF(OTG0_OTG_CONTROL, OTG_OUT_MUX, mask_sh),\
++	SF(OTG0_OTG_CONTROL, OTG_CURRENT_MASTER_EN_STATE, mask_sh),\
+ 	SF(OTG0_OTG_STEREO_CONTROL, OTG_STEREO_EN, mask_sh),\
+ 	SF(OTG0_OTG_STEREO_CONTROL, OTG_STEREO_SYNC_OUTPUT_LINE_NUM, mask_sh),\
+ 	SF(OTG0_OTG_STEREO_CONTROL, OTG_STEREO_SYNC_OUTPUT_POLARITY, mask_sh),\
+diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c b/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
+index 72bff94cb57da..52d5ea98c86b1 100644
+--- a/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/optc/dcn35/dcn35_optc.c
+@@ -162,6 +162,8 @@ static bool optc35_disable_crtc(struct timing_generator *optc)
+ 	REG_WAIT(OTG_CLOCK_CONTROL,
+ 			OTG_BUSY, 0,
+ 			1, 100000);
++	REG_WAIT(OTG_CONTROL, OTG_CURRENT_MASTER_EN_STATE, 0, 1, 100000);
++
+ 	optc1_clear_optc_underflow(optc);
+ 
+ 	return true;
+@@ -428,6 +430,21 @@ static void optc35_set_long_vtotal(
+ 	}
+ }
+ 
++static void optc35_wait_otg_disable(struct timing_generator *optc)
++{
++	struct optc *optc1;
++	uint32_t is_master_en;
++
++	if (!optc || !optc->ctx)
++		return;
++
++	optc1 = DCN10TG_FROM_TG(optc);
++
++	REG_GET(OTG_CONTROL, OTG_MASTER_EN, &is_master_en);
++	if (!is_master_en)
++		REG_WAIT(OTG_CLOCK_CONTROL, OTG_CURRENT_MASTER_EN_STATE, 0, 1, 100000);
++}
++
+ static const struct timing_generator_funcs dcn35_tg_funcs = {
+ 		.validate_timing = optc1_validate_timing,
+ 		.program_timing = optc1_program_timing,
+@@ -479,6 +496,7 @@ static const struct timing_generator_funcs dcn35_tg_funcs = {
+ 		.set_odm_bypass = optc32_set_odm_bypass,
+ 		.set_odm_combine = optc35_set_odm_combine,
+ 		.get_optc_source = optc2_get_optc_source,
++		.wait_otg_disable = optc35_wait_otg_disable,
+ 		.set_h_timing_div_manual_mode = optc32_set_h_timing_div_manual_mode,
+ 		.set_out_mux = optc3_set_out_mux,
+ 		.set_drr_trigger_window = optc3_set_drr_trigger_window,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-display-wait-until-otg-enable-state-is-clear.patch b/queue-6.17/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
new file mode 100644
index 0000000000..29079f86e7
--- /dev/null
+++ b/queue-6.17/drm-amd-display-wait-until-otg-enable-state-is-clear.patch
@@ -0,0 +1,48 @@
+From 61143fb0e0be5ac0e712b4379c14b4975620d3f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 16:56:59 +0800
+Subject: drm/amd/display: Wait until OTG enable state is cleared
+
+From: TungYu Lu <tungyu.lu@amd.com>
+
+[ Upstream commit e7496c15d830689cc4fc666b976c845ed2c5ed28 ]
+
+[Why]
+Customer reported an issue that OS starts and stops device multiple times
+during driver installation. Frequently disabling and enabling OTG may
+prevent OTG from being safely disabled and cause incorrect configuration
+upon the next enablement.
+
+[How]
+Add a wait until OTG_CURRENT_MASTER_EN_STATE is cleared as a short term
+solution.
+
+Reviewed-by: Dillon Varone <dillon.varone@amd.com>
+Signed-off-by: TungYu Lu <tungyu.lu@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
+index ff79c38287df1..5af13706e6014 100644
+--- a/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/optc/dcn401/dcn401_optc.c
+@@ -226,6 +226,11 @@ bool optc401_disable_crtc(struct timing_generator *optc)
+ 	REG_UPDATE(CONTROL,
+ 			VTG0_ENABLE, 0);
+ 
++	// wait until CRTC_CURRENT_MASTER_EN_STATE == 0
++	REG_WAIT(OTG_CONTROL,
++			 OTG_CURRENT_MASTER_EN_STATE,
++			 0, 10, 15000);
++
+ 	/* CRTC disabled, so disable  clock. */
+ 	REG_WAIT(OTG_CLOCK_CONTROL,
+ 			OTG_BUSY, 0,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-pm-increase-smc-timeout-on-si-and-warn-v3.patch b/queue-6.17/drm-amd-pm-increase-smc-timeout-on-si-and-warn-v3.patch
new file mode 100644
index 0000000000..e1e5ea8c47
--- /dev/null
+++ b/queue-6.17/drm-amd-pm-increase-smc-timeout-on-si-and-warn-v3.patch
@@ -0,0 +1,104 @@
+From a02e5aeda77be85d6dad514a423dccf3414a7e76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:11:05 +0200
+Subject: drm/amd/pm: Increase SMC timeout on SI and warn (v3)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 813d13524a3bdcc5f0253e06542440ca74c2653a ]
+
+The SMC can take an excessive amount of time to process some
+messages under some conditions.
+
+Background:
+Sending a message to the SMC works by writing the message into
+the mmSMC_MESSAGE_0 register and its optional parameter into
+the mmSMC_SCRATCH0, and then polling mmSMC_RESP_0. Previously
+the timeout was AMDGPU_MAX_USEC_TIMEOUT, ie. 100 ms.
+
+Increase the timeout to 200 ms for all messages and to 1 sec for
+a few messages which I've observed to be especially slow:
+PPSMC_MSG_NoForcedLevel
+PPSMC_MSG_SetEnabledLevels
+PPSMC_MSG_SetForcedLevels
+PPSMC_MSG_DisableULV
+PPSMC_MSG_SwitchToSwState
+
+This fixes the following problems on Tahiti when switching
+from a lower clock power state to a higher clock state, such
+as when DC turns on a display which was previously turned off.
+
+* si_restrict_performance_levels_before_switch would fail
+  (if the user previously forced high clocks using sysfs)
+* si_set_sw_state would fail (always)
+
+It turns out that both of those failures were SMC timeouts and
+that the SMC actually didn't fail or hang, just needs more time
+to process those.
+
+Add a warning when there is an SMC timeout to make it easier to
+identify this type of problem in the future.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c | 26 ++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c
+index 4e65ab9e931c9..281a5e377aee4 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_smc.c
+@@ -172,20 +172,42 @@ PPSMC_Result amdgpu_si_send_msg_to_smc(struct amdgpu_device *adev,
+ {
+ 	u32 tmp;
+ 	int i;
++	int usec_timeout;
++
++	/* SMC seems to process some messages exceptionally slowly. */
++	switch (msg) {
++	case PPSMC_MSG_NoForcedLevel:
++	case PPSMC_MSG_SetEnabledLevels:
++	case PPSMC_MSG_SetForcedLevels:
++	case PPSMC_MSG_DisableULV:
++	case PPSMC_MSG_SwitchToSwState:
++		usec_timeout = 1000000; /* 1 sec */
++		break;
++	default:
++		usec_timeout = 200000; /* 200 ms */
++		break;
++	}
+ 
+ 	if (!amdgpu_si_is_smc_running(adev))
+ 		return PPSMC_Result_Failed;
+ 
+ 	WREG32(mmSMC_MESSAGE_0, msg);
+ 
+-	for (i = 0; i < adev->usec_timeout; i++) {
++	for (i = 0; i < usec_timeout; i++) {
+ 		tmp = RREG32(mmSMC_RESP_0);
+ 		if (tmp != 0)
+ 			break;
+ 		udelay(1);
+ 	}
+ 
+-	return (PPSMC_Result)RREG32(mmSMC_RESP_0);
++	tmp = RREG32(mmSMC_RESP_0);
++	if (tmp == 0) {
++		drm_warn(adev_to_drm(adev),
++			"%s timeout on message: %x (SMC_SCRATCH0: %x)\n",
++			__func__, msg, RREG32(mmSMC_SCRATCH0));
++	}
++
++	return (PPSMC_Result)tmp;
+ }
+ 
+ PPSMC_Result amdgpu_si_wait_for_smc_inactive(struct amdgpu_device *adev)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-pm-refine-amdgpu-pm-sysfs-node-error-code.patch b/queue-6.17/drm-amd-pm-refine-amdgpu-pm-sysfs-node-error-code.patch
new file mode 100644
index 0000000000..61ead81dde
--- /dev/null
+++ b/queue-6.17/drm-amd-pm-refine-amdgpu-pm-sysfs-node-error-code.patch
@@ -0,0 +1,44 @@
+From 326b7b542c94429707e809ec0011e36fcfd0c4c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:29:12 +0800
+Subject: drm/amd/pm: refine amdgpu pm sysfs node error code
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+[ Upstream commit cf32515a70618c0fb2319bd4a855f4d9447940a8 ]
+
+v1:
+Returns different error codes based on the scenario to help the user app understand
+the AMDGPU device status when an exception occurs.
+
+v2:
+change -NODEV to -EBUSY.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+index 5fbfe7333b54d..1fca183827c7c 100644
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -110,9 +110,10 @@ static int amdgpu_pm_dev_state_check(struct amdgpu_device *adev, bool runpm)
+ 	bool runpm_check = runpm ? adev->in_runpm : false;
+ 
+ 	if (amdgpu_in_reset(adev))
+-		return -EPERM;
++		return -EBUSY;
++
+ 	if (adev->in_suspend && !runpm_check)
+-		return -EPERM;
++		return -EBUSY;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch b/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
new file mode 100644
index 0000000000..b84d8fbac6
--- /dev/null
+++ b/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
@@ -0,0 +1,37 @@
+From 50fa5b15c97284a91bef0121a2474a127ddbaaaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:15:45 +0530
+Subject: drm/amd/pm: Use cached metrics data on aldebaran
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
+
+Cached metrics data validity is 1ms on aldebaran. It's not reasonable
+for any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index c63d2e28954d0..b067147b7c41f 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1781,7 +1781,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..1c7e2fec81
--- /dev/null
+++ b/queue-6.17/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From b994fc20c2e317eade5f4c2e558f4b5b6f2273ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index 9ad46f545d15c..599eddb5a67d5 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -1897,7 +1897,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-add-fallback-to-pipe-reset-if-kcq-ring-re.patch b/queue-6.17/drm-amdgpu-add-fallback-to-pipe-reset-if-kcq-ring-re.patch
new file mode 100644
index 0000000000..719f395100
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-add-fallback-to-pipe-reset-if-kcq-ring-re.patch
@@ -0,0 +1,70 @@
+From fda9b5abda5374686c1520ffd7edcbd283d417fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 13:11:06 +0800
+Subject: drm/amdgpu: Add fallback to pipe reset if KCQ ring reset fails
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit 7469567d882374dcac3fdb8b300e0f28cf875a75 ]
+
+Add a fallback mechanism to attempt pipe reset when KCQ reset
+fails to recover the ring. After performing the KCQ reset and
+queue remapping, test the ring functionality. If the ring test
+fails, initiate a pipe reset as an additional recovery step.
+
+v2: fix the typo (Lijo)
+v3: try pipeline reset when kiq mapping fails (Lijo)
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+index 51babf5c78c86..f06bc94cf6e14 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+@@ -3562,6 +3562,7 @@ static int gfx_v9_4_3_reset_kcq(struct amdgpu_ring *ring,
+ 	struct amdgpu_device *adev = ring->adev;
+ 	struct amdgpu_kiq *kiq = &adev->gfx.kiq[ring->xcc_id];
+ 	struct amdgpu_ring *kiq_ring = &kiq->ring;
++	int reset_mode = AMDGPU_RESET_TYPE_PER_QUEUE;
+ 	unsigned long flags;
+ 	int r;
+ 
+@@ -3599,6 +3600,7 @@ static int gfx_v9_4_3_reset_kcq(struct amdgpu_ring *ring,
+ 		if (!(adev->gfx.compute_supported_reset & AMDGPU_RESET_TYPE_PER_PIPE))
+ 			return -EOPNOTSUPP;
+ 		r = gfx_v9_4_3_reset_hw_pipe(ring);
++		reset_mode = AMDGPU_RESET_TYPE_PER_PIPE;
+ 		dev_info(adev->dev, "ring: %s pipe reset :%s\n", ring->name,
+ 				r ? "failed" : "successfully");
+ 		if (r)
+@@ -3621,10 +3623,20 @@ static int gfx_v9_4_3_reset_kcq(struct amdgpu_ring *ring,
+ 	r = amdgpu_ring_test_ring(kiq_ring);
+ 	spin_unlock_irqrestore(&kiq->ring_lock, flags);
+ 	if (r) {
++		if (reset_mode == AMDGPU_RESET_TYPE_PER_QUEUE)
++			goto pipe_reset;
++
+ 		dev_err(adev->dev, "fail to remap queue\n");
+ 		return r;
+ 	}
+ 
++	if (reset_mode == AMDGPU_RESET_TYPE_PER_QUEUE) {
++		r = amdgpu_ring_test_ring(ring);
++		if (r)
++			goto pipe_reset;
++	}
++
++
+ 	return amdgpu_ring_reset_helper_end(ring, timedout_fence);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch b/queue-6.17/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
new file mode 100644
index 0000000000..5807cc8c4b
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
@@ -0,0 +1,137 @@
+From 1a3a01207cc8c0b50547572bbcea5b30c0062984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jul 2025 16:16:02 +0800
+Subject: drm/amdgpu: add range check for RAS bad page address
+
+From: Tao Zhou <tao.zhou1@amd.com>
+
+[ Upstream commit 2b17c240e8cd9ac61d3c82277fbed27edad7f002 ]
+
+Exclude invalid bad pages.
+
+Signed-off-by: Tao Zhou <tao.zhou1@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 58 ++++++++++++-------------
+ 1 file changed, 28 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 540817e296da6..c88123302a071 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -136,9 +136,9 @@ enum amdgpu_ras_retire_page_reservation {
+ 
+ atomic_t amdgpu_ras_in_intr = ATOMIC_INIT(0);
+ 
+-static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
++static int amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+ 				uint64_t addr);
+-static bool amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
++static int amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
+ 				uint64_t addr);
+ #ifdef CONFIG_X86_MCE_AMD
+ static void amdgpu_register_bad_pages_mca_notifier(struct amdgpu_device *adev);
+@@ -169,18 +169,16 @@ static int amdgpu_reserve_page_direct(struct amdgpu_device *adev, uint64_t addre
+ 	struct eeprom_table_record err_rec;
+ 	int ret;
+ 
+-	if ((address >= adev->gmc.mc_vram_size) ||
+-	    (address >= RAS_UMC_INJECT_ADDR_LIMIT)) {
++	ret = amdgpu_ras_check_bad_page(adev, address);
++	if (ret == -EINVAL) {
+ 		dev_warn(adev->dev,
+-		         "RAS WARN: input address 0x%llx is invalid.\n",
+-		         address);
++			"RAS WARN: input address 0x%llx is invalid.\n",
++			address);
+ 		return -EINVAL;
+-	}
+-
+-	if (amdgpu_ras_check_bad_page(adev, address)) {
++	} else if (ret == 1) {
+ 		dev_warn(adev->dev,
+-			 "RAS WARN: 0x%llx has already been marked as bad page!\n",
+-			 address);
++			"RAS WARN: 0x%llx has already been marked as bad page!\n",
++			address);
+ 		return 0;
+ 	}
+ 
+@@ -513,22 +511,16 @@ static ssize_t amdgpu_ras_debugfs_ctrl_write(struct file *f,
+ 		ret = amdgpu_ras_feature_enable(adev, &data.head, 1);
+ 		break;
+ 	case 2:
+-		if ((data.inject.address >= adev->gmc.mc_vram_size &&
+-		    adev->gmc.mc_vram_size) ||
+-		    (data.inject.address >= RAS_UMC_INJECT_ADDR_LIMIT)) {
+-			dev_warn(adev->dev, "RAS WARN: input address "
+-					"0x%llx is invalid.",
++		/* umc ce/ue error injection for a bad page is not allowed */
++		if (data.head.block == AMDGPU_RAS_BLOCK__UMC)
++			ret = amdgpu_ras_check_bad_page(adev, data.inject.address);
++		if (ret == -EINVAL) {
++			dev_warn(adev->dev, "RAS WARN: input address 0x%llx is invalid.",
+ 					data.inject.address);
+-			ret = -EINVAL;
+ 			break;
+-		}
+-
+-		/* umc ce/ue error injection for a bad page is not allowed */
+-		if ((data.head.block == AMDGPU_RAS_BLOCK__UMC) &&
+-		    amdgpu_ras_check_bad_page(adev, data.inject.address)) {
+-			dev_warn(adev->dev, "RAS WARN: inject: 0x%llx has "
+-				 "already been marked as bad!\n",
+-				 data.inject.address);
++		} else if (ret == 1) {
++			dev_warn(adev->dev, "RAS WARN: inject: 0x%llx has already been marked as bad!\n",
++					data.inject.address);
+ 			break;
+ 		}
+ 
+@@ -3134,18 +3126,24 @@ static int amdgpu_ras_load_bad_pages(struct amdgpu_device *adev)
+ 	return ret;
+ }
+ 
+-static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
++static int amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+ 				uint64_t addr)
+ {
+ 	struct ras_err_handler_data *data = con->eh_data;
++	struct amdgpu_device *adev = con->adev;
+ 	int i;
+ 
++	if ((addr >= adev->gmc.mc_vram_size &&
++	    adev->gmc.mc_vram_size) ||
++	    (addr >= RAS_UMC_INJECT_ADDR_LIMIT))
++		return -EINVAL;
++
+ 	addr >>= AMDGPU_GPU_PAGE_SHIFT;
+ 	for (i = 0; i < data->count; i++)
+ 		if (addr == data->bps[i].retired_page)
+-			return true;
++			return 1;
+ 
+-	return false;
++	return 0;
+ }
+ 
+ /*
+@@ -3153,11 +3151,11 @@ static bool amdgpu_ras_check_bad_page_unlock(struct amdgpu_ras *con,
+  *
+  * Note: this check is only for umc block
+  */
+-static bool amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
++static int amdgpu_ras_check_bad_page(struct amdgpu_device *adev,
+ 				uint64_t addr)
+ {
+ 	struct amdgpu_ras *con = amdgpu_ras_get_context(adev);
+-	bool ret = false;
++	int ret = 0;
+ 
+ 	if (!con || !con->eh_data)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch b/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
new file mode 100644
index 0000000000..2dbcf60642
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
@@ -0,0 +1,44 @@
+From 8c00245c9482084b6a97aab79ace5a698a5d7680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:21:16 -0400
+Subject: drm/amdgpu: add support for cyan skillfish gpu_info
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
+
+Some SOCs which are part of the cyan skillfish family
+rely on an explicit firmware for IP discovery.  Add support
+for the gpu_info firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 097ceee79ece6..274bb4d857d36 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -95,6 +95,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin");
++MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin");
+ 
+ #define AMDGPU_RESUME_MS		2000
+ #define AMDGPU_MAX_RETRY_LIMIT		2
+@@ -2595,6 +2596,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
+ 			return 0;
+ 		chip_name = "navi12";
+ 		break;
++	case CHIP_CYAN_SKILLFISH:
++		chip_name = "cyan_skillfish";
++		break;
+ 	}
+ 
+ 	err = amdgpu_ucode_request(adev, &adev->firmware.gpu_info_fw,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-add-to-custom-amdgpu_drm_release-drm_dev_.patch b/queue-6.17/drm-amdgpu-add-to-custom-amdgpu_drm_release-drm_dev_.patch
new file mode 100644
index 0000000000..60c3269893
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-add-to-custom-amdgpu_drm_release-drm_dev_.patch
@@ -0,0 +1,50 @@
+From 0c390b0a16b901d6fc56f2f8516c3613272bb0e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:37:25 -0400
+Subject: drm/amdgpu: add to custom amdgpu_drm_release drm_dev_enter/exit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+[ Upstream commit c31f486bc8dd6f481adcb9cca4a6e1837b8cf127 ]
+
+User queues are disabled before GEM objects are released
+(protecting against user app crashes).
+No races with PCI hot-unplug (because drm_dev_enter prevents cleanup
+if iewdevice is being removed).
+
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index c1792e9ab126d..5e81ff3ffdc3f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2937,11 +2937,14 @@ static int amdgpu_drm_release(struct inode *inode, struct file *filp)
+ {
+ 	struct drm_file *file_priv = filp->private_data;
+ 	struct amdgpu_fpriv *fpriv = file_priv->driver_priv;
++	struct drm_device *dev = file_priv->minor->dev;
++	int idx;
+ 
+-	if (fpriv) {
++	if (fpriv && drm_dev_enter(dev, &idx)) {
+ 		fpriv->evf_mgr.fd_closing = true;
+ 		amdgpu_eviction_fence_destroy(&fpriv->evf_mgr);
+ 		amdgpu_userq_mgr_fini(&fpriv->userq_mgr);
++		drm_dev_exit(idx);
+ 	}
+ 
+ 	return drm_release(inode, filp);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch b/queue-6.17/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
new file mode 100644
index 0000000000..c05c7b4a0a
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
@@ -0,0 +1,40 @@
+From e05507b12410c70f656ee893b765f899905d89a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:01:32 -0500
+Subject: drm/amdgpu: Allow kfd CRIU with no buffer objects
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
+
+The kfd CRIU checkpoint ioctl would return an error if trying
+to checkpoint a process with no kfd buffer objects.
+
+This is a normal case and should not be an error.
+
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 43115a3744694..8535a52a62cab 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2571,8 +2571,8 @@ static int criu_restore(struct file *filep,
+ 	pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
+ 		 args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
+ 
+-	if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size ||
+-	    !args->num_devices || !args->num_bos)
++	if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
++	    !args->priv_data_size || !args->num_devices)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&p->mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch b/queue-6.17/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
new file mode 100644
index 0000000000..c957d6dcbc
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
@@ -0,0 +1,41 @@
+From b36320f7a9e3e35896790efeb35e5ef069ae102b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 18:57:05 +0800
+Subject: drm/amdgpu/atom: Check kcalloc() for WS buffer in
+ amdgpu_atom_execute_table_locked()
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+[ Upstream commit cc9a8e238e42c1f43b98c097995137d644b69245 ]
+
+kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws
+remains NULL while ectx.ws_size is set, leading to a potential NULL
+pointer dereference in atom_get_src_int() when accessing WS entries.
+
+Return -ENOMEM on allocation failure to avoid the NULL dereference.
+
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/atom.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index 427b073de2fc1..1a7591ca2f9a0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -1246,6 +1246,10 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index,
+ 	ectx.last_jump_jiffies = 0;
+ 	if (ws) {
+ 		ectx.ws = kcalloc(4, ws, GFP_KERNEL);
++		if (!ectx.ws) {
++			ret = -ENOMEM;
++			goto free;
++		}
+ 		ectx.ws_size = ws;
+ 	} else {
+ 		ectx.ws = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-avoid-jpeg-v5.0.1-poison-irq-call-trace-o.patch b/queue-6.17/drm-amdgpu-avoid-jpeg-v5.0.1-poison-irq-call-trace-o.patch
new file mode 100644
index 0000000000..a9cce6d016
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-avoid-jpeg-v5.0.1-poison-irq-call-trace-o.patch
@@ -0,0 +1,36 @@
+From 248369815e1727a761e852d7de1904c2cec5852a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:18:42 +0800
+Subject: drm/amdgpu: Avoid jpeg v5.0.1 poison irq call trace on sriov guest
+
+From: Mangesh Gadre <Mangesh.Gadre@amd.com>
+
+[ Upstream commit 01152c30eef972c5ca3b3eeb14f2984fa48d18c2 ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini
+
+Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+index 8d74455dab1e2..7731ef262d39f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+@@ -315,7 +315,7 @@ static int jpeg_v5_0_1_hw_fini(struct amdgpu_ip_block *ip_block)
+ 			ret = jpeg_v5_0_1_set_powergating_state(ip_block, AMD_PG_STATE_GATE);
+ 	}
+ 
+-	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG))
++	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG) && !amdgpu_sriov_vf(adev))
+ 		amdgpu_irq_put(adev, &adev->jpeg.inst->ras_poison_irq, 0);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch b/queue-6.17/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
new file mode 100644
index 0000000000..a890459491
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
@@ -0,0 +1,103 @@
+From 0e671cdea70ba4cbedd56f32712215037afebeef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Jul 2025 12:06:55 +0800
+Subject: drm/amdgpu: Avoid rma causes GPU duplicate reset
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 21c0ffa612c98bcc6dab5bd9d977a18d565ee28e ]
+
+Try to ensure poison creation handle is completed in time
+to set device rma value.
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 17 ++++++++++-------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h |  1 +
+ 2 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index c88123302a071..54909bcf181f3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -3285,7 +3285,6 @@ static void amdgpu_ras_do_page_retirement(struct work_struct *work)
+ 					      page_retirement_dwork.work);
+ 	struct amdgpu_device *adev = con->adev;
+ 	struct ras_err_data err_data;
+-	unsigned long err_cnt;
+ 
+ 	/* If gpu reset is ongoing, delay retiring the bad pages */
+ 	if (amdgpu_in_reset(adev) || amdgpu_ras_in_recovery(adev)) {
+@@ -3297,13 +3296,9 @@ static void amdgpu_ras_do_page_retirement(struct work_struct *work)
+ 	amdgpu_ras_error_data_init(&err_data);
+ 
+ 	amdgpu_umc_handle_bad_pages(adev, &err_data);
+-	err_cnt = err_data.err_addr_cnt;
+ 
+ 	amdgpu_ras_error_data_fini(&err_data);
+ 
+-	if (err_cnt && amdgpu_ras_is_rma(adev))
+-		amdgpu_ras_reset_gpu(adev);
+-
+ 	amdgpu_ras_schedule_retirement_dwork(con,
+ 			AMDGPU_RAS_RETIRE_PAGE_INTERVAL);
+ }
+@@ -3357,6 +3352,9 @@ static int amdgpu_ras_poison_creation_handler(struct amdgpu_device *adev,
+ 	if (total_detect_count)
+ 		schedule_delayed_work(&ras->page_retirement_dwork, 0);
+ 
++	if (amdgpu_ras_is_rma(adev) && atomic_cmpxchg(&ras->rma_in_recovery, 0, 1) == 0)
++		amdgpu_ras_reset_gpu(adev);
++
+ 	return 0;
+ }
+ 
+@@ -3392,6 +3390,12 @@ static int amdgpu_ras_poison_consumption_handler(struct amdgpu_device *adev,
+ 		reset_flags |= msg.reset;
+ 	}
+ 
++	/*
++	 * Try to ensure poison creation handler is completed first
++	 * to set rma if bad page exceed threshold.
++	 */
++	flush_delayed_work(&con->page_retirement_dwork);
++
+ 	/* for RMA, amdgpu_ras_poison_creation_handler will trigger gpu reset */
+ 	if (reset_flags && !amdgpu_ras_is_rma(adev)) {
+ 		if (reset_flags & AMDGPU_RAS_GPU_RESET_MODE1_RESET)
+@@ -3401,8 +3405,6 @@ static int amdgpu_ras_poison_consumption_handler(struct amdgpu_device *adev,
+ 		else
+ 			reset = reset_flags;
+ 
+-		flush_delayed_work(&con->page_retirement_dwork);
+-
+ 		con->gpu_reset_flags |= reset;
+ 		amdgpu_ras_reset_gpu(adev);
+ 
+@@ -3570,6 +3572,7 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev, bool init_bp_info)
+ 	mutex_init(&con->recovery_lock);
+ 	INIT_WORK(&con->recovery_work, amdgpu_ras_do_recovery);
+ 	atomic_set(&con->in_recovery, 0);
++	atomic_set(&con->rma_in_recovery, 0);
+ 	con->eeprom_control.bad_channel_bitmap = 0;
+ 
+ 	max_eeprom_records_count = amdgpu_ras_eeprom_max_record_count(&con->eeprom_control);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+index 927d6bff734ae..699953c02649f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+@@ -515,6 +515,7 @@ struct amdgpu_ras {
+ 	/* gpu recovery */
+ 	struct work_struct recovery_work;
+ 	atomic_t in_recovery;
++	atomic_t rma_in_recovery;
+ 	struct amdgpu_device *adev;
+ 	/* error handler data */
+ 	struct ras_err_handler_data *eh_data;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch b/queue-6.17/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
new file mode 100644
index 0000000000..ae021decf9
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
@@ -0,0 +1,36 @@
+From f042237df1d35a0d4d95a3033875169666151489 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:22:30 +0800
+Subject: drm/amdgpu: Avoid vcn v5.0.1 poison irq call trace on sriov guest
+
+From: Mangesh Gadre <Mangesh.Gadre@amd.com>
+
+[ Upstream commit 37551277dfed796b6749e4fa52bdb62403cfdb42 ]
+
+Sriov guest side doesn't init ras feature hence the poison irq shouldn't
+be put during hw fini
+
+Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+index cb560d64da08c..8ef4a8b2fae99 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+@@ -284,7 +284,7 @@ static int vcn_v5_0_1_hw_fini(struct amdgpu_ip_block *ip_block)
+ 			vinst->set_pg_state(vinst, AMD_PG_STATE_GATE);
+ 	}
+ 
+-	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN))
++	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__VCN) && !amdgpu_sriov_vf(adev))
+ 		amdgpu_irq_put(adev, &adev->vcn.inst->ras_poison_irq, 0);
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-check-vcn-sram-load-return-value.patch b/queue-6.17/drm-amdgpu-check-vcn-sram-load-return-value.patch
new file mode 100644
index 0000000000..728dd2c77e
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-check-vcn-sram-load-return-value.patch
@@ -0,0 +1,255 @@
+From 1b611f17190282e88495956ce94c58ed20008ea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Jul 2025 01:28:02 +0530
+Subject: drm/amdgpu: Check vcn sram load return value
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit faab5ea0836733ef1c8e83cf6b05690a5c9066be ]
+
+Log an error when vcn sram load fails in indirect mode
+and return the same error value.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c   | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c | 11 ++++++++---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c | 10 ++++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c |  9 +++++++--
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c | 11 ++++++++---
+ 8 files changed, 63 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+index 68b4371df0f1b..d1481e6d57ecd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+@@ -865,6 +865,7 @@ static int vcn_v2_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst->fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring = &adev->vcn.inst->ring_dec;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	vcn_v2_0_enable_static_power_gating(vinst);
+ 
+@@ -948,8 +949,13 @@ static int vcn_v2_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 		UVD, 0, mmUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, 0, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, 0, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	/* force RBC into idle state */
+ 	rb_bufsz = order_base_2(ring->ring_size);
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index f13ed3c1e29c2..fdd8e33916f27 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -1012,6 +1012,7 @@ static int vcn_v2_5_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, mmUVD_POWER_STATUS), 1,
+@@ -1102,8 +1103,13 @@ static int vcn_v2_5_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 		VCN, 0, mmUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_dec;
+ 	/* force RBC into idle state */
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+index 866222fc10a05..b7c4fcca18bb1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+@@ -1041,6 +1041,7 @@ static int vcn_v3_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t rb_bufsz, tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, mmUVD_POWER_STATUS), 1,
+@@ -1133,8 +1134,13 @@ static int vcn_v3_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 	WREG32_SOC15_DPG_MODE(inst_idx, SOC15_DPG_MODE_OFFSET(
+ 		VCN, inst_idx, mmUVD_VCPU_CNTL), tmp, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_dec;
+ 	/* force RBC into idle state */
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+index ac55549e20be6..082def4a6bdfe 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+@@ -1012,6 +1012,7 @@ static int vcn_v4_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -1094,8 +1095,13 @@ static int vcn_v4_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst, bool indirect)
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+index ba944a96c0707..2e985c4a288a3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+@@ -849,7 +849,7 @@ static int vcn_v4_0_3_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared =
+ 						adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+-	int vcn_inst;
++	int vcn_inst, ret;
+ 	uint32_t tmp;
+ 
+ 	vcn_inst = GET_INST(VCN, inst_idx);
+@@ -942,8 +942,13 @@ static int vcn_v4_0_3_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		VCN, 0, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+index 11fec716e846a..3ce49dfd3897d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_5.c
+@@ -924,6 +924,7 @@ static int vcn_v4_0_5_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 	volatile struct amdgpu_vcn4_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -1004,8 +1005,13 @@ static int vcn_v4_0_5_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		VCN, inst_idx, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
+index 07a6e95828808..f8bb90fe764bb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_0.c
+@@ -713,6 +713,7 @@ static int vcn_v5_0_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 	volatile struct amdgpu_vcn5_fw_shared *fw_shared = adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	uint32_t tmp;
++	int ret;
+ 
+ 	/* disable register anti-hang mechanism */
+ 	WREG32_P(SOC15_REG_OFFSET(VCN, inst_idx, regUVD_POWER_STATUS), 1,
+@@ -766,8 +767,12 @@ static int vcn_v5_0_0_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		VCN, inst_idx, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, 0);
++		dev_err(adev->dev, "%s: vcn sram load failed %d\n", __func__, ret);
++		if (ret)
++			return ret;
++	}
+ 
+ 	ring = &adev->vcn.inst[inst_idx].ring_enc[0];
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+index cdefd7fcb0da6..d8bbb93767318 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+@@ -605,7 +605,7 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		adev->vcn.inst[inst_idx].fw_shared.cpu_addr;
+ 	struct amdgpu_ring *ring;
+ 	struct dpg_pause_state state = {.fw_based = VCN_DPG_STATE__PAUSE};
+-	int vcn_inst;
++	int vcn_inst, ret;
+ 	uint32_t tmp;
+ 
+ 	vcn_inst = GET_INST(VCN, inst_idx);
+@@ -666,8 +666,13 @@ static int vcn_v5_0_1_start_dpg_mode(struct amdgpu_vcn_inst *vinst,
+ 		VCN, 0, regUVD_MASTINT_EN),
+ 		UVD_MASTINT_EN__VCPU_EN_MASK, 0, indirect);
+ 
+-	if (indirect)
+-		amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++	if (indirect) {
++		ret = amdgpu_vcn_psp_update_sram(adev, inst_idx, AMDGPU_UCODE_ID_VCN0_RAM);
++		if (ret) {
++			dev_err(adev->dev, "vcn sram load failed %d\n", ret);
++			return ret;
++		}
++	}
+ 
+ 	/* resetting ring, fw should not check RB ring */
+ 	fw_shared->sq.queue_mode |= FW_QUEUE_RING_RESET;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-correct-info-field-of-bad-page-threshold-.patch b/queue-6.17/drm-amdgpu-correct-info-field-of-bad-page-threshold-.patch
new file mode 100644
index 0000000000..b65e1ea691
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-correct-info-field-of-bad-page-threshold-.patch
@@ -0,0 +1,46 @@
+From d261bae7b081f31530319e235472f2a548e7f42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 22:13:44 +0800
+Subject: drm/amdgpu: Correct info field of bad page threshold exceed CPER
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit f320ed01cf5f2259e2035a56900952cb3cc77e7a ]
+
+Correct valid_bits and ms_chk_bits of section info field for bad page
+threshold exceed CPER to match OOB's behavior.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+index ee937d617c826..54de38dbaf2d5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+@@ -68,7 +68,6 @@ void amdgpu_cper_entry_fill_hdr(struct amdgpu_device *adev,
+ 	hdr->error_severity		= sev;
+ 
+ 	hdr->valid_bits.platform_id	= 1;
+-	hdr->valid_bits.partition_id	= 1;
+ 	hdr->valid_bits.timestamp	= 1;
+ 
+ 	amdgpu_cper_get_timestamp(&hdr->timestamp);
+@@ -220,7 +219,10 @@ int amdgpu_cper_entry_fill_bad_page_threshold_section(struct amdgpu_device *adev
+ 	section->hdr.valid_bits.err_context_cnt = 1;
+ 
+ 	section->info.error_type = RUNTIME;
++	section->info.valid_bits.ms_chk = 1;
+ 	section->info.ms_chk_bits.err_type_valid = 1;
++	section->info.ms_chk_bits.err_type = 1;
++	section->info.ms_chk_bits.pcc = 1;
+ 	section->ctx.reg_ctx_type = CPER_CTX_TYPE_CRASH;
+ 	section->ctx.reg_arr_size = sizeof(section->ctx.reg_dump);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch b/queue-6.17/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
new file mode 100644
index 0000000000..5e95aabc05
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
@@ -0,0 +1,43 @@
+From 8858ed772f5bcce914f5f8a5451fed2b1e3d951c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 12:36:05 +0800
+Subject: drm/amdgpu: Correct the counts of nr_banks and nr_errors
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit 907813e5d7cadfeafab12467d748705a5309efb0 ]
+
+Correct the counts of nr_banks and nr_errors
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+index d1e431818212d..9b31804491500 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+@@ -76,6 +76,7 @@ static void aca_banks_release(struct aca_banks *banks)
+ 	list_for_each_entry_safe(node, tmp, &banks->list, node) {
+ 		list_del(&node->node);
+ 		kvfree(node);
++		banks->nr_banks--;
+ 	}
+ }
+ 
+@@ -238,6 +239,7 @@ static struct aca_bank_error *new_bank_error(struct aca_error *aerr, struct aca_
+ 
+ 	mutex_lock(&aerr->lock);
+ 	list_add_tail(&bank_error->node, &aerr->list);
++	aerr->nr_errors++;
+ 	mutex_unlock(&aerr->lock);
+ 
+ 	return bank_error;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-correct-the-loss-of-aca-bank-reg-info.patch b/queue-6.17/drm-amdgpu-correct-the-loss-of-aca-bank-reg-info.patch
new file mode 100644
index 0000000000..91aae50a97
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-correct-the-loss-of-aca-bank-reg-info.patch
@@ -0,0 +1,215 @@
+From 3eaa3092cc9821e5146e8445281d814ac85d55bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 17:18:57 +0800
+Subject: drm/amdgpu: Correct the loss of aca bank reg info
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit d8442bcad0764c5613e9f8b2356f3e0a48327e20 ]
+
+By polling, poll ACA bank count to ensure that valid
+ACA bank reg info can be obtained
+
+v2: add corresponding delay before send msg to SMU to query mca bank info
+(Stanley)
+
+v3: the loop cannot exit. (Thomas)
+
+v4: remove amdgpu_aca_clear_bank_count. (Kevin)
+
+v5: continuously inject ce. If a creation interruption
+occurs at this time, bank reg info will be lost. (Thomas)
+v5: each cycle is delayed by 100ms. (Tao)
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 50 +++++++++++--------------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h |  5 ++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c |  1 +
+ drivers/gpu/drm/amd/amdgpu/umc_v12_0.c  |  5 ++-
+ 4 files changed, 29 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+index 54909bcf181f3..893cae9813fbb 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+@@ -122,7 +122,7 @@ const char *get_ras_block_str(struct ras_common_if *ras_block)
+ /* typical ECC bad page rate is 1 bad page per 100MB VRAM */
+ #define RAS_BAD_PAGE_COVER              (100 * 1024 * 1024ULL)
+ 
+-#define MAX_UMC_POISON_POLLING_TIME_ASYNC  300  //ms
++#define MAX_UMC_POISON_POLLING_TIME_ASYNC  10
+ 
+ #define AMDGPU_RAS_RETIRE_PAGE_INTERVAL 100  //ms
+ 
+@@ -3239,7 +3239,7 @@ static void amdgpu_ras_ecc_log_init(struct ras_ecc_log_info *ecc_log)
+ 
+ 	INIT_RADIX_TREE(&ecc_log->de_page_tree, GFP_KERNEL);
+ 	ecc_log->de_queried_count = 0;
+-	ecc_log->prev_de_queried_count = 0;
++	ecc_log->consumption_q_count = 0;
+ }
+ 
+ static void amdgpu_ras_ecc_log_fini(struct ras_ecc_log_info *ecc_log)
+@@ -3259,7 +3259,7 @@ static void amdgpu_ras_ecc_log_fini(struct ras_ecc_log_info *ecc_log)
+ 
+ 	mutex_destroy(&ecc_log->lock);
+ 	ecc_log->de_queried_count = 0;
+-	ecc_log->prev_de_queried_count = 0;
++	ecc_log->consumption_q_count = 0;
+ }
+ 
+ static bool amdgpu_ras_schedule_retirement_dwork(struct amdgpu_ras *con,
+@@ -3309,47 +3309,34 @@ static int amdgpu_ras_poison_creation_handler(struct amdgpu_device *adev,
+ 	int ret = 0;
+ 	struct ras_ecc_log_info *ecc_log;
+ 	struct ras_query_if info;
+-	uint32_t timeout = 0;
++	u32 timeout = MAX_UMC_POISON_POLLING_TIME_ASYNC;
+ 	struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);
+-	uint64_t de_queried_count;
+-	uint32_t new_detect_count, total_detect_count;
+-	uint32_t need_query_count = poison_creation_count;
++	u64 de_queried_count;
++	u64 consumption_q_count;
+ 	enum ras_event_type type = RAS_EVENT_TYPE_POISON_CREATION;
+ 
+ 	memset(&info, 0, sizeof(info));
+ 	info.head.block = AMDGPU_RAS_BLOCK__UMC;
+ 
+ 	ecc_log = &ras->umc_ecc_log;
+-	total_detect_count = 0;
++	ecc_log->de_queried_count = 0;
++	ecc_log->consumption_q_count = 0;
++
+ 	do {
+ 		ret = amdgpu_ras_query_error_status_with_event(adev, &info, type);
+ 		if (ret)
+ 			return ret;
+ 
+ 		de_queried_count = ecc_log->de_queried_count;
+-		if (de_queried_count > ecc_log->prev_de_queried_count) {
+-			new_detect_count = de_queried_count - ecc_log->prev_de_queried_count;
+-			ecc_log->prev_de_queried_count = de_queried_count;
+-			timeout = 0;
+-		} else {
+-			new_detect_count = 0;
+-		}
++		consumption_q_count = ecc_log->consumption_q_count;
+ 
+-		if (new_detect_count) {
+-			total_detect_count += new_detect_count;
+-		} else {
+-			if (!timeout && need_query_count)
+-				timeout = MAX_UMC_POISON_POLLING_TIME_ASYNC;
++		if (de_queried_count && consumption_q_count)
++			break;
+ 
+-			if (timeout) {
+-				if (!--timeout)
+-					break;
+-				msleep(1);
+-			}
+-		}
+-	} while (total_detect_count < need_query_count);
++		msleep(100);
++	} while (--timeout);
+ 
+-	if (total_detect_count)
++	if (de_queried_count)
+ 		schedule_delayed_work(&ras->page_retirement_dwork, 0);
+ 
+ 	if (amdgpu_ras_is_rma(adev) && atomic_cmpxchg(&ras->rma_in_recovery, 0, 1) == 0)
+@@ -3446,7 +3433,8 @@ static int amdgpu_ras_page_retirement_thread(void *param)
+ 				atomic_sub(poison_creation_count, &con->poison_creation_count);
+ 				atomic_sub(poison_creation_count, &con->page_retirement_req_cnt);
+ 			}
+-		} while (atomic_read(&con->poison_creation_count));
++		} while (atomic_read(&con->poison_creation_count) &&
++			!atomic_read(&con->poison_consumption_count));
+ 
+ 		if (ret != -EIO) {
+ 			msg_count = kfifo_len(&con->poison_fifo);
+@@ -3463,6 +3451,7 @@ static int amdgpu_ras_page_retirement_thread(void *param)
+ 			/* gpu mode-1 reset is ongoing or just completed ras mode-1 reset */
+ 			/* Clear poison creation request */
+ 			atomic_set(&con->poison_creation_count, 0);
++			atomic_set(&con->poison_consumption_count, 0);
+ 
+ 			/* Clear poison fifo */
+ 			amdgpu_ras_clear_poison_fifo(adev);
+@@ -3487,6 +3476,8 @@ static int amdgpu_ras_page_retirement_thread(void *param)
+ 				atomic_sub(msg_count, &con->page_retirement_req_cnt);
+ 			}
+ 
++			atomic_set(&con->poison_consumption_count, 0);
++
+ 			/* Wake up work to save bad pages to eeprom */
+ 			schedule_delayed_work(&con->page_retirement_dwork, 0);
+ 		}
+@@ -3590,6 +3581,7 @@ int amdgpu_ras_recovery_init(struct amdgpu_device *adev, bool init_bp_info)
+ 	init_waitqueue_head(&con->page_retirement_wq);
+ 	atomic_set(&con->page_retirement_req_cnt, 0);
+ 	atomic_set(&con->poison_creation_count, 0);
++	atomic_set(&con->poison_consumption_count, 0);
+ 	con->page_retirement_thread =
+ 		kthread_run(amdgpu_ras_page_retirement_thread, adev, "umc_page_retirement");
+ 	if (IS_ERR(con->page_retirement_thread)) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+index 699953c02649f..96cb62a44a35b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h
+@@ -492,8 +492,8 @@ struct ras_ecc_err {
+ struct ras_ecc_log_info {
+ 	struct mutex lock;
+ 	struct radix_tree_root de_page_tree;
+-	uint64_t	de_queried_count;
+-	uint64_t	prev_de_queried_count;
++	uint64_t de_queried_count;
++	uint64_t consumption_q_count;
+ };
+ 
+ struct amdgpu_ras {
+@@ -558,6 +558,7 @@ struct amdgpu_ras {
+ 	struct mutex page_retirement_lock;
+ 	atomic_t page_retirement_req_cnt;
+ 	atomic_t poison_creation_count;
++	atomic_t poison_consumption_count;
+ 	struct mutex page_rsv_lock;
+ 	DECLARE_KFIFO(poison_fifo, struct ras_poison_msg, 128);
+ 	struct ras_ecc_log_info  umc_ecc_log;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
+index c92b8794aa73d..2e039fb778ea8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_umc.c
+@@ -252,6 +252,7 @@ int amdgpu_umc_pasid_poison_handler(struct amdgpu_device *adev,
+ 				block, pasid, pasid_fn, data, reset);
+ 			if (!ret) {
+ 				atomic_inc(&con->page_retirement_req_cnt);
++				atomic_inc(&con->poison_consumption_count);
+ 				wake_up(&con->page_retirement_wq);
+ 			}
+ 		}
+diff --git a/drivers/gpu/drm/amd/amdgpu/umc_v12_0.c b/drivers/gpu/drm/amd/amdgpu/umc_v12_0.c
+index e590cbdd8de96..8dc32787d6250 100644
+--- a/drivers/gpu/drm/amd/amdgpu/umc_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/umc_v12_0.c
+@@ -536,8 +536,11 @@ static int umc_v12_0_update_ecc_status(struct amdgpu_device *adev,
+ 	hwid = REG_GET_FIELD(ipid, MCMP1_IPIDT0, HardwareID);
+ 	mcatype = REG_GET_FIELD(ipid, MCMP1_IPIDT0, McaType);
+ 
+-	if ((hwid != MCA_UMC_HWID_V12_0) || (mcatype != MCA_UMC_MCATYPE_V12_0))
++	/* The IP block decode of consumption is SMU */
++	if (hwid != MCA_UMC_HWID_V12_0 || mcatype != MCA_UMC_MCATYPE_V12_0) {
++		con->umc_ecc_log.consumption_q_count++;
+ 		return 0;
++	}
+ 
+ 	if (!status)
+ 		return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch b/queue-6.17/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
new file mode 100644
index 0000000000..c9d78040e9
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
@@ -0,0 +1,43 @@
+From 260448b50b5e42296c2093b70565021bcd4195a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:25:09 -0400
+Subject: drm/amdgpu: don't enable SMU on cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
+
+Cyan skillfish uses different SMU firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index e814da2b14225..dd7b2b796427c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -2126,7 +2126,6 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
+ 	case IP_VERSION(11, 0, 5):
+ 	case IP_VERSION(11, 0, 9):
+ 	case IP_VERSION(11, 0, 7):
+-	case IP_VERSION(11, 0, 8):
+ 	case IP_VERSION(11, 0, 11):
+ 	case IP_VERSION(11, 0, 12):
+ 	case IP_VERSION(11, 0, 13):
+@@ -2134,6 +2133,10 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
+ 	case IP_VERSION(11, 5, 2):
+ 		amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
+ 		break;
++	case IP_VERSION(11, 0, 8):
++		if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2)
++			amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
++		break;
+ 	case IP_VERSION(12, 0, 0):
+ 	case IP_VERSION(12, 0, 1):
+ 		amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-effective-health-check-before-reset.patch b/queue-6.17/drm-amdgpu-effective-health-check-before-reset.patch
new file mode 100644
index 0000000000..786f87edcf
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-effective-health-check-before-reset.patch
@@ -0,0 +1,97 @@
+From 1e2973e25d950b171b5dbaa9ac9eec48410e0894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jul 2025 20:16:24 +0800
+Subject: drm/amdgpu: Effective health check before reset
+
+From: Ce Sun <cesun102@amd.com>
+
+[ Upstream commit da467352296f8e50c7ab7057ead44a1df1c81496 ]
+
+Move amdgpu_device_health_check into amdgpu_device_gpu_recover to
+ensure that if the device is present can be checked before reset
+
+The reason is:
+1.During the dpc event, the device where the dpc event occurs is not
+present on the bus
+2.When both dpc event and ATHUB event occur simultaneously,the dpc thread
+holds the reset domain lock when detecting error,and the gpu recover thread
+acquires the hive lock.The device is simultaneously in the states of
+amdgpu_ras_in_recovery and occurs_dpc,so gpu recover thread will not go to
+amdgpu_device_health_check.It waits for the reset domain lock held by the
+dpc thread, but dpc thread has not released the reset domain lock.In the dpc
+callback slot_reset,to obtain the hive lock, the hive lock is held by the
+gpu recover thread at this time.So a deadlock occurred
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +++++++---------------
+ 1 file changed, 8 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index c8459337fcb89..dfa68cb411966 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -6132,12 +6132,11 @@ static int amdgpu_device_health_check(struct list_head *device_list_handle)
+ 	return ret;
+ }
+ 
+-static int amdgpu_device_recovery_prepare(struct amdgpu_device *adev,
++static void amdgpu_device_recovery_prepare(struct amdgpu_device *adev,
+ 					  struct list_head *device_list,
+ 					  struct amdgpu_hive_info *hive)
+ {
+ 	struct amdgpu_device *tmp_adev = NULL;
+-	int r;
+ 
+ 	/*
+ 	 * Build list of devices to reset.
+@@ -6157,14 +6156,6 @@ static int amdgpu_device_recovery_prepare(struct amdgpu_device *adev,
+ 	} else {
+ 		list_add_tail(&adev->reset_list, device_list);
+ 	}
+-
+-	if (!amdgpu_sriov_vf(adev) && (!adev->pcie_reset_ctx.occurs_dpc)) {
+-		r = amdgpu_device_health_check(device_list);
+-		if (r)
+-			return r;
+-	}
+-
+-	return 0;
+ }
+ 
+ static void amdgpu_device_recovery_get_reset_lock(struct amdgpu_device *adev,
+@@ -6457,8 +6448,13 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,
+ 	reset_context->hive = hive;
+ 	INIT_LIST_HEAD(&device_list);
+ 
+-	if (amdgpu_device_recovery_prepare(adev, &device_list, hive))
+-		goto end_reset;
++	amdgpu_device_recovery_prepare(adev, &device_list, hive);
++
++	if (!amdgpu_sriov_vf(adev)) {
++		r = amdgpu_device_health_check(&device_list);
++		if (r)
++			goto end_reset;
++	}
+ 
+ 	/* We need to lock reset domain only once both for XGMI and single device */
+ 	amdgpu_device_recovery_get_reset_lock(adev, &device_list);
+@@ -6965,12 +6961,6 @@ pci_ers_result_t amdgpu_pci_slot_reset(struct pci_dev *pdev)
+ 	int r = 0, i;
+ 	u32 memsize;
+ 
+-	/* PCI error slot reset should be skipped During RAS recovery */
+-	if ((amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3) ||
+-	    amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 4)) &&
+-	    amdgpu_ras_in_recovery(adev))
+-		return PCI_ERS_RESULT_RECOVERED;
+-
+ 	dev_info(adev->dev, "PCI error: slot reset callback!!\n");
+ 
+ 	memset(&reset_context, 0, sizeof(reset_context));
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-fix-build-error-when-config_suspend-is-di.patch b/queue-6.17/drm-amdgpu-fix-build-error-when-config_suspend-is-di.patch
new file mode 100644
index 0000000000..138fe98082
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-fix-build-error-when-config_suspend-is-di.patch
@@ -0,0 +1,52 @@
+From afdb8be2a3f639b7867b80729e14c6a24ef36345 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 10:45:28 +0800
+Subject: drm/amdgpu: Fix build error when CONFIG_SUSPEND is disabled
+
+From: Perry Yuan <perry.yuan@amd.com>
+
+[ Upstream commit 8e3967a71e6fca9c871f98b9289b59c82b88b729 ]
+
+The variable `pm_suspend_target_state` is conditionally defined only when
+`CONFIG_SUSPEND` is enabled (see `include/linux/suspend.h`). Directly
+referencing it without guarding by `#ifdef CONFIG_SUSPEND` causes build
+failures when suspend functionality is disabled (e.g., `CONFIG_SUSPEND=n`).
+
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Perry Yuan <perry.yuan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 65f4a76490eac..c1792e9ab126d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -2597,6 +2597,7 @@ static int amdgpu_pmops_suspend(struct device *dev)
+ 	else if (amdgpu_acpi_is_s3_active(adev))
+ 		adev->in_s3 = true;
+ 	if (!adev->in_s0ix && !adev->in_s3) {
++#if IS_ENABLED(CONFIG_SUSPEND)
+ 		/* don't allow going deep first time followed by s2idle the next time */
+ 		if (adev->last_suspend_state != PM_SUSPEND_ON &&
+ 		    adev->last_suspend_state != pm_suspend_target_state) {
+@@ -2604,11 +2605,14 @@ static int amdgpu_pmops_suspend(struct device *dev)
+ 				     pm_suspend_target_state);
+ 			return -EINVAL;
+ 		}
++#endif
+ 		return 0;
+ 	}
+ 
++#if IS_ENABLED(CONFIG_SUSPEND)
+ 	/* cache the state last used for suspend */
+ 	adev->last_suspend_state = pm_suspend_target_state;
++#endif
+ 
+ 	return amdgpu_device_suspend(drm_dev, true);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-fix-fence-signaling-race-condition-in-use.patch b/queue-6.17/drm-amdgpu-fix-fence-signaling-race-condition-in-use.patch
new file mode 100644
index 0000000000..6c2cb16a7d
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-fix-fence-signaling-race-condition-in-use.patch
@@ -0,0 +1,54 @@
+From 67fe75f42275215c4877c8b1403fab23bca90957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 16:00:06 +0800
+Subject: drm/amdgpu: Fix fence signaling race condition in userqueue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jesse.Zhang <Jesse.Zhang@amd.com>
+
+[ Upstream commit b8ae2640f9acd4f411c9227d2493755d03fe440a ]
+
+This commit fixes a potential race condition in the userqueue fence
+signaling mechanism by replacing dma_fence_is_signaled_locked() with
+dma_fence_is_signaled().
+
+The issue occurred because:
+1. dma_fence_is_signaled_locked() should only be used when holding
+   the fence's individual lock, not just the fence list lock
+2. Using the locked variant without the proper fence lock could lead
+   to double-signaling scenarios:
+   - Hardware completion signals the fence
+   - Software path also tries to signal the same fence
+
+By using dma_fence_is_signaled() instead, we properly handle the
+locking hierarchy and avoid the race condition while still maintaining
+the necessary synchronization through the fence_list_lock.
+
+v2: drop the comment (Christian)
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+index c2a983ff23c95..b372baae39797 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+@@ -276,7 +276,7 @@ static int amdgpu_userq_fence_create(struct amdgpu_usermode_queue *userq,
+ 
+ 	/* Check if hardware has already processed the job */
+ 	spin_lock_irqsave(&fence_drv->fence_list_lock, flags);
+-	if (!dma_fence_is_signaled_locked(fence))
++	if (!dma_fence_is_signaled(fence))
+ 		list_add_tail(&userq_fence->link, &fence_drv->fences);
+ 	else
+ 		dma_fence_put(fence);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch b/queue-6.17/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
new file mode 100644
index 0000000000..c76741ea8c
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
@@ -0,0 +1,52 @@
+From 91018e41ba7d49003fa3d02eedde160e0a6c432b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:18:04 +0800
+Subject: drm/amdgpu: fix nullptr err of vm_handle_moved
+
+From: Heng Zhou <Heng.Zhou@amd.com>
+
+[ Upstream commit 859958a7faefe5b7742b7b8cdbc170713d4bf158 ]
+
+If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL.
+So, such kind of amdgpu_bo_va should be updated separately before
+amdgpu_vm_handle_moved.
+
+Signed-off-by: Heng Zhou <Heng.Zhou@amd.com>
+Reviewed-by: Kasiviswanathan, Harish <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+index 902eac2c685f3..30d4a47535882 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -2993,9 +2993,22 @@ int amdgpu_amdkfd_gpuvm_restore_process_bos(void *info, struct dma_fence __rcu *
+ 		struct amdgpu_device *adev = amdgpu_ttm_adev(
+ 			peer_vm->root.bo->tbo.bdev);
+ 
++		struct amdgpu_fpriv *fpriv =
++			container_of(peer_vm, struct amdgpu_fpriv, vm);
++
++		ret = amdgpu_vm_bo_update(adev, fpriv->prt_va, false);
++		if (ret) {
++			dev_dbg(adev->dev,
++				"Memory eviction: handle PRT moved failed, pid %8d. Try again.\n",
++				pid_nr(process_info->pid));
++			goto validate_map_fail;
++		}
++
+ 		ret = amdgpu_vm_handle_moved(adev, peer_vm, &exec.ticket);
+ 		if (ret) {
+-			pr_debug("Memory eviction: handle moved failed. Try again\n");
++			dev_dbg(adev->dev,
++				"Memory eviction: handle moved failed, pid %8d. Try again.\n",
++				pid_nr(process_info->pid));
+ 			goto validate_map_fail;
+ 		}
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-fix-vcn-v5.0.1-poison-irq-call-trace.patch b/queue-6.17/drm-amdgpu-fix-vcn-v5.0.1-poison-irq-call-trace.patch
new file mode 100644
index 0000000000..dcbb3d13ac
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-fix-vcn-v5.0.1-poison-irq-call-trace.patch
@@ -0,0 +1,90 @@
+From f63fd9bcda18d8478a2bb92dae29ba8e5b914eb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Jul 2025 19:33:50 +0800
+Subject: drm/amdgpu: Fix vcn v5.0.1 poison irq call trace
+
+From: Stanley.Yang <Stanley.Yang@amd.com>
+
+[ Upstream commit b1b29aa88f5367d0367c8eeef643635bc6009a9a ]
+
+Why:
+    [13014.890792] Call Trace:
+    [13014.890793]  <TASK>
+    [13014.890795]  ? show_trace_log_lvl+0x1d6/0x2ea
+    [13014.890799]  ? show_trace_log_lvl+0x1d6/0x2ea
+    [13014.890800]  ? vcn_v5_0_1_hw_fini+0xe9/0x110 [amdgpu]
+    [13014.890872]  ? show_regs.part.0+0x23/0x29
+    [13014.890873]  ? show_regs.cold+0x8/0xd
+    [13014.890874]  ? amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+    [13014.890934]  ? __warn+0x8c/0x100
+    [13014.890936]  ? amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+    [13014.890995]  ? report_bug+0xa4/0xd0
+    [13014.890999]  ? handle_bug+0x39/0x90
+    [13014.891001]  ? exc_invalid_op+0x19/0x70
+    [13014.891003]  ? asm_exc_invalid_op+0x1b/0x20
+    [13014.891005]  ? amdgpu_irq_put+0xc6/0xe0 [amdgpu]
+    [13014.891065]  ? amdgpu_irq_put+0x63/0xe0 [amdgpu]
+    [13014.891124]  vcn_v5_0_1_hw_fini+0xe9/0x110 [amdgpu]
+    [13014.891189]  amdgpu_ip_block_hw_fini+0x3b/0x78 [amdgpu]
+    [13014.891309]  amdgpu_device_fini_hw+0x3c1/0x479 [amdgpu]
+How:
+    Add omitted vcn poison irq get call.
+
+Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 10 +++++-----
+ drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c  |  7 +++++++
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+index 54523dc1f7026..03ec4b741d194 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+@@ -1058,6 +1058,11 @@ static int jpeg_v5_0_1_ras_late_init(struct amdgpu_device *adev, struct ras_comm
+ 	if (r)
+ 		return r;
+ 
++	r = amdgpu_ras_bind_aca(adev, AMDGPU_RAS_BLOCK__JPEG,
++				&jpeg_v5_0_1_aca_info, NULL);
++	if (r)
++		goto late_fini;
++
+ 	if (amdgpu_ras_is_supported(adev, ras_block->block) &&
+ 		adev->jpeg.inst->ras_poison_irq.funcs) {
+ 		r = amdgpu_irq_get(adev, &adev->jpeg.inst->ras_poison_irq, 0);
+@@ -1065,11 +1070,6 @@ static int jpeg_v5_0_1_ras_late_init(struct amdgpu_device *adev, struct ras_comm
+ 			goto late_fini;
+ 	}
+ 
+-	r = amdgpu_ras_bind_aca(adev, AMDGPU_RAS_BLOCK__JPEG,
+-				&jpeg_v5_0_1_aca_info, NULL);
+-	if (r)
+-		goto late_fini;
+-
+ 	return 0;
+ 
+ late_fini:
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+index d8bbb93767318..cb560d64da08c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+@@ -1608,6 +1608,13 @@ static int vcn_v5_0_1_ras_late_init(struct amdgpu_device *adev, struct ras_commo
+ 	if (r)
+ 		goto late_fini;
+ 
++	if (amdgpu_ras_is_supported(adev, ras_block->block) &&
++		adev->vcn.inst->ras_poison_irq.funcs) {
++		r = amdgpu_irq_get(adev, &adev->vcn.inst->ras_poison_irq, 0);
++		if (r)
++			goto late_fini;
++	}
++
+ 	return 0;
+ 
+ late_fini:
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-initialize-jpeg-v5_0_1-ras-function.patch b/queue-6.17/drm-amdgpu-initialize-jpeg-v5_0_1-ras-function.patch
new file mode 100644
index 0000000000..852776234c
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-initialize-jpeg-v5_0_1-ras-function.patch
@@ -0,0 +1,42 @@
+From b38e06b1c811d2f6cd0fb3ffce5b991e82136462 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 00:27:52 +0800
+Subject: drm/amdgpu: Initialize jpeg v5_0_1 ras function
+
+From: Mangesh Gadre <Mangesh.Gadre@amd.com>
+
+[ Upstream commit 01fa9758c8498d8930df56eca36c88ba3e9493d4 ]
+
+Initialize jpeg v5_0_1 ras function
+
+Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
+Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+index 03ec4b741d194..8d74455dab1e2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+@@ -196,6 +196,14 @@ static int jpeg_v5_0_1_sw_init(struct amdgpu_ip_block *ip_block)
+ 		}
+ 	}
+ 
++	if (amdgpu_ras_is_supported(adev, AMDGPU_RAS_BLOCK__JPEG)) {
++		r = amdgpu_jpeg_ras_sw_init(adev);
++		if (r) {
++			dev_err(adev->dev, "Failed to initialize jpeg ras block!\n");
++			return r;
++		}
++	}
++
+ 	r = amdgpu_jpeg_reg_dump_init(adev, jpeg_reg_list_5_0_1, ARRAY_SIZE(jpeg_reg_list_5_0_1));
+ 	if (r)
+ 		return r;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-6.17/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..4b236509e3
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From 4dc5e88ed14024554ab57eabd9b85177d2081d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 82d58ac7afb01..5d5e9ee83a5d6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -121,10 +121,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 			fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec[j]);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-notify-pmfw-bad-page-threshold-exceeded.patch b/queue-6.17/drm-amdgpu-notify-pmfw-bad-page-threshold-exceeded.patch
new file mode 100644
index 0000000000..d3becaf92c
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-notify-pmfw-bad-page-threshold-exceeded.patch
@@ -0,0 +1,40 @@
+From c151dd09d934e8f0e8201faaf89117356cb1237b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 09:40:27 +0800
+Subject: drm/amdgpu: Notify pmfw bad page threshold exceeded
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit c8d6e90abe50377110f92702fbebc6efdd22391d ]
+
+Notify pmfw when bad page threshold is exceeded, no matter the module
+parameter 'bad_page_threshold' is set or not.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+index 9bda9ad13f882..88ded6296be34 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+@@ -774,9 +774,10 @@ amdgpu_ras_eeprom_update_header(struct amdgpu_ras_eeprom_control *control)
+ 				control->tbl_rai.health_percent = 0;
+ 			}
+ 			ras->is_rma = true;
+-			/* ignore the -ENOTSUPP return value */
+-			amdgpu_dpm_send_rma_reason(adev);
+ 		}
++
++		/* ignore the -ENOTSUPP return value */
++		amdgpu_dpm_send_rma_reason(adev);
+ 	}
+ 
+ 	if (control->tbl_hdr.version >= RAS_TABLE_VER_V2_1)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-refactor-bad_page_work-for-corner-case-ha.patch b/queue-6.17/drm-amdgpu-refactor-bad_page_work-for-corner-case-ha.patch
new file mode 100644
index 0000000000..a5da44bee2
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-refactor-bad_page_work-for-corner-case-ha.patch
@@ -0,0 +1,207 @@
+From df6edb5ea883254b19140008b81780267d2e9615 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:52:34 -0400
+Subject: drm/amdgpu: refactor bad_page_work for corner case handling
+
+From: Chenglei Xie <Chenglei.Xie@amd.com>
+
+[ Upstream commit d2fa0ec6e0aea6ffbd41939d0c7671db16991ca4 ]
+
+When a poison is consumed on the guest before the guest receives the host's poison creation msg, a corner case may occur to have poison_handler complete processing earlier than it should to cause the guest to hang waiting for the req_bad_pages reply during a VF FLR, resulting in the VM becoming inaccessible in stress tests.
+
+To fix this issue, this patch refactored the mailbox sequence by seperating the bad_page_work into two parts req_bad_pages_work and handle_bad_pages_work.
+Old sequence:
+  1.Stop data exchange work
+  2.Guest sends MB_REQ_RAS_BAD_PAGES to host and keep polling for IDH_RAS_BAD_PAGES_READY
+  3.If the IDH_RAS_BAD_PAGES_READY arrives within timeout limit, re-init the data exchange region for updated bad page info
+    else timeout with error message
+New sequence:
+req_bad_pages_work:
+  1.Stop data exhange work
+  2.Guest sends MB_REQ_RAS_BAD_PAGES to host
+Once Guest receives IDH_RAS_BAD_PAGES_READY event
+handle_bad_pages_work:
+  3.re-init the data exchange region for updated bad page info
+
+Signed-off-by: Chenglei Xie <Chenglei.Xie@amd.com>
+Reviewed-by: Shravan Kumar Gande <Shravankumar.Gande@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h |  3 +-
+ drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c    | 32 +++++++++++++++++++---
+ drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c    | 35 +++++++++++++++++++-----
+ drivers/gpu/drm/amd/amdgpu/soc15.c       |  1 -
+ 4 files changed, 58 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+index 3da3ebb1d9a13..58accf2259b38 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+@@ -267,7 +267,8 @@ struct amdgpu_virt {
+ 	struct amdgpu_irq_src		rcv_irq;
+ 
+ 	struct work_struct		flr_work;
+-	struct work_struct		bad_pages_work;
++	struct work_struct		req_bad_pages_work;
++	struct work_struct		handle_bad_pages_work;
+ 
+ 	struct amdgpu_mm_table		mm_table;
+ 	const struct amdgpu_virt_ops	*ops;
+diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+index 48101a34e049f..9a40107a0869d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c
+@@ -292,14 +292,32 @@ static void xgpu_ai_mailbox_flr_work(struct work_struct *work)
+ 	}
+ }
+ 
+-static void xgpu_ai_mailbox_bad_pages_work(struct work_struct *work)
++static void xgpu_ai_mailbox_req_bad_pages_work(struct work_struct *work)
+ {
+-	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, bad_pages_work);
++	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, req_bad_pages_work);
+ 	struct amdgpu_device *adev = container_of(virt, struct amdgpu_device, virt);
+ 
+ 	if (down_read_trylock(&adev->reset_domain->sem)) {
+ 		amdgpu_virt_fini_data_exchange(adev);
+ 		amdgpu_virt_request_bad_pages(adev);
++		up_read(&adev->reset_domain->sem);
++	}
++}
++
++/**
++ * xgpu_ai_mailbox_handle_bad_pages_work - Reinitialize the data exchange region to get fresh bad page information
++ * @work: pointer to the work_struct
++ *
++ * This work handler is triggered when bad pages are ready, and it reinitializes
++ * the data exchange region to retrieve updated bad page information from the host.
++ */
++static void xgpu_ai_mailbox_handle_bad_pages_work(struct work_struct *work)
++{
++	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, handle_bad_pages_work);
++	struct amdgpu_device *adev = container_of(virt, struct amdgpu_device, virt);
++
++	if (down_read_trylock(&adev->reset_domain->sem)) {
++		amdgpu_virt_fini_data_exchange(adev);
+ 		amdgpu_virt_init_data_exchange(adev);
+ 		up_read(&adev->reset_domain->sem);
+ 	}
+@@ -327,10 +345,15 @@ static int xgpu_ai_mailbox_rcv_irq(struct amdgpu_device *adev,
+ 	struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);
+ 
+ 	switch (event) {
++	case IDH_RAS_BAD_PAGES_READY:
++		xgpu_ai_mailbox_send_ack(adev);
++		if (amdgpu_sriov_runtime(adev))
++			schedule_work(&adev->virt.handle_bad_pages_work);
++		break;
+ 	case IDH_RAS_BAD_PAGES_NOTIFICATION:
+ 		xgpu_ai_mailbox_send_ack(adev);
+ 		if (amdgpu_sriov_runtime(adev))
+-			schedule_work(&adev->virt.bad_pages_work);
++			schedule_work(&adev->virt.req_bad_pages_work);
+ 		break;
+ 	case IDH_UNRECOV_ERR_NOTIFICATION:
+ 		xgpu_ai_mailbox_send_ack(adev);
+@@ -415,7 +438,8 @@ int xgpu_ai_mailbox_get_irq(struct amdgpu_device *adev)
+ 	}
+ 
+ 	INIT_WORK(&adev->virt.flr_work, xgpu_ai_mailbox_flr_work);
+-	INIT_WORK(&adev->virt.bad_pages_work, xgpu_ai_mailbox_bad_pages_work);
++	INIT_WORK(&adev->virt.req_bad_pages_work, xgpu_ai_mailbox_req_bad_pages_work);
++	INIT_WORK(&adev->virt.handle_bad_pages_work, xgpu_ai_mailbox_handle_bad_pages_work);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+index f6d8597452ed0..457972aa56324 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c
+@@ -202,9 +202,6 @@ static int xgpu_nv_send_access_requests_with_param(struct amdgpu_device *adev,
+ 	case IDH_REQ_RAS_CPER_DUMP:
+ 		event = IDH_RAS_CPER_DUMP_READY;
+ 		break;
+-	case IDH_REQ_RAS_BAD_PAGES:
+-		event = IDH_RAS_BAD_PAGES_READY;
+-		break;
+ 	default:
+ 		break;
+ 	}
+@@ -359,14 +356,32 @@ static void xgpu_nv_mailbox_flr_work(struct work_struct *work)
+ 	}
+ }
+ 
+-static void xgpu_nv_mailbox_bad_pages_work(struct work_struct *work)
++static void xgpu_nv_mailbox_req_bad_pages_work(struct work_struct *work)
+ {
+-	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, bad_pages_work);
++	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, req_bad_pages_work);
+ 	struct amdgpu_device *adev = container_of(virt, struct amdgpu_device, virt);
+ 
+ 	if (down_read_trylock(&adev->reset_domain->sem)) {
+ 		amdgpu_virt_fini_data_exchange(adev);
+ 		amdgpu_virt_request_bad_pages(adev);
++		up_read(&adev->reset_domain->sem);
++	}
++}
++
++/**
++ * xgpu_nv_mailbox_handle_bad_pages_work - Reinitialize the data exchange region to get fresh bad page information
++ * @work: pointer to the work_struct
++ *
++ * This work handler is triggered when bad pages are ready, and it reinitializes
++ * the data exchange region to retrieve updated bad page information from the host.
++ */
++static void xgpu_nv_mailbox_handle_bad_pages_work(struct work_struct *work)
++{
++	struct amdgpu_virt *virt = container_of(work, struct amdgpu_virt, handle_bad_pages_work);
++	struct amdgpu_device *adev = container_of(virt, struct amdgpu_device, virt);
++
++	if (down_read_trylock(&adev->reset_domain->sem)) {
++		amdgpu_virt_fini_data_exchange(adev);
+ 		amdgpu_virt_init_data_exchange(adev);
+ 		up_read(&adev->reset_domain->sem);
+ 	}
+@@ -397,10 +412,15 @@ static int xgpu_nv_mailbox_rcv_irq(struct amdgpu_device *adev,
+ 	struct amdgpu_ras *ras = amdgpu_ras_get_context(adev);
+ 
+ 	switch (event) {
++	case IDH_RAS_BAD_PAGES_READY:
++		xgpu_nv_mailbox_send_ack(adev);
++		if (amdgpu_sriov_runtime(adev))
++			schedule_work(&adev->virt.handle_bad_pages_work);
++		break;
+ 	case IDH_RAS_BAD_PAGES_NOTIFICATION:
+ 		xgpu_nv_mailbox_send_ack(adev);
+ 		if (amdgpu_sriov_runtime(adev))
+-			schedule_work(&adev->virt.bad_pages_work);
++			schedule_work(&adev->virt.req_bad_pages_work);
+ 		break;
+ 	case IDH_UNRECOV_ERR_NOTIFICATION:
+ 		xgpu_nv_mailbox_send_ack(adev);
+@@ -485,7 +505,8 @@ int xgpu_nv_mailbox_get_irq(struct amdgpu_device *adev)
+ 	}
+ 
+ 	INIT_WORK(&adev->virt.flr_work, xgpu_nv_mailbox_flr_work);
+-	INIT_WORK(&adev->virt.bad_pages_work, xgpu_nv_mailbox_bad_pages_work);
++	INIT_WORK(&adev->virt.req_bad_pages_work, xgpu_nv_mailbox_req_bad_pages_work);
++	INIT_WORK(&adev->virt.handle_bad_pages_work, xgpu_nv_mailbox_handle_bad_pages_work);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
+index 9e74c9822e622..9785fada4fa79 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
+@@ -741,7 +741,6 @@ static void soc15_reg_base_init(struct amdgpu_device *adev)
+ void soc15_set_virt_ops(struct amdgpu_device *adev)
+ {
+ 	adev->virt.ops = &xgpu_ai_virt_ops;
+-
+ 	/* init soc15 reg base early enough so we can
+ 	 * request request full access for sriov before
+ 	 * set_ip_blocks. */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-reject-gang-submissions-under-sriov.patch b/queue-6.17/drm-amdgpu-reject-gang-submissions-under-sriov.patch
new file mode 100644
index 0000000000..33c3abd5a1
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-reject-gang-submissions-under-sriov.patch
@@ -0,0 +1,52 @@
+From c79c119ca71d0e73af3a914373fe6d159ee61bba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 13:14:43 +0200
+Subject: drm/amdgpu: reject gang submissions under SRIOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
+
+Gang submission means that the kernel driver guarantees that multiple
+submissions are executed on the HW at the same time on different engines.
+
+Background is that those submissions then depend on each other and each
+can't finish stand alone.
+
+SRIOV now uses world switch to preempt submissions on the engines to allow
+sharing the HW resources between multiple VFs.
+
+The problem is now that the SRIOV world switch can't know about such inter
+dependencies and will cause a timeout if it waits for a partially running
+gang submission.
+
+To conclude SRIOV and gang submissions are fundamentally incompatible at
+the moment. For now just disable them.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index d541e214a18c8..1ce1fd0c87a57 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -286,7 +286,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
+ 		}
+ 	}
+ 
+-	if (!p->gang_size) {
++	if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) {
+ 		ret = -EINVAL;
+ 		goto free_all_kdata;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-release-hive-reference-properly.patch b/queue-6.17/drm-amdgpu-release-hive-reference-properly.patch
new file mode 100644
index 0000000000..916136c7dc
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-release-hive-reference-properly.patch
@@ -0,0 +1,63 @@
+From 921f0e05b4fa5b5c7ab06f5bbfbd1be2fc3a9eb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:37:37 +0530
+Subject: drm/amdgpu: Release hive reference properly
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit c1456fadce0c99175f97e66c2b982dd051e01aa2 ]
+
+xgmi hive reference is taken on function entry, but not released
+correctly for all paths. Use __free() to release reference properly.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Ce Sun <cesun102@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++----
+ drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h   | 4 ++++
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 274bb4d857d36..56a737df87cc7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -6880,7 +6880,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_sta
+ {
+ 	struct drm_device *dev = pci_get_drvdata(pdev);
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+-	struct amdgpu_hive_info *hive = amdgpu_get_xgmi_hive(adev);
++	struct amdgpu_hive_info *hive __free(xgmi_put_hive) =
++		amdgpu_get_xgmi_hive(adev);
+ 	struct amdgpu_reset_context reset_context;
+ 	struct list_head device_list;
+ 
+@@ -6911,10 +6912,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_sta
+ 		amdgpu_device_recovery_get_reset_lock(adev, &device_list);
+ 		amdgpu_device_halt_activities(adev, NULL, &reset_context, &device_list,
+ 					      hive, false);
+-		if (hive) {
++		if (hive)
+ 			mutex_unlock(&hive->hive_lock);
+-			amdgpu_put_xgmi_hive(hive);
+-		}
+ 		return PCI_ERS_RESULT_NEED_RESET;
+ 	case pci_channel_io_perm_failure:
+ 		/* Permanent error, prepare for device removal */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h
+index bba0b26fee8f1..5f36aff17e79e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.h
+@@ -126,4 +126,8 @@ uint32_t amdgpu_xgmi_get_max_bandwidth(struct amdgpu_device *adev);
+ 
+ void amgpu_xgmi_set_max_speed_width(struct amdgpu_device *adev,
+ 				    uint16_t max_speed, uint8_t max_width);
++
++/* Cleanup macro for use with __free(xgmi_put_hive) */
++DEFINE_FREE(xgmi_put_hive, struct amdgpu_hive_info *, if (_T) amdgpu_put_xgmi_hive(_T))
++
+ #endif
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch b/queue-6.17/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
new file mode 100644
index 0000000000..797de6142c
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
@@ -0,0 +1,114 @@
+From ddea0bc4f7eaacae02929159471f27325843b5c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:50:36 +0200
+Subject: drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
+
+Update the legacy (non-DC) display code to respect the maximum
+pixel clock for HDMI and DVI-D. Reject modes that would require
+a higher pixel clock than can be supported.
+
+Also update the maximum supported HDMI clock value depending on
+the ASIC type.
+
+For reference, see the DC code:
+check max_hdmi_pixel_clock in dce*_resource.c
+
+v2:
+Fix maximum clocks for DVI-D and DVI/HDMI adapters.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/amdgpu_connectors.c    | 57 ++++++++++++++-----
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index 5e375e9c4f5de..a381de8648e54 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -1195,29 +1195,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector)
+ 		amdgpu_connector->use_digital = true;
+ }
+ 
++/**
++ * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
++ */
++static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
++{
++	if (adev->asic_type >= CHIP_POLARIS10)
++		return 600000;
++	else if (adev->asic_type >= CHIP_TONGA)
++		return 300000;
++	else
++		return 297000;
++}
++
++/**
++ * Validates the given display mode on DVI and HDMI connectors,
++ * including analog signals on DVI-I.
++ */
+ static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
+ 					    const struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
++	const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev);
++	const int max_dvi_single_link_pixel_clock = 165000;
++	int max_digital_pixel_clock_khz;
+ 
+ 	/* XXX check mode bandwidth */
+ 
+-	if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
+-		if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
+-			return MODE_OK;
+-		} else if (connector->display_info.is_hdmi) {
+-			/* HDMI 1.3+ supports max clock of 340 Mhz */
+-			if (mode->clock > 340000)
+-				return MODE_CLOCK_HIGH;
+-			else
+-				return MODE_OK;
+-		} else {
+-			return MODE_CLOCK_HIGH;
++	if (amdgpu_connector->use_digital) {
++		switch (amdgpu_connector->connector_object_id) {
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_A:
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D:
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_B:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2;
++			break;
+ 		}
++
++		/* When the display EDID claims that it's an HDMI display,
++		 * we use the HDMI encoder mode of the display HW,
++		 * so we should verify against the max HDMI clock here.
++		 */
++		if (connector->display_info.is_hdmi)
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++
++		if (mode->clock > max_digital_pixel_clock_khz)
++			return MODE_CLOCK_HIGH;
+ 	}
+ 
+ 	/* check against the max pixel clock */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-skip-mgpu-fan-boost-for-multi-vf.patch b/queue-6.17/drm-amdgpu-skip-mgpu-fan-boost-for-multi-vf.patch
new file mode 100644
index 0000000000..afd3ef94ad
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-skip-mgpu-fan-boost-for-multi-vf.patch
@@ -0,0 +1,36 @@
+From b3cc07e5bc59607b75023010535c24a89068d632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 12:56:35 -0400
+Subject: drm/amdgpu: skip mgpu fan boost for multi-vf
+
+From: Yunxiang Li <Yunxiang.Li@amd.com>
+
+[ Upstream commit ba5e322b2617157edb757055252a33587b6729e0 ]
+
+On multi-vf setup if the VM have two vf assigned, perhaps from two
+different gpus, mgpu fan boost will fail.
+
+Signed-off-by: Yunxiang Li <Yunxiang.Li@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index dfa68cb411966..097ceee79ece6 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3389,7 +3389,7 @@ static int amdgpu_device_enable_mgpu_fan_boost(void)
+ 	for (i = 0; i < mgpu_info.num_dgpu; i++) {
+ 		gpu_ins = &(mgpu_info.gpu_ins[i]);
+ 		adev = gpu_ins->adev;
+-		if (!(adev->flags & AMD_IS_APU) &&
++		if (!(adev->flags & AMD_IS_APU || amdgpu_sriov_multi_vf_mode(adev)) &&
+ 		    !gpu_ins->mgpu_fan_enabled) {
+ 			ret = amdgpu_dpm_enable_mgpu_fan_boost(adev);
+ 			if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch b/queue-6.17/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
new file mode 100644
index 0000000000..008f83b5b4
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
@@ -0,0 +1,98 @@
+From 06020f3de8d6682adacfaac8e5d38a7d6745b637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jul 2025 11:07:43 +0800
+Subject: drm/amdgpu: Skip poison aca bank from UE channel
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 8e8e08c831f088ed581444c58a635c49ea1222ab ]
+
+Avoid GFX poison consumption errors logged when fatal error occurs.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c | 51 +++++++++++++++----------
+ 1 file changed, 30 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+index cbc40cad581b4..d1e431818212d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_aca.c
+@@ -130,6 +130,27 @@ static void aca_smu_bank_dump(struct amdgpu_device *adev, int idx, int total, st
+ 		RAS_EVENT_LOG(adev, event_id, HW_ERR "hardware error logged by the scrubber\n");
+ }
+ 
++static bool aca_bank_hwip_is_matched(struct aca_bank *bank, enum aca_hwip_type type)
++{
++
++	struct aca_hwip *hwip;
++	int hwid, mcatype;
++	u64 ipid;
++
++	if (!bank || type == ACA_HWIP_TYPE_UNKNOW)
++		return false;
++
++	hwip = &aca_hwid_mcatypes[type];
++	if (!hwip->hwid)
++		return false;
++
++	ipid = bank->regs[ACA_REG_IDX_IPID];
++	hwid = ACA_REG__IPID__HARDWAREID(ipid);
++	mcatype = ACA_REG__IPID__MCATYPE(ipid);
++
++	return hwip->hwid == hwid && hwip->mcatype == mcatype;
++}
++
+ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_type type,
+ 				       int start, int count,
+ 				       struct aca_banks *banks, struct ras_query_context *qctx)
+@@ -168,6 +189,15 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_
+ 
+ 		bank.smu_err_type = type;
+ 
++		/*
++		 * Poison being consumed when injecting a UE while running background workloads,
++		 * which are unexpected.
++		 */
++		if (type == ACA_SMU_TYPE_UE &&
++		    ACA_REG__STATUS__POISON(bank.regs[ACA_REG_IDX_STATUS]) &&
++		    !aca_bank_hwip_is_matched(&bank, ACA_HWIP_TYPE_UMC))
++			continue;
++
+ 		aca_smu_bank_dump(adev, i, count, &bank, qctx);
+ 
+ 		ret = aca_banks_add_bank(banks, &bank);
+@@ -178,27 +208,6 @@ static int aca_smu_get_valid_aca_banks(struct amdgpu_device *adev, enum aca_smu_
+ 	return 0;
+ }
+ 
+-static bool aca_bank_hwip_is_matched(struct aca_bank *bank, enum aca_hwip_type type)
+-{
+-
+-	struct aca_hwip *hwip;
+-	int hwid, mcatype;
+-	u64 ipid;
+-
+-	if (!bank || type == ACA_HWIP_TYPE_UNKNOW)
+-		return false;
+-
+-	hwip = &aca_hwid_mcatypes[type];
+-	if (!hwip->hwid)
+-		return false;
+-
+-	ipid = bank->regs[ACA_REG_IDX_IPID];
+-	hwid = ACA_REG__IPID__HARDWAREID(ipid);
+-	mcatype = ACA_REG__IPID__MCATYPE(ipid);
+-
+-	return hwip->hwid == hwid && hwip->mcatype == mcatype;
+-}
+-
+ static bool aca_bank_is_valid(struct aca_handle *handle, struct aca_bank *bank, enum aca_smu_type type)
+ {
+ 	const struct aca_bank_ops *bank_ops = handle->bank_ops;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-update-ipid-value-for-bad-page-threshold-.patch b/queue-6.17/drm-amdgpu-update-ipid-value-for-bad-page-threshold-.patch
new file mode 100644
index 0000000000..7266b8a581
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-update-ipid-value-for-bad-page-threshold-.patch
@@ -0,0 +1,56 @@
+From 956029e9e1444134a0f14c4700719dee3d668b99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 14:28:35 +0800
+Subject: drm/amdgpu: Update IPID value for bad page threshold CPER
+
+From: Xiang Liu <xiang.liu@amd.com>
+
+[ Upstream commit 8f0245ee95c5ba65a2fe03f60386868353c6a3a0 ]
+
+Update the IPID register value for bad page threshold CPER according to
+the latest definition.
+
+Signed-off-by: Xiang Liu <xiang.liu@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+index 48a8aa1044b15..ee937d617c826 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cper.c
+@@ -206,6 +206,7 @@ int amdgpu_cper_entry_fill_bad_page_threshold_section(struct amdgpu_device *adev
+ {
+ 	struct cper_sec_desc *section_desc;
+ 	struct cper_sec_nonstd_err *section;
++	uint32_t socket_id;
+ 
+ 	section_desc = (struct cper_sec_desc *)((uint8_t *)hdr + SEC_DESC_OFFSET(idx));
+ 	section = (struct cper_sec_nonstd_err *)((uint8_t *)hdr +
+@@ -224,6 +225,9 @@ int amdgpu_cper_entry_fill_bad_page_threshold_section(struct amdgpu_device *adev
+ 	section->ctx.reg_arr_size = sizeof(section->ctx.reg_dump);
+ 
+ 	/* Hardcoded Reg dump for bad page threshold CPER */
++	socket_id = (adev->smuio.funcs && adev->smuio.funcs->get_socket_id) ?
++				adev->smuio.funcs->get_socket_id(adev) :
++				0;
+ 	section->ctx.reg_dump[CPER_ACA_REG_CTL_LO]    = 0x1;
+ 	section->ctx.reg_dump[CPER_ACA_REG_CTL_HI]    = 0x0;
+ 	section->ctx.reg_dump[CPER_ACA_REG_STATUS_LO] = 0x137;
+@@ -234,8 +238,8 @@ int amdgpu_cper_entry_fill_bad_page_threshold_section(struct amdgpu_device *adev
+ 	section->ctx.reg_dump[CPER_ACA_REG_MISC0_HI]  = 0x0;
+ 	section->ctx.reg_dump[CPER_ACA_REG_CONFIG_LO] = 0x2;
+ 	section->ctx.reg_dump[CPER_ACA_REG_CONFIG_HI] = 0x1ff;
+-	section->ctx.reg_dump[CPER_ACA_REG_IPID_LO]   = 0x0;
+-	section->ctx.reg_dump[CPER_ACA_REG_IPID_HI]   = 0x96;
++	section->ctx.reg_dump[CPER_ACA_REG_IPID_LO]   = (socket_id / 4) & 0x01;
++	section->ctx.reg_dump[CPER_ACA_REG_IPID_HI]   = 0x096 | (((socket_id % 4) & 0x3) << 12);
+ 	section->ctx.reg_dump[CPER_ACA_REG_SYND_LO]   = 0x0;
+ 	section->ctx.reg_dump[CPER_ACA_REG_SYND_HI]   = 0x0;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch b/queue-6.17/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
new file mode 100644
index 0000000000..8a789abceb
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
@@ -0,0 +1,64 @@
+From 71f3775cbbf69ac290f505de65aea09e5abb0f5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 11:44:27 +0100
+Subject: drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
+
+Replace kmalloc_array() + copy_from_user() with memdup_array_user().
+
+This shrinks the source code and improves separation between the kernel
+and userspace slabs.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index d3f220be2ef9a..d541e214a18c8 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1767,30 +1767,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
+ {
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	union drm_amdgpu_wait_fences *wait = data;
+-	uint32_t fence_count = wait->in.fence_count;
+-	struct drm_amdgpu_fence *fences_user;
+ 	struct drm_amdgpu_fence *fences;
+ 	int r;
+ 
+ 	/* Get the fences from userspace */
+-	fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
+-			GFP_KERNEL);
+-	if (fences == NULL)
+-		return -ENOMEM;
+-
+-	fences_user = u64_to_user_ptr(wait->in.fences);
+-	if (copy_from_user(fences, fences_user,
+-		sizeof(struct drm_amdgpu_fence) * fence_count)) {
+-		r = -EFAULT;
+-		goto err_free_fences;
+-	}
++	fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
++				   wait->in.fence_count,
++				   sizeof(struct drm_amdgpu_fence));
++	if (IS_ERR(fences))
++		return PTR_ERR(fences);
+ 
+ 	if (wait->in.wait_all)
+ 		r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
+ 	else
+ 		r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
+ 
+-err_free_fences:
+ 	kfree(fences);
+ 
+ 	return r;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-validate-userq-buffer-virtual-address-and.patch b/queue-6.17/drm-amdgpu-validate-userq-buffer-virtual-address-and.patch
new file mode 100644
index 0000000000..788d4c8780
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-validate-userq-buffer-virtual-address-and.patch
@@ -0,0 +1,149 @@
+From 1820aa6bb30614b8cdf8af561b7e342c64879f27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Jun 2025 16:29:38 +0800
+Subject: drm/amdgpu: validate userq buffer virtual address and size
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+[ Upstream commit 9e46b8bb0539d7bc9a9e7b3072fa4f6082490392 ]
+
+It needs to validate the userq object virtual address to
+determine whether it is residented in a valid vm mapping.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c  | 40 ++++++++++++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h  |  2 ++
+ drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 16 +++++++++
+ 3 files changed, 58 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+index 65c8a38890d48..695eb2b052fc0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -44,6 +44,38 @@ u32 amdgpu_userq_get_supported_ip_mask(struct amdgpu_device *adev)
+ 	return userq_ip_mask;
+ }
+ 
++int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
++				   u64 expected_size)
++{
++	struct amdgpu_bo_va_mapping *va_map;
++	u64 user_addr;
++	u64 size;
++	int r = 0;
++
++	user_addr = (addr & AMDGPU_GMC_HOLE_MASK) >> AMDGPU_GPU_PAGE_SHIFT;
++	size = expected_size >> AMDGPU_GPU_PAGE_SHIFT;
++
++	r = amdgpu_bo_reserve(vm->root.bo, false);
++	if (r)
++		return r;
++
++	va_map = amdgpu_vm_bo_lookup_mapping(vm, user_addr);
++	if (!va_map) {
++		r = -EINVAL;
++		goto out_err;
++	}
++	/* Only validate the userq whether resident in the VM mapping range */
++	if (user_addr >= va_map->start  &&
++	    va_map->last - user_addr + 1 >= size) {
++		amdgpu_bo_unreserve(vm->root.bo);
++		return 0;
++	}
++
++out_err:
++	amdgpu_bo_unreserve(vm->root.bo);
++	return r;
++}
++
+ static int
+ amdgpu_userq_unmap_helper(struct amdgpu_userq_mgr *uq_mgr,
+ 			  struct amdgpu_usermode_queue *queue)
+@@ -439,6 +471,14 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
+ 		r = -ENOMEM;
+ 		goto unlock;
+ 	}
++
++	/* Validate the userq virtual address.*/
++	if (amdgpu_userq_input_va_validate(&fpriv->vm, args->in.queue_va, args->in.queue_size) ||
++	    amdgpu_userq_input_va_validate(&fpriv->vm, args->in.rptr_va, AMDGPU_GPU_PAGE_SIZE) ||
++	    amdgpu_userq_input_va_validate(&fpriv->vm, args->in.wptr_va, AMDGPU_GPU_PAGE_SIZE)) {
++		kfree(queue);
++		goto unlock;
++	}
+ 	queue->doorbell_handle = args->in.doorbell_handle;
+ 	queue->queue_type = args->in.ip_type;
+ 	queue->vm = &fpriv->vm;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
+index b1ca91b7cda4b..8603c31320f11 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
+@@ -133,4 +133,6 @@ int amdgpu_userq_stop_sched_for_enforce_isolation(struct amdgpu_device *adev,
+ int amdgpu_userq_start_sched_for_enforce_isolation(struct amdgpu_device *adev,
+ 						   u32 idx);
+ 
++int amdgpu_userq_input_va_validate(struct amdgpu_vm *vm, u64 addr,
++				   u64 expected_size);
+ #endif
+diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+index 1457fb49a794f..ef54d211214f4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+@@ -206,6 +206,7 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 	struct amdgpu_mqd *mqd_hw_default = &adev->mqds[queue->queue_type];
+ 	struct drm_amdgpu_userq_in *mqd_user = args_in;
+ 	struct amdgpu_mqd_prop *userq_props;
++	struct amdgpu_gfx_shadow_info shadow_info;
+ 	int r;
+ 
+ 	/* Structure to initialize MQD for userqueue using generic MQD init function */
+@@ -231,6 +232,8 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 	userq_props->doorbell_index = queue->doorbell_index;
+ 	userq_props->fence_address = queue->fence_drv->gpu_addr;
+ 
++	if (adev->gfx.funcs->get_gfx_shadow_info)
++		adev->gfx.funcs->get_gfx_shadow_info(adev, &shadow_info, true);
+ 	if (queue->queue_type == AMDGPU_HW_IP_COMPUTE) {
+ 		struct drm_amdgpu_userq_mqd_compute_gfx11 *compute_mqd;
+ 
+@@ -247,6 +250,10 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 			goto free_mqd;
+ 		}
+ 
++		if (amdgpu_userq_input_va_validate(queue->vm, compute_mqd->eop_va,
++		    max_t(u32, PAGE_SIZE, AMDGPU_GPU_PAGE_SIZE)))
++			goto free_mqd;
++
+ 		userq_props->eop_gpu_addr = compute_mqd->eop_va;
+ 		userq_props->hqd_pipe_priority = AMDGPU_GFX_PIPE_PRIO_NORMAL;
+ 		userq_props->hqd_queue_priority = AMDGPU_GFX_QUEUE_PRIORITY_MINIMUM;
+@@ -274,6 +281,11 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 		userq_props->csa_addr = mqd_gfx_v11->csa_va;
+ 		userq_props->tmz_queue =
+ 			mqd_user->flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE;
++
++		if (amdgpu_userq_input_va_validate(queue->vm, mqd_gfx_v11->shadow_va,
++		    shadow_info.shadow_size))
++			goto free_mqd;
++
+ 		kfree(mqd_gfx_v11);
+ 	} else if (queue->queue_type == AMDGPU_HW_IP_DMA) {
+ 		struct drm_amdgpu_userq_mqd_sdma_gfx11 *mqd_sdma_v11;
+@@ -291,6 +303,10 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 			goto free_mqd;
+ 		}
+ 
++		if (amdgpu_userq_input_va_validate(queue->vm, mqd_sdma_v11->csa_va,
++		    shadow_info.csa_size))
++			goto free_mqd;
++
+ 		userq_props->csa_addr = mqd_sdma_v11->csa_va;
+ 		kfree(mqd_sdma_v11);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-validate-userq-input-args.patch b/queue-6.17/drm-amdgpu-validate-userq-input-args.patch
new file mode 100644
index 0000000000..efec145303
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-validate-userq-input-args.patch
@@ -0,0 +1,161 @@
+From 8a0d6ab0e30add1257395b4d67d6082c72dbe233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 May 2025 12:43:57 +0800
+Subject: drm/amdgpu: validate userq input args
+
+From: Prike Liang <Prike.Liang@amd.com>
+
+[ Upstream commit 219be4711a1ba788bc2a9fafc117139d133e5fea ]
+
+This will help on validating the userq input args, and
+rejecting for the invalid userq request at the IOCTLs
+first place.
+
+Signed-off-by: Prike Liang <Prike.Liang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c  | 81 +++++++++++++++-------
+ drivers/gpu/drm/amd/amdgpu/mes_userqueue.c |  7 --
+ 2 files changed, 56 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+index 8190c24a649a2..65c8a38890d48 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+@@ -404,27 +404,10 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
+ 		(args->in.flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_PRIORITY_MASK) >>
+ 		AMDGPU_USERQ_CREATE_FLAGS_QUEUE_PRIORITY_SHIFT;
+ 
+-	/* Usermode queues are only supported for GFX IP as of now */
+-	if (args->in.ip_type != AMDGPU_HW_IP_GFX &&
+-	    args->in.ip_type != AMDGPU_HW_IP_DMA &&
+-	    args->in.ip_type != AMDGPU_HW_IP_COMPUTE) {
+-		drm_file_err(uq_mgr->file, "Usermode queue doesn't support IP type %u\n",
+-			     args->in.ip_type);
+-		return -EINVAL;
+-	}
+-
+ 	r = amdgpu_userq_priority_permit(filp, priority);
+ 	if (r)
+ 		return r;
+ 
+-	if ((args->in.flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE) &&
+-	    (args->in.ip_type != AMDGPU_HW_IP_GFX) &&
+-	    (args->in.ip_type != AMDGPU_HW_IP_COMPUTE) &&
+-	    !amdgpu_is_tmz(adev)) {
+-		drm_file_err(uq_mgr->file, "Secure only supported on GFX/Compute queues\n");
+-		return -EINVAL;
+-	}
+-
+ 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
+ 	if (r < 0) {
+ 		drm_file_err(uq_mgr->file, "pm_runtime_get_sync() failed for userqueue create\n");
+@@ -543,22 +526,45 @@ amdgpu_userq_create(struct drm_file *filp, union drm_amdgpu_userq *args)
+ 	return r;
+ }
+ 
+-int amdgpu_userq_ioctl(struct drm_device *dev, void *data,
+-		       struct drm_file *filp)
++static int amdgpu_userq_input_args_validate(struct drm_device *dev,
++					union drm_amdgpu_userq *args,
++					struct drm_file *filp)
+ {
+-	union drm_amdgpu_userq *args = data;
+-	int r;
++	struct amdgpu_device *adev = drm_to_adev(dev);
+ 
+ 	switch (args->in.op) {
+ 	case AMDGPU_USERQ_OP_CREATE:
+ 		if (args->in.flags & ~(AMDGPU_USERQ_CREATE_FLAGS_QUEUE_PRIORITY_MASK |
+ 				       AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE))
+ 			return -EINVAL;
+-		r = amdgpu_userq_create(filp, args);
+-		if (r)
+-			drm_file_err(filp, "Failed to create usermode queue\n");
+-		break;
++		/* Usermode queues are only supported for GFX IP as of now */
++		if (args->in.ip_type != AMDGPU_HW_IP_GFX &&
++		    args->in.ip_type != AMDGPU_HW_IP_DMA &&
++		    args->in.ip_type != AMDGPU_HW_IP_COMPUTE) {
++			drm_file_err(filp, "Usermode queue doesn't support IP type %u\n",
++				     args->in.ip_type);
++			return -EINVAL;
++		}
++
++		if ((args->in.flags & AMDGPU_USERQ_CREATE_FLAGS_QUEUE_SECURE) &&
++		    (args->in.ip_type != AMDGPU_HW_IP_GFX) &&
++		    (args->in.ip_type != AMDGPU_HW_IP_COMPUTE) &&
++		    !amdgpu_is_tmz(adev)) {
++			drm_file_err(filp, "Secure only supported on GFX/Compute queues\n");
++			return -EINVAL;
++		}
+ 
++		if (args->in.queue_va == AMDGPU_BO_INVALID_OFFSET ||
++		    args->in.queue_va == 0 ||
++		    args->in.queue_size == 0) {
++			drm_file_err(filp, "invalidate userq queue va or size\n");
++			return -EINVAL;
++		}
++		if (!args->in.wptr_va || !args->in.rptr_va) {
++			drm_file_err(filp, "invalidate userq queue rptr or wptr\n");
++			return -EINVAL;
++		}
++		break;
+ 	case AMDGPU_USERQ_OP_FREE:
+ 		if (args->in.ip_type ||
+ 		    args->in.doorbell_handle ||
+@@ -572,6 +578,31 @@ int amdgpu_userq_ioctl(struct drm_device *dev, void *data,
+ 		    args->in.mqd ||
+ 		    args->in.mqd_size)
+ 			return -EINVAL;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++int amdgpu_userq_ioctl(struct drm_device *dev, void *data,
++		       struct drm_file *filp)
++{
++	union drm_amdgpu_userq *args = data;
++	int r;
++
++	if (amdgpu_userq_input_args_validate(dev, args, filp) < 0)
++		return -EINVAL;
++
++	switch (args->in.op) {
++	case AMDGPU_USERQ_OP_CREATE:
++		r = amdgpu_userq_create(filp, args);
++		if (r)
++			drm_file_err(filp, "Failed to create usermode queue\n");
++		break;
++
++	case AMDGPU_USERQ_OP_FREE:
+ 		r = amdgpu_userq_destroy(filp, args->in.queue_id);
+ 		if (r)
+ 			drm_file_err(filp, "Failed to destroy usermode queue\n");
+diff --git a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+index d6f50b13e2ba0..1457fb49a794f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
++++ b/drivers/gpu/drm/amd/amdgpu/mes_userqueue.c
+@@ -215,13 +215,6 @@ static int mes_userq_mqd_create(struct amdgpu_userq_mgr *uq_mgr,
+ 		return -ENOMEM;
+ 	}
+ 
+-	if (!mqd_user->wptr_va || !mqd_user->rptr_va ||
+-	    !mqd_user->queue_va || mqd_user->queue_size == 0) {
+-		DRM_ERROR("Invalid MQD parameters for userqueue\n");
+-		r = -EINVAL;
+-		goto free_props;
+-	}
+-
+ 	r = amdgpu_userq_create_object(uq_mgr, &queue->mqd, mqd_hw_default->mqd_size);
+ 	if (r) {
+ 		DRM_ERROR("Failed to create MQD object for userqueue\n");
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdgpu-vpe-cancel-delayed-work-in-hw_fini.patch b/queue-6.17/drm-amdgpu-vpe-cancel-delayed-work-in-hw_fini.patch
new file mode 100644
index 0000000000..be818ef1f8
--- /dev/null
+++ b/queue-6.17/drm-amdgpu-vpe-cancel-delayed-work-in-hw_fini.patch
@@ -0,0 +1,47 @@
+From 2c17e075353a3325f448663a9cb63a8a42de28d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 09:35:07 -0400
+Subject: drm/amdgpu/vpe: cancel delayed work in hw_fini
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit ec813f384b1a9df332e86ff46c422e5d2d00217f ]
+
+We need to cancel any outstanding work at both suspend
+and driver teardown. Move the cancel to hw_fini which
+gets called in both cases.
+
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c
+index 7538c4738af34..118fbe38b33ab 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vpe.c
+@@ -461,6 +461,8 @@ static int vpe_hw_fini(struct amdgpu_ip_block *ip_block)
+ 	struct amdgpu_device *adev = ip_block->adev;
+ 	struct amdgpu_vpe *vpe = &adev->vpe;
+ 
++	cancel_delayed_work_sync(&adev->vpe.idle_work);
++
+ 	vpe_ring_stop(vpe);
+ 
+ 	/* Power off VPE */
+@@ -471,10 +473,6 @@ static int vpe_hw_fini(struct amdgpu_ip_block *ip_block)
+ 
+ static int vpe_suspend(struct amdgpu_ip_block *ip_block)
+ {
+-	struct amdgpu_device *adev = ip_block->adev;
+-
+-	cancel_delayed_work_sync(&adev->vpe.idle_work);
+-
+ 	return vpe_hw_fini(ip_block);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch b/queue-6.17/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
new file mode 100644
index 0000000000..9c049a7c9d
--- /dev/null
+++ b/queue-6.17/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
@@ -0,0 +1,43 @@
+From 0b020aa8e41e86ce8933f030659e58d3aeab00e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 14:22:53 -0400
+Subject: drm/amdkfd: fix vram allocation failure for a special case
+
+From: Eric Huang <jinhuieric.huang@amd.com>
+
+[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
+
+When it only allocates vram without va, which is 0, and a
+SVM range allocated stays in this range, the vram allocation
+returns failure. It should be skipped for this case from
+SVM usage check.
+
+Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 79ed3be63d0dd..43115a3744694 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1070,7 +1070,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
+ 	svm_range_list_lock_and_flush_work(&p->svms, current->mm);
+ 	mutex_lock(&p->svms.lock);
+ 	mmap_write_unlock(current->mm);
+-	if (interval_tree_iter_first(&p->svms.objects,
++
++	/* Skip a special case that allocates VRAM without VA,
++	 * VA will be invalid of 0.
++	 */
++	if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
++	    interval_tree_iter_first(&p->svms.objects,
+ 				     args->va_addr >> PAGE_SHIFT,
+ 				     (args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
+ 		pr_err("Address: 0x%llx already allocated by SVM\n",
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch b/queue-6.17/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
new file mode 100644
index 0000000000..3095230602
--- /dev/null
+++ b/queue-6.17/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
@@ -0,0 +1,67 @@
+From 98db898e7b908298e8ca0d53132ce3d2351939d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 14:06:36 -0400
+Subject: drm/amdkfd: Handle lack of READ permissions in SVM mapping
+
+From: Kent Russell <kent.russell@amd.com>
+
+[ Upstream commit 0ed704d058cec7643a716a21888d58c7d03f2c3e ]
+
+HMM assumes that pages have READ permissions by default. Inside
+svm_range_validate_and_map, we add READ permissions then add WRITE
+permissions if the VMA isn't read-only. This will conflict with regions
+that only have PROT_WRITE or have PROT_NONE. When that happens,
+svm_range_restore_work will continue to retry, silently, giving the
+impression of a hang if pr_debug isn't enabled to show the retries..
+
+If pages don't have READ permissions, simply unmap them and continue. If
+they weren't mapped in the first place, this would be a no-op. Since x86
+doesn't support write-only, and PROT_NONE doesn't allow reads or writes
+anyways, this will allow the svm range validation to continue without
+getting stuck in a loop forever on mappings we can't use with HMM.
+
+Signed-off-by: Kent Russell <kent.russell@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 3d8b20828c068..cecdbcea0bb90 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -1714,6 +1714,29 @@ static int svm_range_validate_and_map(struct mm_struct *mm,
+ 
+ 			next = min(vma->vm_end, end);
+ 			npages = (next - addr) >> PAGE_SHIFT;
++			/* HMM requires at least READ permissions. If provided with PROT_NONE,
++			 * unmap the memory. If it's not already mapped, this is a no-op
++			 * If PROT_WRITE is provided without READ, warn first then unmap
++			 */
++			if (!(vma->vm_flags & VM_READ)) {
++				unsigned long e, s;
++
++				svm_range_lock(prange);
++				if (vma->vm_flags & VM_WRITE)
++					pr_debug("VM_WRITE without VM_READ is not supported");
++				s = max(start, prange->start);
++				e = min(end, prange->last);
++				if (e >= s)
++					r = svm_range_unmap_from_gpus(prange, s, e,
++						       KFD_SVM_UNMAP_TRIGGER_UNMAP_FROM_CPU);
++				svm_range_unlock(prange);
++				/* If unmap returns non-zero, we'll bail on the next for loop
++				 * iteration, so just leave r and continue
++				 */
++				addr = next;
++				continue;
++			}
++
+ 			WRITE_ONCE(p->svms.faulting_task, current);
+ 			r = amdgpu_hmm_range_get_pages(&prange->notifier, addr, npages,
+ 						       readonly, owner, NULL,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-6.17/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..4f3223055b
--- /dev/null
+++ b/queue-6.17/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From d1c253c1af64c609933defacd79d03996478202a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 828a9ceef1e76..79ed3be63d0dd 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -3252,8 +3252,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	int retcode = -EINVAL;
+ 	bool ptrace_attached = false;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -3266,8 +3268,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-6.17/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..b1659faf85
--- /dev/null
+++ b/queue-6.17/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 98c6eab50eec95f619fcfa14699bbf205689605b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 67694bcd94646..d01ef5ac07666 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -111,7 +111,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ #define KFD_MAX_SDMA_QUEUES	128
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch b/queue-6.17/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
new file mode 100644
index 0000000000..2eee9af200
--- /dev/null
+++ b/queue-6.17/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
@@ -0,0 +1,44 @@
+From 4f8dd46594183b4bb9265562e10191668345826d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:21 +0300
+Subject: drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 7070f55f294745c5a3c033623b76309f3512be67 ]
+
+While the cdns-dsi does not support DSI burst mode, the burst mode is
+essentially DSI event mode with more versatile clocking and timings.
+Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests
+MIPI_DSI_MODE_VIDEO_BURST.
+
+In my particular use case, this allows the use of ti-sn65dsi83 driver.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index 9f1c460d5f0d4..0cc83bdb130fc 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -1088,10 +1088,6 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host,
+ 	if (output->dev)
+ 		return -EBUSY;
+ 
+-	/* We do not support burst mode yet. */
+-	if (dev->mode_flags & MIPI_DSI_MODE_VIDEO_BURST)
+-		return -ENOTSUPP;
+-
+ 	/*
+ 	 * The host <-> device link might be described using an OF-graph
+ 	 * representation, in this case we extract the device of_node from
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch b/queue-6.17/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
new file mode 100644
index 0000000000..60401760d4
--- /dev/null
+++ b/queue-6.17/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
@@ -0,0 +1,58 @@
+From 7ecc56b6b4fc68ff09b0a6834356cdcd6c620538 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:17 +0300
+Subject: drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit eea4f89b6461294ed6bea1d3285bb3f79c09a041 ]
+
+The driver tries to calculate the value for REG_WAKEUP_TIME. However,
+the calculation itself is not correct, and to add on it, the resulting
+value is almost always larger than the field's size, so the actual
+result is more or less random.
+
+According to the docs, figuring out the value for REG_WAKEUP_TIME
+requires HW characterization and there's no way to have a generic
+algorithm to come up with the value. That doesn't help at all...
+
+However, we know that the value must be smaller than the line time, and,
+at least in my understanding, the proper value for it is quite small.
+Testing shows that setting it to 1/10 of the line time seems to work
+well. All video modes from my HDMI monitor work with this algorithm.
+
+Hopefully we'll get more information on how to calculate the value, and
+we can then update this.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-11-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index 695b6246b280f..9f1c460d5f0d4 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -882,7 +882,13 @@ static void cdns_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
+ 
+ 	tx_byte_period = DIV_ROUND_DOWN_ULL((u64)NSEC_PER_SEC * 8,
+ 					    phy_cfg->hs_clk_rate);
+-	reg_wakeup = (phy_cfg->hs_prepare + phy_cfg->hs_zero) / tx_byte_period;
++
++	/*
++	 * Estimated time [in clock cycles] to perform LP->HS on D-PHY.
++	 * It is not clear how to calculate this, so for now,
++	 * set it to 1/10 of the total number of clocks in a line.
++	 */
++	reg_wakeup = dsi_cfg.htotal / nlanes / 10;
+ 	writel(REG_WAKEUP_TIME(reg_wakeup) | REG_LINE_DURATION(tmp),
+ 	       dsi->regs + VID_DPHY_TIME);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-6.17/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..9c1ef521ac
--- /dev/null
+++ b/queue-6.17/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From 80eaa275a230ebdc8f18845f73534e8f214ca350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index 52b7b5889e6fe..4f0295efb8f68 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -373,7 +373,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-bridge-write-full-audio-infoframe.patch b/queue-6.17/drm-bridge-write-full-audio-infoframe.patch
new file mode 100644
index 0000000000..df5c9df633
--- /dev/null
+++ b/queue-6.17/drm-bridge-write-full-audio-infoframe.patch
@@ -0,0 +1,119 @@
+From 5ac5be3366f43959435fb262e8024b8b8658a43f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:21:29 +0300
+Subject: drm/bridge: write full Audio InfoFrame
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit f0e7f358e72b10b01361787134ebcbd9e9aa72d9 ]
+
+Instead of writing the first byte of the infoframe (and hoping that the
+rest is default / zeroes), hook Audio InfoFrame support into the
+write_infoframe / clear_infoframes callbacks and use
+drm_atomic_helper_connector_hdmi_update_audio_infoframe() to write the
+frame.
+
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Link: https://lore.kernel.org/r/20250903-adv7511-audio-infoframe-v1-2-05b24459b9a4@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/bridge/adv7511/adv7511_audio.c    | 23 +++++--------------
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c  | 18 +++++++++++++++
+ 2 files changed, 24 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+index 766b1c96bc887..87e7e820810a8 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_audio.c
+@@ -12,6 +12,8 @@
+ #include <sound/soc.h>
+ #include <linux/of_graph.h>
+ 
++#include <drm/display/drm_hdmi_state_helper.h>
++
+ #include "adv7511.h"
+ 
+ static void adv7511_calc_cts_n(unsigned int f_tmds, unsigned int fs,
+@@ -155,17 +157,8 @@ int adv7511_hdmi_audio_prepare(struct drm_bridge *bridge,
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_I2C_FREQ_ID_CFG,
+ 			   ADV7511_I2C_FREQ_ID_CFG_RATE_MASK, rate << 4);
+ 
+-	/* send current Audio infoframe values while updating */
+-	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+-			   BIT(5), BIT(5));
+-
+-	regmap_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME(0), 0x1);
+-
+-	/* use Audio infoframe updated info */
+-	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+-			   BIT(5), 0);
+-
+-	return 0;
++	return drm_atomic_helper_connector_hdmi_update_audio_infoframe(connector,
++								       &hparms->cea);
+ }
+ 
+ int adv7511_hdmi_audio_startup(struct drm_bridge *bridge,
+@@ -188,15 +181,9 @@ int adv7511_hdmi_audio_startup(struct drm_bridge *bridge,
+ 	/* not copyrighted */
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CFG1,
+ 				BIT(5), BIT(5));
+-	/* enable audio infoframes */
+-	regmap_update_bits(adv7511->regmap, ADV7511_REG_PACKET_ENABLE1,
+-				BIT(3), BIT(3));
+ 	/* AV mute disable */
+ 	regmap_update_bits(adv7511->regmap, ADV7511_REG_GC(0),
+ 				BIT(7) | BIT(6), BIT(7));
+-	/* use Audio infoframe updated info */
+-	regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
+-				BIT(5), 0);
+ 
+ 	/* enable SPDIF receiver */
+ 	if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF)
+@@ -214,4 +201,6 @@ void adv7511_hdmi_audio_shutdown(struct drm_bridge *bridge,
+ 	if (adv7511->audio_source == ADV7511_AUDIO_SOURCE_SPDIF)
+ 		regmap_update_bits(adv7511->regmap, ADV7511_REG_AUDIO_CONFIG,
+ 				   BIT(7), 0);
++
++	drm_atomic_helper_connector_hdmi_clear_audio_infoframe(connector);
+ }
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 00d6417c177b4..9081c09fc136b 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -886,6 +886,9 @@ static int adv7511_bridge_hdmi_clear_infoframe(struct drm_bridge *bridge,
+ 	struct adv7511 *adv7511 = bridge_to_adv7511(bridge);
+ 
+ 	switch (type) {
++	case HDMI_INFOFRAME_TYPE_AUDIO:
++		adv7511_packet_disable(adv7511, ADV7511_PACKET_ENABLE_AUDIO_INFOFRAME);
++		break;
+ 	case HDMI_INFOFRAME_TYPE_AVI:
+ 		adv7511_packet_disable(adv7511, ADV7511_PACKET_ENABLE_AVI_INFOFRAME);
+ 		break;
+@@ -906,6 +909,21 @@ static int adv7511_bridge_hdmi_write_infoframe(struct drm_bridge *bridge,
+ 	adv7511_bridge_hdmi_clear_infoframe(bridge, type);
+ 
+ 	switch (type) {
++	case HDMI_INFOFRAME_TYPE_AUDIO:
++		/* send current Audio infoframe values while updating */
++		regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
++				   BIT(5), BIT(5));
++
++		/* The Audio infoframe id is not configurable */
++		regmap_bulk_write(adv7511->regmap, ADV7511_REG_AUDIO_INFOFRAME_VERSION,
++				  buffer + 1, len - 1);
++
++		/* use Audio infoframe updated info */
++		regmap_update_bits(adv7511->regmap, ADV7511_REG_INFOFRAME_UPDATE,
++				   BIT(5), 0);
++
++		adv7511_packet_enable(adv7511, ADV7511_PACKET_ENABLE_AUDIO_INFOFRAME);
++		break;
+ 	case HDMI_INFOFRAME_TYPE_AVI:
+ 		/* The AVI infoframe id is not configurable */
+ 		regmap_bulk_write(adv7511->regmap, ADV7511_REG_AVI_INFOFRAME_VERSION,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-gpusvm-fix-hmm_pfn_to_map_order-usage.patch b/queue-6.17/drm-gpusvm-fix-hmm_pfn_to_map_order-usage.patch
new file mode 100644
index 0000000000..01f3ae1d8b
--- /dev/null
+++ b/queue-6.17/drm-gpusvm-fix-hmm_pfn_to_map_order-usage.patch
@@ -0,0 +1,93 @@
+From 0cf3c49ab5d5918547e7b216830fb1e53eff1fde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:24:32 +0100
+Subject: drm/gpusvm: fix hmm_pfn_to_map_order() usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit c50729c68aaf93611c855752b00e49ce1fdd1558 ]
+
+Handle the case where the hmm range partially covers a huge page (like
+2M), otherwise we can potentially end up doing something nasty like
+mapping memory which is outside the range, and maybe not even mapped by
+the mm. Fix is based on the xe userptr code, which in a future patch
+will directly use gpusvm, so needs alignment here.
+
+v2:
+  - Add kernel-doc (Matt B)
+  - s/fls/ilog2/ (Thomas)
+
+Reported-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://lore.kernel.org/r/20250828142430.615826-11-matthew.auld@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_gpusvm.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_gpusvm.c b/drivers/gpu/drm/drm_gpusvm.c
+index 5bb4c77db2c3c..1dd8f3b593df6 100644
+--- a/drivers/gpu/drm/drm_gpusvm.c
++++ b/drivers/gpu/drm/drm_gpusvm.c
+@@ -708,6 +708,35 @@ drm_gpusvm_range_alloc(struct drm_gpusvm *gpusvm,
+ 	return range;
+ }
+ 
++/**
++ * drm_gpusvm_hmm_pfn_to_order() - Get the largest CPU mapping order.
++ * @hmm_pfn: The current hmm_pfn.
++ * @hmm_pfn_index: Index of the @hmm_pfn within the pfn array.
++ * @npages: Number of pages within the pfn array i.e the hmm range size.
++ *
++ * To allow skipping PFNs with the same flags (like when they belong to
++ * the same huge PTE) when looping over the pfn array, take a given a hmm_pfn,
++ * and return the largest order that will fit inside the CPU PTE, but also
++ * crucially accounting for the original hmm range boundaries.
++ *
++ * Return: The largest order that will safely fit within the size of the hmm_pfn
++ * CPU PTE.
++ */
++static unsigned int drm_gpusvm_hmm_pfn_to_order(unsigned long hmm_pfn,
++						unsigned long hmm_pfn_index,
++						unsigned long npages)
++{
++	unsigned long size;
++
++	size = 1UL << hmm_pfn_to_map_order(hmm_pfn);
++	size -= (hmm_pfn & ~HMM_PFN_FLAGS) & (size - 1);
++	hmm_pfn_index += size;
++	if (hmm_pfn_index > npages)
++		size -= (hmm_pfn_index - npages);
++
++	return ilog2(size);
++}
++
+ /**
+  * drm_gpusvm_check_pages() - Check pages
+  * @gpusvm: Pointer to the GPU SVM structure
+@@ -766,7 +795,7 @@ static bool drm_gpusvm_check_pages(struct drm_gpusvm *gpusvm,
+ 			err = -EFAULT;
+ 			goto err_free;
+ 		}
+-		i += 0x1 << hmm_pfn_to_map_order(pfns[i]);
++		i += 0x1 << drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
+ 	}
+ 
+ err_free:
+@@ -1342,7 +1371,7 @@ int drm_gpusvm_range_get_pages(struct drm_gpusvm *gpusvm,
+ 	for (i = 0, j = 0; i < npages; ++j) {
+ 		struct page *page = hmm_pfn_to_page(pfns[i]);
+ 
+-		order = hmm_pfn_to_map_order(pfns[i]);
++		order = drm_gpusvm_hmm_pfn_to_order(pfns[i], i, npages);
+ 		if (is_device_private_page(page) ||
+ 		    is_device_coherent_page(page)) {
+ 			if (zdd != page->zone_device_data && i > 0) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-a6xx-switch-to-gmu-ao-counter.patch b/queue-6.17/drm-msm-a6xx-switch-to-gmu-ao-counter.patch
new file mode 100644
index 0000000000..576f41f97d
--- /dev/null
+++ b/queue-6.17/drm-msm-a6xx-switch-to-gmu-ao-counter.patch
@@ -0,0 +1,86 @@
+From 680e32227a753f7aa477fc876330b54e56d4d957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:57:02 +0530
+Subject: drm/msm/a6xx: Switch to GMU AO counter
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+[ Upstream commit f195421318bd00151b3a111af6f315a25c3438a8 ]
+
+CP_ALWAYS_ON counter falls under GX domain which is collapsed during
+IFPC. So switch to GMU_ALWAYS_ON counter for any CPU reads since it is
+not impacted by IFPC. Both counters are clocked by same xo clock source.
+
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/673373/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 30 ++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 536da1acf615e..1e363af319488 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -16,6 +16,19 @@
+ 
+ #define GPU_PAS_ID 13
+ 
++static u64 read_gmu_ao_counter(struct a6xx_gpu *a6xx_gpu)
++{
++	u64 count_hi, count_lo, temp;
++
++	do {
++		count_hi = gmu_read(&a6xx_gpu->gmu, REG_A6XX_GMU_ALWAYS_ON_COUNTER_H);
++		count_lo = gmu_read(&a6xx_gpu->gmu, REG_A6XX_GMU_ALWAYS_ON_COUNTER_L);
++		temp = gmu_read(&a6xx_gpu->gmu, REG_A6XX_GMU_ALWAYS_ON_COUNTER_H);
++	} while (unlikely(count_hi != temp));
++
++	return (count_hi << 32) | count_lo;
++}
++
+ static bool fence_status_check(struct msm_gpu *gpu, u32 offset, u32 value, u32 status, u32 mask)
+ {
+ 	/* Success if !writedropped0/1 */
+@@ -376,8 +389,7 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ 	OUT_RING(ring, upper_32_bits(rbmemptr(ring, fence)));
+ 	OUT_RING(ring, submit->seqno);
+ 
+-	trace_msm_gpu_submit_flush(submit,
+-		gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER));
++	trace_msm_gpu_submit_flush(submit, read_gmu_ao_counter(a6xx_gpu));
+ 
+ 	a6xx_flush(gpu, ring);
+ }
+@@ -577,8 +589,7 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
+ 	}
+ 
+ 
+-	trace_msm_gpu_submit_flush(submit,
+-		gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER));
++	trace_msm_gpu_submit_flush(submit, read_gmu_ao_counter(a6xx_gpu));
+ 
+ 	a6xx_flush(gpu, ring);
+ 
+@@ -2260,16 +2271,7 @@ static int a6xx_gmu_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
+ 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+ 	struct a6xx_gpu *a6xx_gpu = to_a6xx_gpu(adreno_gpu);
+ 
+-	mutex_lock(&a6xx_gpu->gmu.lock);
+-
+-	/* Force the GPU power on so we can read this register */
+-	a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+-
+-	*value = gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER);
+-
+-	a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_PERFCOUNTER_SET);
+-
+-	mutex_unlock(&a6xx_gpu->gmu.lock);
++	*value = read_gmu_ao_counter(a6xx_gpu);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-adreno-add-fenced-regwrite-support.patch b/queue-6.17/drm-msm-adreno-add-fenced-regwrite-support.patch
new file mode 100644
index 0000000000..4a9d519417
--- /dev/null
+++ b/queue-6.17/drm-msm-adreno-add-fenced-regwrite-support.patch
@@ -0,0 +1,205 @@
+From c60b1817e2d951f21ce6e04814336f8e60a41450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 13:57:00 +0530
+Subject: drm/msm/adreno: Add fenced regwrite support
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+[ Upstream commit a27d774045566b587bfc1ae9fb122642b06677b8 ]
+
+There are some special registers which are accessible even when GX power
+domain is collapsed during an IFPC sleep. Accessing these registers
+wakes up GPU from power collapse and allow programming these registers
+without additional handshake with GMU. This patch adds support for this
+special register write sequence.
+
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/673368/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c     | 80 ++++++++++++++++++++++-
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.h     |  1 +
+ drivers/gpu/drm/msm/adreno/a6xx_preempt.c | 20 +++---
+ 3 files changed, 90 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index f8992a68df7fb..536da1acf615e 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -16,6 +16,84 @@
+ 
+ #define GPU_PAS_ID 13
+ 
++static bool fence_status_check(struct msm_gpu *gpu, u32 offset, u32 value, u32 status, u32 mask)
++{
++	/* Success if !writedropped0/1 */
++	if (!(status & mask))
++		return true;
++
++	udelay(10);
++
++	/* Try to update fenced register again */
++	gpu_write(gpu, offset, value);
++
++	/* We can't do a posted write here because the power domain could be
++	 * in collapse state. So use the heaviest barrier instead
++	 */
++	mb();
++	return false;
++}
++
++static int fenced_write(struct a6xx_gpu *a6xx_gpu, u32 offset, u32 value, u32 mask)
++{
++	struct adreno_gpu *adreno_gpu = &a6xx_gpu->base;
++	struct msm_gpu *gpu = &adreno_gpu->base;
++	struct a6xx_gmu *gmu = &a6xx_gpu->gmu;
++	u32 status;
++
++	gpu_write(gpu, offset, value);
++
++	/* Nothing else to be done in the case of no-GMU */
++	if (adreno_has_gmu_wrapper(adreno_gpu))
++		return 0;
++
++	/* We can't do a posted write here because the power domain could be
++	 * in collapse state. So use the heaviest barrier instead
++	 */
++	mb();
++
++	if (!gmu_poll_timeout(gmu, REG_A6XX_GMU_AHB_FENCE_STATUS, status,
++			fence_status_check(gpu, offset, value, status, mask), 0, 1000))
++		return 0;
++
++	/* Try again for another 1ms before failing */
++	gpu_write(gpu, offset, value);
++	mb();
++
++	if (!gmu_poll_timeout(gmu, REG_A6XX_GMU_AHB_FENCE_STATUS, status,
++			fence_status_check(gpu, offset, value, status, mask), 0, 1000)) {
++		/*
++		 * The 'delay' warning is here because the pause to print this
++		 * warning will allow gpu to move to power collapse which
++		 * defeats the purpose of continuous polling for 2 ms
++		 */
++		dev_err_ratelimited(gmu->dev, "delay in fenced register write (0x%x)\n",
++				offset);
++		return 0;
++	}
++
++	dev_err_ratelimited(gmu->dev, "fenced register write (0x%x) fail\n",
++			offset);
++
++	return -ETIMEDOUT;
++}
++
++int a6xx_fenced_write(struct a6xx_gpu *a6xx_gpu, u32 offset, u64 value, u32 mask, bool is_64b)
++{
++	int ret;
++
++	ret = fenced_write(a6xx_gpu, offset, lower_32_bits(value), mask);
++	if (ret)
++		return ret;
++
++	if (!is_64b)
++		return 0;
++
++	ret = fenced_write(a6xx_gpu, offset + 1, upper_32_bits(value), mask);
++
++	return ret;
++}
++
+ static inline bool _a6xx_check_idle(struct msm_gpu *gpu)
+ {
+ 	struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu);
+@@ -86,7 +164,7 @@ static void a6xx_flush(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+ 	/* Update HW if this is the current ring and we are not in preempt*/
+ 	if (!a6xx_in_preempt(a6xx_gpu)) {
+ 		if (a6xx_gpu->cur_ring == ring)
+-			gpu_write(gpu, REG_A6XX_CP_RB_WPTR, wptr);
++			a6xx_fenced_write(a6xx_gpu, REG_A6XX_CP_RB_WPTR, wptr, BIT(0), false);
+ 		else
+ 			ring->restore_wptr = true;
+ 	} else {
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+index 6e71f617fc3d0..e736c59d566b3 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+@@ -295,5 +295,6 @@ int a6xx_gpu_state_put(struct msm_gpu_state *state);
+ 
+ void a6xx_bus_clear_pending_transactions(struct adreno_gpu *adreno_gpu, bool gx_off);
+ void a6xx_gpu_sw_reset(struct msm_gpu *gpu, bool assert);
++int a6xx_fenced_write(struct a6xx_gpu *gpu, u32 offset, u64 value, u32 mask, bool is_64b);
+ 
+ #endif /* __A6XX_GPU_H__ */
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_preempt.c b/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
+index 6a12a35dabff1..10625ffbc4cfc 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_preempt.c
+@@ -41,7 +41,7 @@ static inline void set_preempt_state(struct a6xx_gpu *gpu,
+ }
+ 
+ /* Write the most recent wptr for the given ring into the hardware */
+-static inline void update_wptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
++static inline void update_wptr(struct a6xx_gpu *a6xx_gpu, struct msm_ringbuffer *ring)
+ {
+ 	unsigned long flags;
+ 	uint32_t wptr;
+@@ -51,7 +51,7 @@ static inline void update_wptr(struct msm_gpu *gpu, struct msm_ringbuffer *ring)
+ 	if (ring->restore_wptr) {
+ 		wptr = get_wptr(ring);
+ 
+-		gpu_write(gpu, REG_A6XX_CP_RB_WPTR, wptr);
++		a6xx_fenced_write(a6xx_gpu, REG_A6XX_CP_RB_WPTR, wptr, BIT(0), false);
+ 
+ 		ring->restore_wptr = false;
+ 	}
+@@ -172,7 +172,7 @@ void a6xx_preempt_irq(struct msm_gpu *gpu)
+ 
+ 	set_preempt_state(a6xx_gpu, PREEMPT_FINISH);
+ 
+-	update_wptr(gpu, a6xx_gpu->cur_ring);
++	update_wptr(a6xx_gpu, a6xx_gpu->cur_ring);
+ 
+ 	set_preempt_state(a6xx_gpu, PREEMPT_NONE);
+ 
+@@ -268,7 +268,7 @@ void a6xx_preempt_trigger(struct msm_gpu *gpu)
+ 	 */
+ 	if (!ring || (a6xx_gpu->cur_ring == ring)) {
+ 		set_preempt_state(a6xx_gpu, PREEMPT_FINISH);
+-		update_wptr(gpu, a6xx_gpu->cur_ring);
++		update_wptr(a6xx_gpu, a6xx_gpu->cur_ring);
+ 		set_preempt_state(a6xx_gpu, PREEMPT_NONE);
+ 		spin_unlock_irqrestore(&a6xx_gpu->eval_lock, flags);
+ 		return;
+@@ -302,13 +302,13 @@ void a6xx_preempt_trigger(struct msm_gpu *gpu)
+ 
+ 	spin_unlock_irqrestore(&ring->preempt_lock, flags);
+ 
+-	gpu_write64(gpu,
+-		REG_A6XX_CP_CONTEXT_SWITCH_SMMU_INFO,
+-		a6xx_gpu->preempt_smmu_iova[ring->id]);
++	a6xx_fenced_write(a6xx_gpu,
++		REG_A6XX_CP_CONTEXT_SWITCH_SMMU_INFO, a6xx_gpu->preempt_smmu_iova[ring->id],
++		BIT(1), true);
+ 
+-	gpu_write64(gpu,
++	a6xx_fenced_write(a6xx_gpu,
+ 		REG_A6XX_CP_CONTEXT_SWITCH_PRIV_NON_SECURE_RESTORE_ADDR,
+-		a6xx_gpu->preempt_iova[ring->id]);
++		a6xx_gpu->preempt_iova[ring->id], BIT(1), true);
+ 
+ 	a6xx_gpu->next_ring = ring;
+ 
+@@ -328,7 +328,7 @@ void a6xx_preempt_trigger(struct msm_gpu *gpu)
+ 	set_preempt_state(a6xx_gpu, PREEMPT_TRIGGERED);
+ 
+ 	/* Trigger the preemption */
+-	gpu_write(gpu, REG_A6XX_CP_CONTEXT_SWITCH_CNTL, cntl);
++	a6xx_fenced_write(a6xx_gpu, REG_A6XX_CP_CONTEXT_SWITCH_CNTL, cntl, BIT(1), false);
+ }
+ 
+ static int preempt_init_ring(struct a6xx_gpu *a6xx_gpu,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-adreno-add-speedbin-data-for-a623-gpu.patch b/queue-6.17/drm-msm-adreno-add-speedbin-data-for-a623-gpu.patch
new file mode 100644
index 0000000000..e4b1ebef14
--- /dev/null
+++ b/queue-6.17/drm-msm-adreno-add-speedbin-data-for-a623-gpu.patch
@@ -0,0 +1,39 @@
+From 0afeb6d4f9fb713c996b8170ebf17097552cb46a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 12:49:53 +0530
+Subject: drm/msm/adreno: Add speedbin data for A623 GPU
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+[ Upstream commit 0584da4515dbb4fec69107ce837eef36a7be5d7d ]
+
+Add the speedbin mappings for Adreno 623 GPU.
+
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/672462/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+index 2b1c41f6cfeee..3c82b3f320e3a 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+@@ -913,6 +913,11 @@ static const struct adreno_info a6xx_gpus[] = {
+ 				{ /* sentinel */ },
+ 			},
+ 		},
++		.speedbins = ADRENO_SPEEDBINS(
++			{ 0,   0 },
++			{ 185, 0 },
++			{ 127, 1 },
++		),
+ 	}, {
+ 		.chip_ids = ADRENO_CHIP_IDS(
+ 			0x06030001,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-adreno-add-speedbins-for-a663-gpu.patch b/queue-6.17/drm-msm-adreno-add-speedbins-for-a663-gpu.patch
new file mode 100644
index 0000000000..218d2cdb94
--- /dev/null
+++ b/queue-6.17/drm-msm-adreno-add-speedbins-for-a663-gpu.patch
@@ -0,0 +1,39 @@
+From df10891e0a2e36649ce303e9854828223a732bc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 00:25:26 +0530
+Subject: drm/msm/adreno: Add speedbins for A663 GPU
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+[ Upstream commit 0c5300343d0c622f7852145a763c570fbaf68a48 ]
+
+Add speedbin mappings for A663 GPU.
+
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670096/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_catalog.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+index 00e1afd46b815..2b1c41f6cfeee 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_catalog.c
+@@ -1024,6 +1024,11 @@ static const struct adreno_info a6xx_gpus[] = {
+ 			.gmu_cgc_mode = 0x00020200,
+ 			.prim_fifo_threshold = 0x00300200,
+ 		},
++		.speedbins = ADRENO_SPEEDBINS(
++			{ 0,   0 },
++			{ 169, 0 },
++			{ 113, 1 },
++		),
+ 	}, {
+ 		.chip_ids = ADRENO_CHIP_IDS(0x06030500),
+ 		.family = ADRENO_6XX_GEN4,
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-dpu-filter-modes-based-on-adjusted-mode-cloc.patch b/queue-6.17/drm-msm-dpu-filter-modes-based-on-adjusted-mode-cloc.patch
new file mode 100644
index 0000000000..7bfa168611
--- /dev/null
+++ b/queue-6.17/drm-msm-dpu-filter-modes-based-on-adjusted-mode-cloc.patch
@@ -0,0 +1,144 @@
+From be9b0effdaf90352a0a868b8df1af962f7386879 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 May 2025 18:38:39 -0700
+Subject: drm/msm/dpu: Filter modes based on adjusted mode clock
+
+From: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
+
+[ Upstream commit 62b7d68352881609e237b303fa391410ebc583a5 ]
+
+Filter out modes that have a clock rate greater than the max core clock
+rate when adjusted for the perf clock factor
+
+This is especially important for chipsets such as QCS615 that have lower
+limits for the MDP max core clock.
+
+Since the core CRTC clock is at least the mode clock (adjusted for the
+perf clock factor) [1], the modes supported by the driver should be less
+than the max core clock rate.
+
+[1] https://elixir.bootlin.com/linux/v6.12.4/source/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c#L83
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/652041/
+Link: https://lore.kernel.org/r/20250506-filter-modes-v2-1-c20a0b7aa241@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c | 35 +++++++++++++------
+ drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h |  3 ++
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c      | 12 +++++++
+ 3 files changed, 39 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+index 0fb5789c60d0d..13cc658065c56 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.c
+@@ -31,6 +31,26 @@ enum dpu_perf_mode {
+ 	DPU_PERF_MODE_MAX
+ };
+ 
++/**
++ * dpu_core_perf_adjusted_mode_clk - Adjust given mode clock rate according to
++ *   the perf clock factor.
++ * @crtc_clk_rate - Unadjusted mode clock rate
++ * @perf_cfg: performance configuration
++ */
++u64 dpu_core_perf_adjusted_mode_clk(u64 mode_clk_rate,
++				    const struct dpu_perf_cfg *perf_cfg)
++{
++	u32 clk_factor;
++
++	clk_factor = perf_cfg->clk_inefficiency_factor;
++	if (clk_factor) {
++		mode_clk_rate *= clk_factor;
++		do_div(mode_clk_rate, 100);
++	}
++
++	return mode_clk_rate;
++}
++
+ /**
+  * _dpu_core_perf_calc_bw() - to calculate BW per crtc
+  * @perf_cfg: performance configuration
+@@ -75,28 +95,21 @@ static u64 _dpu_core_perf_calc_clk(const struct dpu_perf_cfg *perf_cfg,
+ 	struct drm_plane *plane;
+ 	struct dpu_plane_state *pstate;
+ 	struct drm_display_mode *mode;
+-	u64 crtc_clk;
+-	u32 clk_factor;
++	u64 mode_clk;
+ 
+ 	mode = &state->adjusted_mode;
+ 
+-	crtc_clk = (u64)mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
++	mode_clk = (u64)mode->vtotal * mode->hdisplay * drm_mode_vrefresh(mode);
+ 
+ 	drm_atomic_crtc_for_each_plane(plane, crtc) {
+ 		pstate = to_dpu_plane_state(plane->state);
+ 		if (!pstate)
+ 			continue;
+ 
+-		crtc_clk = max(pstate->plane_clk, crtc_clk);
+-	}
+-
+-	clk_factor = perf_cfg->clk_inefficiency_factor;
+-	if (clk_factor) {
+-		crtc_clk *= clk_factor;
+-		do_div(crtc_clk, 100);
++		mode_clk = max(pstate->plane_clk, mode_clk);
+ 	}
+ 
+-	return crtc_clk;
++	return dpu_core_perf_adjusted_mode_clk(mode_clk, perf_cfg);
+ }
+ 
+ static struct dpu_kms *_dpu_crtc_get_kms(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h
+index d2f21d34e501e..3740bc97422ca 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h
+@@ -54,6 +54,9 @@ struct dpu_core_perf {
+ 	u32 fix_core_ab_vote;
+ };
+ 
++u64 dpu_core_perf_adjusted_mode_clk(u64 clk_rate,
++				    const struct dpu_perf_cfg *perf_cfg);
++
+ int dpu_core_perf_crtc_check(struct drm_crtc *crtc,
+ 		struct drm_crtc_state *state);
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 94912b4708fb5..d59512e45af05 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1534,6 +1534,7 @@ static enum drm_mode_status dpu_crtc_mode_valid(struct drm_crtc *crtc,
+ 						const struct drm_display_mode *mode)
+ {
+ 	struct dpu_kms *dpu_kms = _dpu_crtc_get_kms(crtc);
++	u64 adjusted_mode_clk;
+ 
+ 	/* if there is no 3d_mux block we cannot merge LMs so we cannot
+ 	 * split the large layer into 2 LMs, filter out such modes
+@@ -1541,6 +1542,17 @@ static enum drm_mode_status dpu_crtc_mode_valid(struct drm_crtc *crtc,
+ 	if (!dpu_kms->catalog->caps->has_3d_merge &&
+ 	    mode->hdisplay > dpu_kms->catalog->caps->max_mixer_width)
+ 		return MODE_BAD_HVALUE;
++
++	adjusted_mode_clk = dpu_core_perf_adjusted_mode_clk(mode->clock,
++							    dpu_kms->perf.perf_cfg);
++
++	/*
++	 * The given mode, adjusted for the perf clock factor, should not exceed
++	 * the max core clock rate
++	 */
++	if (dpu_kms->perf.max_core_clk_rate < adjusted_mode_clk * 1000)
++		return MODE_CLOCK_HIGH;
++
+ 	/*
+ 	 * max crtc width is equal to the max mixer width * 2 and max height is 4K
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch b/queue-6.17/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
new file mode 100644
index 0000000000..1c1666a7e7
--- /dev/null
+++ b/queue-6.17/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
@@ -0,0 +1,44 @@
+From 77b30b5889798a8a595bca83012d91027de2bc77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:44 +0200
+Subject: drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
+
+According to Hardware Programming Guide for DSI PHY, the retime buffer
+resync should be done after PLL clock users (byte_clk and intf_byte_clk)
+are enabled.  Downstream also does it as part of configuring the PLL.
+
+Driver was only turning off the resync FIFO buffer, but never bringing it
+on again.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657823/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 8c98f91a5930c..6b765f3fd529a 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -491,6 +491,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+ 	if (pll_7nm->slave)
+ 		dsi_pll_enable_global_clk(pll_7nm->slave);
+ 
++	writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++	if (pll_7nm->slave)
++		writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++
+ error:
+ 	return rc;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch b/queue-6.17/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
new file mode 100644
index 0000000000..1bfee3ec96
--- /dev/null
+++ b/queue-6.17/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
@@ -0,0 +1,54 @@
+From d77b670d0b225527d2b61d61d08b5925b4a8a8e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:47 +0200
+Subject: drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
+
+Driver unconditionally saves current state on first init in
+dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
+divider registers.  The state is then restored during probe/enable via
+msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
+dsi_7nm_pll_restore_state().
+
+Restoring calls dsi_pll_7nm_vco_set_rate() with
+pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
+VCO and messes with clock hierarchy, by setting frequency to 0 to clock
+tree.  This makes anyway little sense - VCO rate was not saved, so
+should not be restored.
+
+If PLL was not configured configure it to minimum rate to avoid glitches
+and configuring entire in clock hierarchy to 0 Hz.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657827/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 6b765f3fd529a..5c8a3394c3da0 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -843,6 +843,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+ 
+ 	/* TODO: Remove this when we have proper display handover support */
+ 	msm_dsi_phy_pll_save_state(phy);
++	/*
++	 * Store also proper vco_current_rate, because its value will be used in
++	 * dsi_7nm_pll_restore_state().
++	 */
++	if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
++		pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-fix-32b-size-truncation.patch b/queue-6.17/drm-msm-fix-32b-size-truncation.patch
new file mode 100644
index 0000000000..fa7a78e1e4
--- /dev/null
+++ b/queue-6.17/drm-msm-fix-32b-size-truncation.patch
@@ -0,0 +1,134 @@
+From 7ba5a9bd2ea902545ff0fad50be7966c5c1f1917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 17:04:27 -0700
+Subject: drm/msm: Fix 32b size truncation
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 6d6a29a19b232e29b61a14d58b71fefc2e003fa4 ]
+
+Somehow we never noticed this when arm64 became a thing, many years ago.
+
+v2: also fix npages
+
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Tested-by: Connor Abbott <cwabbott0@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/669785/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/msm_gem.c       | 21 ++++++++++-----------
+ drivers/gpu/drm/msm/msm_gem.h       |  6 +++---
+ drivers/gpu/drm/msm/msm_gem_prime.c |  2 +-
+ 3 files changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index 0745d958f3987..9f7fbe577abb1 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -191,7 +191,7 @@ static struct page **get_pages(struct drm_gem_object *obj)
+ 	if (!msm_obj->pages) {
+ 		struct drm_device *dev = obj->dev;
+ 		struct page **p;
+-		int npages = obj->size >> PAGE_SHIFT;
++		size_t npages = obj->size >> PAGE_SHIFT;
+ 
+ 		p = drm_gem_get_pages(obj);
+ 
+@@ -1152,7 +1152,7 @@ static int msm_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct
+ 
+ /* convenience method to construct a GEM buffer object, and userspace handle */
+ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+-		uint32_t size, uint32_t flags, uint32_t *handle,
++		size_t size, uint32_t flags, uint32_t *handle,
+ 		char *name)
+ {
+ 	struct drm_gem_object *obj;
+@@ -1218,9 +1218,8 @@ static const struct drm_gem_object_funcs msm_gem_object_funcs = {
+ 	.vm_ops = &vm_ops,
+ };
+ 
+-static int msm_gem_new_impl(struct drm_device *dev,
+-		uint32_t size, uint32_t flags,
+-		struct drm_gem_object **obj)
++static int msm_gem_new_impl(struct drm_device *dev, uint32_t flags,
++			    struct drm_gem_object **obj)
+ {
+ 	struct msm_drm_private *priv = dev->dev_private;
+ 	struct msm_gem_object *msm_obj;
+@@ -1254,7 +1253,7 @@ static int msm_gem_new_impl(struct drm_device *dev,
+ 	return 0;
+ }
+ 
+-struct drm_gem_object *msm_gem_new(struct drm_device *dev, uint32_t size, uint32_t flags)
++struct drm_gem_object *msm_gem_new(struct drm_device *dev, size_t size, uint32_t flags)
+ {
+ 	struct msm_drm_private *priv = dev->dev_private;
+ 	struct msm_gem_object *msm_obj;
+@@ -1269,7 +1268,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, uint32_t size, uint32
+ 	if (size == 0)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	ret = msm_gem_new_impl(dev, size, flags, &obj);
++	ret = msm_gem_new_impl(dev, flags, &obj);
+ 	if (ret)
+ 		return ERR_PTR(ret);
+ 
+@@ -1309,12 +1308,12 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+ 	struct msm_drm_private *priv = dev->dev_private;
+ 	struct msm_gem_object *msm_obj;
+ 	struct drm_gem_object *obj;
+-	uint32_t size;
+-	int ret, npages;
++	size_t size, npages;
++	int ret;
+ 
+ 	size = PAGE_ALIGN(dmabuf->size);
+ 
+-	ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
++	ret = msm_gem_new_impl(dev, MSM_BO_WC, &obj);
+ 	if (ret)
+ 		return ERR_PTR(ret);
+ 
+@@ -1357,7 +1356,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+ 	return ERR_PTR(ret);
+ }
+ 
+-void *msm_gem_kernel_new(struct drm_device *dev, uint32_t size, uint32_t flags,
++void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
+ 			 struct drm_gpuvm *vm, struct drm_gem_object **bo,
+ 			 uint64_t *iova)
+ {
+diff --git a/drivers/gpu/drm/msm/msm_gem.h b/drivers/gpu/drm/msm/msm_gem.h
+index 751c3b4965bcd..a4cf31853c500 100644
+--- a/drivers/gpu/drm/msm/msm_gem.h
++++ b/drivers/gpu/drm/msm/msm_gem.h
+@@ -297,10 +297,10 @@ bool msm_gem_active(struct drm_gem_object *obj);
+ int msm_gem_cpu_prep(struct drm_gem_object *obj, uint32_t op, ktime_t *timeout);
+ int msm_gem_cpu_fini(struct drm_gem_object *obj);
+ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file,
+-		uint32_t size, uint32_t flags, uint32_t *handle, char *name);
++		size_t size, uint32_t flags, uint32_t *handle, char *name);
+ struct drm_gem_object *msm_gem_new(struct drm_device *dev,
+-		uint32_t size, uint32_t flags);
+-void *msm_gem_kernel_new(struct drm_device *dev, uint32_t size, uint32_t flags,
++		size_t size, uint32_t flags);
++void *msm_gem_kernel_new(struct drm_device *dev, size_t size, uint32_t flags,
+ 			 struct drm_gpuvm *vm, struct drm_gem_object **bo,
+ 			 uint64_t *iova);
+ void msm_gem_kernel_put(struct drm_gem_object *bo, struct drm_gpuvm *vm);
+diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c
+index c0a33ac839cb6..036d34c674d9a 100644
+--- a/drivers/gpu/drm/msm/msm_gem_prime.c
++++ b/drivers/gpu/drm/msm/msm_gem_prime.c
+@@ -15,7 +15,7 @@
+ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ {
+ 	struct msm_gem_object *msm_obj = to_msm_bo(obj);
+-	int npages = obj->size >> PAGE_SHIFT;
++	size_t npages = obj->size >> PAGE_SHIFT;
+ 
+ 	if (msm_obj->flags & MSM_BO_NO_SHARE)
+ 		return ERR_PTR(-EINVAL);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch b/queue-6.17/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
new file mode 100644
index 0000000000..c45c82668e
--- /dev/null
+++ b/queue-6.17/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
@@ -0,0 +1,43 @@
+From b917dd127e2c8ee5f5815a3e3df07cd51b132a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:06:34 +0200
+Subject: drm/msm: make sure to not queue up recovery more than once
+
+From: Antonino Maniscalco <antomani103@gmail.com>
+
+[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
+
+If two fault IRQs arrive in short succession recovery work will be
+queued up twice.
+
+When recovery runs a second time it may end up killing an unrelated
+context.
+
+Prevent this by masking off interrupts when triggering recovery.
+
+Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670023/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 45dd5fd1c2bfc..f8992a68df7fb 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1727,6 +1727,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+ 	/* Turn off the hangcheck timer to keep it from bothering us */
+ 	timer_delete(&gpu->hangcheck_timer);
+ 
++	/* Turn off interrupts to avoid triggering recovery again */
++	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
++
+ 	kthread_queue_work(gpu->worker, &gpu->recover_work);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch b/queue-6.17/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
new file mode 100644
index 0000000000..5ff80161b1
--- /dev/null
+++ b/queue-6.17/drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
@@ -0,0 +1,61 @@
+From 885cc918e7793ddda8a8319e0f61ae80dc3db0dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 12:30:07 -0700
+Subject: drm/msm/registers: Generate _HI/LO builders for reg64
+
+From: Rob Clark <robin.clark@oss.qualcomm.com>
+
+[ Upstream commit 60e9f776b7932d67c88e8475df7830cb9cdf3154 ]
+
+The upstream mesa copy of the GPU regs has shifted more things to reg64
+instead of seperate 32b HI/LO reg32's.  This works better with the "new-
+style" c++ builders that mesa has been migrating to for a6xx+ (to better
+handle register shuffling between gens), but it leaves the C builders
+with missing _HI/LO builders.
+
+So handle the special case of reg64, automatically generating the
+missing _HI/LO builders.
+
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/673559/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/registers/gen_header.py | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/registers/gen_header.py b/drivers/gpu/drm/msm/registers/gen_header.py
+index a409404627c71..6a6f9e52b11f7 100644
+--- a/drivers/gpu/drm/msm/registers/gen_header.py
++++ b/drivers/gpu/drm/msm/registers/gen_header.py
+@@ -150,6 +150,7 @@ class Bitset(object):
+ 	def __init__(self, name, template):
+ 		self.name = name
+ 		self.inline = False
++		self.reg = None
+ 		if template:
+ 			self.fields = template.fields[:]
+ 		else:
+@@ -256,6 +257,11 @@ class Bitset(object):
+ 	def dump(self, prefix=None):
+ 		if prefix == None:
+ 			prefix = self.name
++		if self.reg and self.reg.bit_size == 64:
++			print("static inline uint32_t %s_LO(uint32_t val)\n{" % prefix)
++			print("\treturn val;\n}")
++			print("static inline uint32_t %s_HI(uint32_t val)\n{" % prefix)
++			print("\treturn val;\n}")
+ 		for f in self.fields:
+ 			if f.name:
+ 				name = prefix + "_" + f.name
+@@ -620,6 +626,7 @@ class Parser(object):
+ 
+ 		self.current_reg = Reg(attrs, self.prefix(variant), self.current_array, bit_size)
+ 		self.current_reg.bitset = self.current_bitset
++		self.current_bitset.reg = self.current_reg
+ 
+ 		if len(self.stack) == 1:
+ 			self.file.append(self.current_reg)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-msm-use-of_reserved_mem_region_to_resource-for-m.patch b/queue-6.17/drm-msm-use-of_reserved_mem_region_to_resource-for-m.patch
new file mode 100644
index 0000000000..a0d0bbabef
--- /dev/null
+++ b/queue-6.17/drm-msm-use-of_reserved_mem_region_to_resource-for-m.patch
@@ -0,0 +1,73 @@
+From 6399191563a99f8f11a84508fc8e640a81d844d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:34:41 -0500
+Subject: drm/msm: Use of_reserved_mem_region_to_resource() for "memory-region"
+
+From: Rob Herring (Arm) <robh@kernel.org>
+
+[ Upstream commit fb53e8f09fc1e1a343fd08ea4f353f81613975d7 ]
+
+Use the newly added of_reserved_mem_region_to_resource() function to
+handle "memory-region" properties.
+
+The original code did not set 'zap_available' to false if
+of_address_to_resource() failed which seems like an oversight.
+
+Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/662275/
+Link: https://lore.kernel.org/r/20250703183442.2073717-1-robh@kernel.org
+[DB: dropped part related to VRAM, no longer applicable]
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index f1230465bf0d0..8c6336b007dc0 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -10,7 +10,7 @@
+ #include <linux/interconnect.h>
+ #include <linux/firmware/qcom/qcom_scm.h>
+ #include <linux/kernel.h>
+-#include <linux/of_address.h>
++#include <linux/of_reserved_mem.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+ #include <linux/soc/qcom/mdt_loader.h>
+@@ -33,7 +33,7 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,
+ 	struct device *dev = &gpu->pdev->dev;
+ 	const struct firmware *fw;
+ 	const char *signed_fwname = NULL;
+-	struct device_node *np, *mem_np;
++	struct device_node *np;
+ 	struct resource r;
+ 	phys_addr_t mem_phys;
+ 	ssize_t mem_size;
+@@ -51,18 +51,11 @@ static int zap_shader_load_mdt(struct msm_gpu *gpu, const char *fwname,
+ 		return -ENODEV;
+ 	}
+ 
+-	mem_np = of_parse_phandle(np, "memory-region", 0);
+-	of_node_put(np);
+-	if (!mem_np) {
++	ret = of_reserved_mem_region_to_resource(np, 0, &r);
++	if (ret) {
+ 		zap_available = false;
+-		return -EINVAL;
+-	}
+-
+-	ret = of_address_to_resource(mem_np, 0, &r);
+-	of_node_put(mem_np);
+-	if (ret)
+ 		return ret;
+-
++	}
+ 	mem_phys = r.start;
+ 
+ 	/*
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-nouveau-always-set-rmdevidcheckignore-for-gsp-rm.patch b/queue-6.17/drm-nouveau-always-set-rmdevidcheckignore-for-gsp-rm.patch
new file mode 100644
index 0000000000..60ee3391d8
--- /dev/null
+++ b/queue-6.17/drm-nouveau-always-set-rmdevidcheckignore-for-gsp-rm.patch
@@ -0,0 +1,61 @@
+From b7f1b870178e4f6db5fb8c2813f26616e2d545b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 14:13:40 -0500
+Subject: drm/nouveau: always set RMDevidCheckIgnore for GSP-RM
+
+From: Timur Tabi <ttabi@nvidia.com>
+
+[ Upstream commit 27738c3003bf3b124527c9ed75e1e0d0c013c101 ]
+
+Always set the RMDevidCheckIgnore registry key for GSP-RM so that it
+will continue support newer variants of already supported GPUs.
+
+GSP-RM maintains an internal list of PCI IDs of GPUs that it supports,
+and checks if the current GPU is on this list.  While the actual GPU
+architecture (as specified in the BOOT_0/BOOT_42 registers) determines
+how to enable the GPU, the PCI ID is used for the product name, e.g.
+"NVIDIA GeForce RTX 5090".
+
+Unfortunately, if there is no match, GSP-RM will refuse to initialize,
+even if the device is fully supported.  Nouveau will get an error
+return code, but by then it's too late.  This behavior may be corrected
+in a future version of GSP-RM, but that does not help Nouveau today.
+
+Fortunately, GSP-RM supports an undocumented registry key that tells it
+to ignore the mismatch.  In such cases, the product name returned will
+be a blank string, but otherwise GSP-RM will continue.
+
+Unlike Nvidia's proprietary driver, Nouveau cannot update to newer
+firmware versions to keep up with every new hardware release.  Instead,
+we can permanently set this registry key, and GSP-RM will continue
+to function the same with known hardware.
+
+Signed-off-by: Timur Tabi <ttabi@nvidia.com>
+Link: https://lore.kernel.org/r/20250808191340.1701983-1-ttabi@nvidia.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
+index 588cb4ab85cb4..32e6a065d6d7a 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c
+@@ -582,10 +582,13 @@ struct nv_gsp_registry_entries {
+  * RMSecBusResetEnable - enables PCI secondary bus reset
+  * RMForcePcieConfigSave - forces GSP-RM to preserve PCI configuration
+  *   registers on any PCI reset.
++ * RMDevidCheckIgnore - allows GSP-RM to boot even if the PCI dev ID
++ *   is not found in the internal product name database.
+  */
+ static const struct nv_gsp_registry_entries r535_registry_entries[] = {
+ 	{ "RMSecBusResetEnable", 1 },
+ 	{ "RMForcePcieConfigSave", 1 },
++	{ "RMDevidCheckIgnore", 1 },
+ };
+ #define NV_GSP_REG_NUM_ENTRIES ARRAY_SIZE(r535_registry_entries)
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-6.17/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..8a976e3a05
--- /dev/null
+++ b/queue-6.17/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From b6b6b81432182972f98bc6d912158cfc5c235dee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panel-backlight-quirks-make-edid-match-optional.patch b/queue-6.17/drm-panel-backlight-quirks-make-edid-match-optional.patch
new file mode 100644
index 0000000000..423cefec29
--- /dev/null
+++ b/queue-6.17/drm-panel-backlight-quirks-make-edid-match-optional.patch
@@ -0,0 +1,44 @@
+From 3fad8f4c6d2a3d1535bd51bcdd68a7c628dd8c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 16:55:36 +0200
+Subject: drm: panel-backlight-quirks: Make EDID match optional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit 9931e4be11f2129a20ffd908bc364598a63016f8 ]
+
+Currently, having a valid panel_id match is required to use the quirk
+system. For certain devices, we know that all SKUs need a certain quirk.
+Therefore, allow not specifying ident by only checking for a match
+if panel_id is non-zero.
+
+Tested-by: Philip Müller <philm@manjaro.org>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Link: https://lore.kernel.org/r/20250829145541.512671-2-lkml@antheas.dev
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_panel_backlight_quirks.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_panel_backlight_quirks.c b/drivers/gpu/drm/drm_panel_backlight_quirks.c
+index 598f812b7cb38..b38b33e26ea5c 100644
+--- a/drivers/gpu/drm/drm_panel_backlight_quirks.c
++++ b/drivers/gpu/drm/drm_panel_backlight_quirks.c
+@@ -50,7 +50,7 @@ static bool drm_panel_min_backlight_quirk_matches(const struct drm_panel_min_bac
+ 	if (!dmi_match(quirk->dmi_match.field, quirk->dmi_match.value))
+ 		return false;
+ 
+-	if (!drm_edid_match(edid, &quirk->ident))
++	if (quirk->ident.panel_id && !drm_edid_match(edid, &quirk->ident))
+ 		return false;
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panel-edp-add-shp-lq134z1-panel-for-dell-xps-934.patch b/queue-6.17/drm-panel-edp-add-shp-lq134z1-panel-for-dell-xps-934.patch
new file mode 100644
index 0000000000..b29bdf1374
--- /dev/null
+++ b/queue-6.17/drm-panel-edp-add-shp-lq134z1-panel-for-dell-xps-934.patch
@@ -0,0 +1,59 @@
+From 08117a6b37b9376bb03239c410d028cae12610c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:27:55 -0400
+Subject: drm/panel-edp: Add SHP LQ134Z1 panel for Dell XPS 9345
+
+From: Christopher Orr <chris.orr@gmail.com>
+
+[ Upstream commit 754dbf164acd4d22dd7a5241b1880f54546d68f2 ]
+
+Introduce high-res OLED panel for the Dell XPS 9345
+
+These timings were selected based on Alex Vinarkskis' commit,
+(6b3815c6815f07acc7eeffa8ae734d1a1c0ee817) for the LQ134N1
+and seem to work fine for the high-res OLED panel on the 9345.
+
+The raw edid for this SHP panel is:
+
+00 ff ff ff ff ff ff 00 4d 10 8f 15 00 00 00 00
+2e 21 01 04 b5 1d 12 78 03 0f 95 ae 52 43 b0 26
+0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01
+01 01 01 01 01 01 fd d7 00 a0 a0 40 fc 66 30 20
+36 00 20 b4 10 00 00 18 00 00 00 fd 00 1e 78 cc
+cc 38 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43
+37 31 4d 31 81 4c 51 31 33 34 5a 31 00 00 00 00
+00 02 41 0c 32 01 01 00 00 0b 41 0a 20 20 01 ea
+
+70 20 79 02 00 20 00 13 8c 52 19 8f 15 00 00 00
+00 2e 17 07 4c 51 31 33 34 5a 31 21 00 1d 40 0b
+08 07 00 0a 40 06 88 e1 fa 51 3d a4 b0 66 62 0f
+02 45 54 d0 5f d0 5f 00 34 13 78 26 00 09 06 00
+00 00 00 00 41 00 00 22 00 14 d9 6f 08 05 ff 09
+9f 00 2f 00 1f 00 3f 06 5d 00 02 00 05 00 25 01
+09 d9 6f 08 d9 6f 08 1e 78 80 81 00 0b e3 05 80
+00 e6 06 05 01 6a 6a 39 00 00 00 00 00 00 58 90
+
+Signed-off-by: Christopher Orr <chris.orr@gmail.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/aJKvm3SlhLGHW4qn@jander
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index d0aa602ecc9de..a926f81f7a2e1 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -2035,6 +2035,7 @@ static const struct edp_panel_entry edp_panels[] = {
+ 	EDP_PANEL_ENTRY('S', 'H', 'P', 0x1523, &delay_80_500_e50, "LQ140M1JW46"),
+ 	EDP_PANEL_ENTRY('S', 'H', 'P', 0x153a, &delay_200_500_e50, "LQ140T1JH01"),
+ 	EDP_PANEL_ENTRY('S', 'H', 'P', 0x154c, &delay_200_500_p2e100, "LQ116M1JW10"),
++	EDP_PANEL_ENTRY('S', 'H', 'P', 0x158f, &delay_200_500_p2e100, "LQ134Z1"),
+ 	EDP_PANEL_ENTRY('S', 'H', 'P', 0x1593, &delay_200_500_p2e100, "LQ134N1"),
+ 
+ 	EDP_PANEL_ENTRY('S', 'T', 'A', 0x0004, &delay_200_500_e200, "116KHD024006"),
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panel-ilitek-ili9881c-move-display_on-_off-dcs-c.patch b/queue-6.17/drm-panel-ilitek-ili9881c-move-display_on-_off-dcs-c.patch
new file mode 100644
index 0000000000..e07366448d
--- /dev/null
+++ b/queue-6.17/drm-panel-ilitek-ili9881c-move-display_on-_off-dcs-c.patch
@@ -0,0 +1,94 @@
+From f56434a37e0371f1b8d6ca9f4a63fa3ff00ca0b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 18:48:55 +0200
+Subject: drm/panel: ilitek-ili9881c: move display_on/_off dcs calls to
+ (un-)prepare
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 5efa82492066fcb32308210fb3f0b752af74334f ]
+
+At least for panel-bridges, the atomic_enable call is defined as being
+called right after the preceding element in the display pipe is enabled.
+
+It is also stated that "The bridge can assume that the display pipe (i.e.
+clocks and timing signals) feeding it is running when this callback is
+called"
+
+This means the DSI controller driving this display would have already
+switched over to video-mode from command mode and thus dcs functions
+should not be called anymore at this point.
+
+This caused a non-working display for me, when trying to enable
+the rk3576 dsi controller using a display using this controller.
+
+Therefore move the display_on/off calls the more appropriate
+prepare/unprepare callbacks.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250707164906.1445288-3-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 27 +++++--------------
+ 1 file changed, 7 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+index 3af22a5f5700c..7ed65d6762d86 100644
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1509,35 +1509,24 @@ static int ili9881c_prepare(struct drm_panel *panel)
+ 	if (ret)
+ 		goto disable_power;
+ 
+-	return 0;
+-
+-disable_power:
+-	regulator_disable(ctx->power);
+-	return ret;
+-}
+-
+-static int ili9881c_enable(struct drm_panel *panel)
+-{
+-	struct ili9881c *ctx = panel_to_ili9881c(panel);
+-
+ 	msleep(120);
+ 
+-	mipi_dsi_dcs_set_display_on(ctx->dsi);
++	ret = mipi_dsi_dcs_set_display_on(ctx->dsi);
++	if (ret)
++		goto disable_power;
+ 
+ 	return 0;
+-}
+ 
+-static int ili9881c_disable(struct drm_panel *panel)
+-{
+-	struct ili9881c *ctx = panel_to_ili9881c(panel);
+-
+-	return mipi_dsi_dcs_set_display_off(ctx->dsi);
++disable_power:
++	regulator_disable(ctx->power);
++	return ret;
+ }
+ 
+ static int ili9881c_unprepare(struct drm_panel *panel)
+ {
+ 	struct ili9881c *ctx = panel_to_ili9881c(panel);
+ 
++	mipi_dsi_dcs_set_display_off(ctx->dsi);
+ 	mipi_dsi_dcs_enter_sleep_mode(ctx->dsi);
+ 	regulator_disable(ctx->power);
+ 	gpiod_set_value_cansleep(ctx->reset, 1);
+@@ -1710,8 +1699,6 @@ static enum drm_panel_orientation ili9881c_get_orientation(struct drm_panel *pan
+ static const struct drm_panel_funcs ili9881c_funcs = {
+ 	.prepare	= ili9881c_prepare,
+ 	.unprepare	= ili9881c_unprepare,
+-	.enable		= ili9881c_enable,
+-	.disable	= ili9881c_disable,
+ 	.get_modes	= ili9881c_get_modes,
+ 	.get_orientation = ili9881c_get_orientation,
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panel-ilitek-ili9881c-turn-off-power-supply-when.patch b/queue-6.17/drm-panel-ilitek-ili9881c-turn-off-power-supply-when.patch
new file mode 100644
index 0000000000..0ae1a140c1
--- /dev/null
+++ b/queue-6.17/drm-panel-ilitek-ili9881c-turn-off-power-supply-when.patch
@@ -0,0 +1,63 @@
+From e938f9cb46c134934154ad8bf9b062ec57dc6ad2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 18:48:54 +0200
+Subject: drm/panel: ilitek-ili9881c: turn off power-supply when init fails
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 6c66eba502709a78281333187c1add7b71f7201f ]
+
+The prepare function turns on the power-supply regulator first, when
+preparing the display. But in an error case, just returns the error
+code, but does not power off the regulator again, fix that.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20250707164906.1445288-2-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+index ac433345a1794..3af22a5f5700c 100644
+--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
++++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+@@ -1486,7 +1486,7 @@ static int ili9881c_prepare(struct drm_panel *panel)
+ 						      instr->arg.cmd.data);
+ 
+ 		if (ret)
+-			return ret;
++			goto disable_power;
+ 	}
+ 
+ 	ret = ili9881c_switch_page(ctx, 0);
+@@ -1498,18 +1498,22 @@ static int ili9881c_prepare(struct drm_panel *panel)
+ 					 &ctx->address_mode,
+ 					 sizeof(ctx->address_mode));
+ 		if (ret < 0)
+-			return ret;
++			goto disable_power;
+ 	}
+ 
+ 	ret = mipi_dsi_dcs_set_tear_on(ctx->dsi, MIPI_DSI_DCS_TEAR_MODE_VBLANK);
+ 	if (ret)
+-		return ret;
++		goto disable_power;
+ 
+ 	ret = mipi_dsi_dcs_exit_sleep_mode(ctx->dsi);
+ 	if (ret)
+-		return ret;
++		goto disable_power;
+ 
+ 	return 0;
++
++disable_power:
++	regulator_disable(ctx->power);
++	return ret;
+ }
+ 
+ static int ili9881c_enable(struct drm_panel *panel)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch b/queue-6.17/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
new file mode 100644
index 0000000000..a85e1c6044
--- /dev/null
+++ b/queue-6.17/drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
@@ -0,0 +1,48 @@
+From 3f5482bd8da2ea77197e6d1a58a00bab50fbf9c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 13:01:16 -0700
+Subject: drm/panthor: check bo offset alignment in vm bind
+
+From: Chia-I Wu <olvaffe@gmail.com>
+
+[ Upstream commit 5afa9d2a9bb1410f816e0123846047288b16e4b9 ]
+
+Fail early from panthor_vm_bind_prepare_op_ctx instead of late from
+ops->map_pages.
+
+Signed-off-by: Chia-I Wu <olvaffe@gmail.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20250828200116.3532255-1-olvaffe@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_mmu.c b/drivers/gpu/drm/panthor/panthor_mmu.c
+index 0402f5f734a1b..de6ec324c8efc 100644
+--- a/drivers/gpu/drm/panthor/panthor_mmu.c
++++ b/drivers/gpu/drm/panthor/panthor_mmu.c
+@@ -1198,7 +1198,7 @@ static int panthor_vm_prepare_map_op_ctx(struct panthor_vm_op_ctx *op_ctx,
+ 	    (flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) != DRM_PANTHOR_VM_BIND_OP_TYPE_MAP)
+ 		return -EINVAL;
+ 
+-	/* Make sure the VA and size are aligned and in-bounds. */
++	/* Make sure the VA and size are in-bounds. */
+ 	if (size > bo->base.base.size || offset > bo->base.base.size - size)
+ 		return -EINVAL;
+ 
+@@ -2415,7 +2415,7 @@ panthor_vm_bind_prepare_op_ctx(struct drm_file *file,
+ 	int ret;
+ 
+ 	/* Aligned on page size. */
+-	if (!IS_ALIGNED(op->va | op->size, vm_pgsz))
++	if (!IS_ALIGNED(op->va | op->size | op->bo_offset, vm_pgsz))
+ 		return -EINVAL;
+ 
+ 	switch (op->flags & DRM_PANTHOR_VM_BIND_OP_TYPE_MASK) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-panthor-serialize-gpu-cache-flush-operations.patch b/queue-6.17/drm-panthor-serialize-gpu-cache-flush-operations.patch
new file mode 100644
index 0000000000..f8f682ad53
--- /dev/null
+++ b/queue-6.17/drm-panthor-serialize-gpu-cache-flush-operations.patch
@@ -0,0 +1,61 @@
+From 33ca701141011ca9ecdb1a582a48025d68676273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 17:26:31 +0100
+Subject: drm/panthor: Serialize GPU cache flush operations
+
+From: Karunika Choo <karunika.choo@arm.com>
+
+[ Upstream commit e322a4844811b54477b7072eb40dc9e402a1725d ]
+
+In certain scenarios, it is possible for multiple cache flushes to be
+requested before the previous one completes. This patch introduces the
+cache_flush_lock mutex to serialize these operations and ensure that
+any requested cache flushes are completed instead of dropped.
+
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Co-developed-by: Dennis Tsiang <dennis.tsiang@arm.com>
+Signed-off-by: Dennis Tsiang <dennis.tsiang@arm.com>
+Signed-off-by: Karunika Choo <karunika.choo@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20250807162633.3666310-6-karunika.choo@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panthor/panthor_gpu.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/panthor/panthor_gpu.c b/drivers/gpu/drm/panthor/panthor_gpu.c
+index cb7a335e07d7c..030409371037b 100644
+--- a/drivers/gpu/drm/panthor/panthor_gpu.c
++++ b/drivers/gpu/drm/panthor/panthor_gpu.c
+@@ -35,6 +35,9 @@ struct panthor_gpu {
+ 
+ 	/** @reqs_acked: GPU request wait queue. */
+ 	wait_queue_head_t reqs_acked;
++
++	/** @cache_flush_lock: Lock to serialize cache flushes */
++	struct mutex cache_flush_lock;
+ };
+ 
+ /**
+@@ -204,6 +207,7 @@ int panthor_gpu_init(struct panthor_device *ptdev)
+ 
+ 	spin_lock_init(&gpu->reqs_lock);
+ 	init_waitqueue_head(&gpu->reqs_acked);
++	mutex_init(&gpu->cache_flush_lock);
+ 	ptdev->gpu = gpu;
+ 	panthor_gpu_init_info(ptdev);
+ 
+@@ -353,6 +357,9 @@ int panthor_gpu_flush_caches(struct panthor_device *ptdev,
+ 	bool timedout = false;
+ 	unsigned long flags;
+ 
++	/* Serialize cache flush operations. */
++	guard(mutex)(&ptdev->gpu->cache_flush_lock);
++
+ 	spin_lock_irqsave(&ptdev->gpu->reqs_lock, flags);
+ 	if (!drm_WARN_ON(&ptdev->base,
+ 			 ptdev->gpu->pending_reqs & GPU_IRQ_CLEAN_CACHES_COMPLETED)) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-sharp-memory-do-not-access-gem-dma-vaddr-directl.patch b/queue-6.17/drm-sharp-memory-do-not-access-gem-dma-vaddr-directl.patch
new file mode 100644
index 0000000000..5324da24fb
--- /dev/null
+++ b/queue-6.17/drm-sharp-memory-do-not-access-gem-dma-vaddr-directl.patch
@@ -0,0 +1,139 @@
+From 43c95141e9ee74a7bfa5c2c4d1babe2005b3f2ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 17:23:09 +0200
+Subject: drm/sharp-memory: Do not access GEM-DMA vaddr directly
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 136c374d8c80378d2982a46b2adabfc007299641 ]
+
+Use DRM's shadow-plane helper to map and access the GEM object's buffer
+within kernel address space. Encapsulates the vmap logic in the GEM-DMA
+helpers.
+
+The sharp-memory driver currently reads the vaddr field from the GME
+buffer object directly. This only works because GEM code 'automagically'
+sets vaddr.
+
+Shadow-plane helpers perform the same steps, but with correct abstraction
+behind drm_gem_vmap(). The shadow-plane state provides the buffer address
+in kernel address space and the format-conversion state.
+
+v2:
+- fix typo in commit description
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://lore.kernel.org/r/20250627152327.8244-1-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tiny/sharp-memory.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/tiny/sharp-memory.c b/drivers/gpu/drm/tiny/sharp-memory.c
+index 03d2850310c47..64272cd0f6e22 100644
+--- a/drivers/gpu/drm/tiny/sharp-memory.c
++++ b/drivers/gpu/drm/tiny/sharp-memory.c
+@@ -126,28 +126,28 @@ static inline void sharp_memory_set_tx_buffer_addresses(u8 *buffer,
+ 
+ static void sharp_memory_set_tx_buffer_data(u8 *buffer,
+ 					    struct drm_framebuffer *fb,
++					    const struct iosys_map *vmap,
+ 					    struct drm_rect clip,
+ 					    u32 pitch,
+ 					    struct drm_format_conv_state *fmtcnv_state)
+ {
+ 	int ret;
+-	struct iosys_map dst, vmap;
+-	struct drm_gem_dma_object *dma_obj = drm_fb_dma_get_gem_obj(fb, 0);
++	struct iosys_map dst;
+ 
+ 	ret = drm_gem_fb_begin_cpu_access(fb, DMA_FROM_DEVICE);
+ 	if (ret)
+ 		return;
+ 
+ 	iosys_map_set_vaddr(&dst, buffer);
+-	iosys_map_set_vaddr(&vmap, dma_obj->vaddr);
+ 
+-	drm_fb_xrgb8888_to_mono(&dst, &pitch, &vmap, fb, &clip, fmtcnv_state);
++	drm_fb_xrgb8888_to_mono(&dst, &pitch, vmap, fb, &clip, fmtcnv_state);
+ 
+ 	drm_gem_fb_end_cpu_access(fb, DMA_FROM_DEVICE);
+ }
+ 
+ static int sharp_memory_update_display(struct sharp_memory_device *smd,
+ 				       struct drm_framebuffer *fb,
++				       const struct iosys_map *vmap,
+ 				       struct drm_rect clip,
+ 				       struct drm_format_conv_state *fmtcnv_state)
+ {
+@@ -163,7 +163,7 @@ static int sharp_memory_update_display(struct sharp_memory_device *smd,
+ 	sharp_memory_set_tx_buffer_mode(&tx_buffer[0],
+ 					SHARP_MEMORY_DISPLAY_UPDATE_MODE, vcom);
+ 	sharp_memory_set_tx_buffer_addresses(&tx_buffer[1], clip, pitch);
+-	sharp_memory_set_tx_buffer_data(&tx_buffer[2], fb, clip, pitch, fmtcnv_state);
++	sharp_memory_set_tx_buffer_data(&tx_buffer[2], fb, vmap, clip, pitch, fmtcnv_state);
+ 
+ 	ret = sharp_memory_spi_write(smd->spi, tx_buffer, tx_buffer_size);
+ 
+@@ -206,7 +206,8 @@ static int sharp_memory_clear_display(struct sharp_memory_device *smd)
+ 	return ret;
+ }
+ 
+-static void sharp_memory_fb_dirty(struct drm_framebuffer *fb, struct drm_rect *rect,
++static void sharp_memory_fb_dirty(struct drm_framebuffer *fb, const struct iosys_map *vmap,
++				  struct drm_rect *rect,
+ 				  struct drm_format_conv_state *fmtconv_state)
+ {
+ 	struct drm_rect clip;
+@@ -218,7 +219,7 @@ static void sharp_memory_fb_dirty(struct drm_framebuffer *fb, struct drm_rect *r
+ 	clip.y1 = rect->y1;
+ 	clip.y2 = rect->y2;
+ 
+-	sharp_memory_update_display(smd, fb, clip, fmtconv_state);
++	sharp_memory_update_display(smd, fb, vmap, clip, fmtconv_state);
+ }
+ 
+ static int sharp_memory_plane_atomic_check(struct drm_plane *plane,
+@@ -242,7 +243,7 @@ static void sharp_memory_plane_atomic_update(struct drm_plane *plane,
+ {
+ 	struct drm_plane_state *old_state = drm_atomic_get_old_plane_state(state, plane);
+ 	struct drm_plane_state *plane_state = plane->state;
+-	struct drm_format_conv_state fmtcnv_state = DRM_FORMAT_CONV_STATE_INIT;
++	struct drm_shadow_plane_state *shadow_plane_state = to_drm_shadow_plane_state(plane_state);
+ 	struct sharp_memory_device *smd;
+ 	struct drm_rect rect;
+ 
+@@ -251,15 +252,15 @@ static void sharp_memory_plane_atomic_update(struct drm_plane *plane,
+ 		return;
+ 
+ 	if (drm_atomic_helper_damage_merged(old_state, plane_state, &rect))
+-		sharp_memory_fb_dirty(plane_state->fb, &rect, &fmtcnv_state);
+-
+-	drm_format_conv_state_release(&fmtcnv_state);
++		sharp_memory_fb_dirty(plane_state->fb, shadow_plane_state->data,
++				      &rect, &shadow_plane_state->fmtcnv_state);
+ }
+ 
+ static const struct drm_plane_helper_funcs sharp_memory_plane_helper_funcs = {
+ 	.prepare_fb = drm_gem_plane_helper_prepare_fb,
+ 	.atomic_check = sharp_memory_plane_atomic_check,
+ 	.atomic_update = sharp_memory_plane_atomic_update,
++	DRM_GEM_SHADOW_PLANE_HELPER_FUNCS,
+ };
+ 
+ static bool sharp_memory_format_mod_supported(struct drm_plane *plane,
+@@ -273,9 +274,7 @@ static const struct drm_plane_funcs sharp_memory_plane_funcs = {
+ 	.update_plane = drm_atomic_helper_update_plane,
+ 	.disable_plane = drm_atomic_helper_disable_plane,
+ 	.destroy = drm_plane_cleanup,
+-	.reset = drm_atomic_helper_plane_reset,
+-	.atomic_duplicate_state	= drm_atomic_helper_plane_duplicate_state,
+-	.atomic_destroy_state = drm_atomic_helper_plane_destroy_state,
++	DRM_GEM_SHADOW_PLANE_FUNCS,
+ 	.format_mod_supported = sharp_memory_format_mod_supported,
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-st7571-i2c-add-support-for-inverted-pixel-format.patch b/queue-6.17/drm-st7571-i2c-add-support-for-inverted-pixel-format.patch
new file mode 100644
index 0000000000..6203f17374
--- /dev/null
+++ b/queue-6.17/drm-st7571-i2c-add-support-for-inverted-pixel-format.patch
@@ -0,0 +1,80 @@
+From 289b136281bf22c7f416ff76f5c22711375a6301 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 12:43:34 +0200
+Subject: drm/st7571-i2c: add support for inverted pixel format
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit e61c35157d32b4b422f0a4cbc3c40d04d883a9c9 ]
+
+Depending on which display that is connected to the controller, an
+"1" means either a black or a white pixel.
+
+The supported formats (R1/R2/XRGB8888) expects the pixels
+to map against (4bit):
+    00 => Black
+    01 => Dark Gray
+    10 => Light Gray
+    11 => White
+
+If this is not what the display map against, make it possible to invert
+the pixels.
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Link: https://lore.kernel.org/r/20250721-st7571-format-v2-4-159f4134098c@gmail.com
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sitronix/st7571-i2c.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sitronix/st7571-i2c.c b/drivers/gpu/drm/sitronix/st7571-i2c.c
+index 453eb7e045e5f..125e810df1391 100644
+--- a/drivers/gpu/drm/sitronix/st7571-i2c.c
++++ b/drivers/gpu/drm/sitronix/st7571-i2c.c
+@@ -151,6 +151,7 @@ struct st7571_device {
+ 	bool ignore_nak;
+ 
+ 	bool grayscale;
++	bool inverted;
+ 	u32 height_mm;
+ 	u32 width_mm;
+ 	u32 startline;
+@@ -792,6 +793,7 @@ static int st7567_parse_dt(struct st7571_device *st7567)
+ 
+ 	of_property_read_u32(np, "width-mm", &st7567->width_mm);
+ 	of_property_read_u32(np, "height-mm", &st7567->height_mm);
++	st7567->inverted = of_property_read_bool(np, "sitronix,inverted");
+ 
+ 	st7567->pformat = &st7571_monochrome;
+ 	st7567->bpp = 1;
+@@ -819,6 +821,7 @@ static int st7571_parse_dt(struct st7571_device *st7571)
+ 	of_property_read_u32(np, "width-mm", &st7571->width_mm);
+ 	of_property_read_u32(np, "height-mm", &st7571->height_mm);
+ 	st7571->grayscale = of_property_read_bool(np, "sitronix,grayscale");
++	st7571->inverted = of_property_read_bool(np, "sitronix,inverted");
+ 
+ 	if (st7571->grayscale) {
+ 		st7571->pformat = &st7571_grayscale;
+@@ -873,7 +876,7 @@ static int st7567_lcd_init(struct st7571_device *st7567)
+ 		ST7571_SET_POWER(0x6),	/* Power Control, VC: ON, VR: ON, VF: OFF */
+ 		ST7571_SET_POWER(0x7),	/* Power Control, VC: ON, VR: ON, VF: ON */
+ 
+-		ST7571_SET_REVERSE(0),
++		ST7571_SET_REVERSE(st7567->inverted ? 1 : 0),
+ 		ST7571_SET_ENTIRE_DISPLAY_ON(0),
+ 	};
+ 
+@@ -917,7 +920,7 @@ static int st7571_lcd_init(struct st7571_device *st7571)
+ 		ST7571_SET_COLOR_MODE(st7571->pformat->mode),
+ 		ST7571_COMMAND_SET_NORMAL,
+ 
+-		ST7571_SET_REVERSE(0),
++		ST7571_SET_REVERSE(st7571->inverted ? 1 : 0),
+ 		ST7571_SET_ENTIRE_DISPLAY_ON(0),
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-tidss-remove-early-fb.patch b/queue-6.17/drm-tidss-remove-early-fb.patch
new file mode 100644
index 0000000000..01247ba934
--- /dev/null
+++ b/queue-6.17/drm-tidss-remove-early-fb.patch
@@ -0,0 +1,56 @@
+From 85e7bdd00f192a9314217ecc38da8b6183a37c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Apr 2025 14:06:30 +0300
+Subject: drm/tidss: Remove early fb
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 942e54a372b44da3ffb0191b4d289d476256c861 ]
+
+Add a call to drm_aperture_remove_framebuffers() to drop the possible
+early fb (simplefb).
+
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://lore.kernel.org/r/20250416-tidss-splash-v1-2-4ff396eb5008@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_drv.c b/drivers/gpu/drm/tidss/tidss_drv.c
+index a1b12e52aca47..27d9a8fd541fc 100644
+--- a/drivers/gpu/drm/tidss/tidss_drv.c
++++ b/drivers/gpu/drm/tidss/tidss_drv.c
+@@ -8,6 +8,7 @@
+ #include <linux/of.h>
+ #include <linux/module.h>
+ #include <linux/pm_runtime.h>
++#include <linux/aperture.h>
+ 
+ #include <drm/clients/drm_client_setup.h>
+ #include <drm/drm_atomic.h>
+@@ -192,12 +193,20 @@ static int tidss_probe(struct platform_device *pdev)
+ 		goto err_irq_uninstall;
+ 	}
+ 
++	/* Remove possible early fb before setting up the fbdev */
++	ret = aperture_remove_all_conflicting_devices(tidss_driver.name);
++	if (ret)
++		goto err_drm_dev_unreg;
++
+ 	drm_client_setup(ddev, NULL);
+ 
+ 	dev_dbg(dev, "%s done\n", __func__);
+ 
+ 	return 0;
+ 
++err_drm_dev_unreg:
++	drm_dev_unregister(ddev);
++
+ err_irq_uninstall:
+ 	tidss_irq_uninstall(ddev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch b/queue-6.17/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
new file mode 100644
index 0000000000..d41ca89dcf
--- /dev/null
+++ b/queue-6.17/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
@@ -0,0 +1,48 @@
+From c205c9950f66aab3dc7eb5deb9f2d0d8f53b82e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:34:02 +0530
+Subject: drm/tidss: Set crtc modesetting parameters with adjusted mode
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
+
+TIDSS uses crtc_* fields to propagate its registers and set the
+clock rates. So set the CRTC modesetting timing parameters with
+the adjusted mode when needed, to set correct values.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 17efd77ce7f23..da89fd01c3376 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -91,7 +91,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 	struct dispc_device *dispc = tidss->dispc;
+ 	struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
+ 	u32 hw_videoport = tcrtc->hw_videoport;
+-	const struct drm_display_mode *mode;
++	struct drm_display_mode *mode;
+ 	enum drm_mode_status ok;
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+@@ -108,6 +108,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 		return -EINVAL;
+ 	}
+ 
++	if (drm_atomic_crtc_needs_modeset(crtc_state))
++		drm_mode_set_crtcinfo(mode, 0);
++
+ 	return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-6.17/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..38c3dcd869
--- /dev/null
+++ b/queue-6.17/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From 41b14769c695be3e0623d423a20fb5a21935daf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index a2f40a5c77030..17efd77ce7f23 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -225,7 +225,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index c0277fa36425e..3f6cff2ab1b29 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -1215,13 +1215,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1263,8 +1263,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-cancel-pending-tlb-inval-workers-on-teardown.patch b/queue-6.17/drm-xe-cancel-pending-tlb-inval-workers-on-teardown.patch
new file mode 100644
index 0000000000..9271105dca
--- /dev/null
+++ b/queue-6.17/drm-xe-cancel-pending-tlb-inval-workers-on-teardown.patch
@@ -0,0 +1,78 @@
+From 9e4407db94554c0ccda24470dc2e74f0299b5658 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:29:04 +0000
+Subject: drm/xe: Cancel pending TLB inval workers on teardown
+
+From: Stuart Summers <stuart.summers@intel.com>
+
+[ Upstream commit 76186a253a4b9eb41c5a83224c14efdf30960a71 ]
+
+Add a new _fini() routine on the GT TLB invalidation
+side to handle this worker cleanup on driver teardown.
+
+v2: Move the TLB teardown to the gt fini() routine called during
+    gt_init rather than in gt_alloc. This way the GT structure stays
+    alive for while we reset the TLB state.
+
+Signed-off-by: Stuart Summers <stuart.summers@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://lore.kernel.org/r/20250826182911.392550-3-stuart.summers@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gt.c                  |  2 ++
+ drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 12 ++++++++++++
+ drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h |  1 +
+ 3 files changed, 15 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c
+index 4d74a4983fd07..2f4c52716e75b 100644
+--- a/drivers/gpu/drm/xe/xe_gt.c
++++ b/drivers/gpu/drm/xe/xe_gt.c
+@@ -605,6 +605,8 @@ static void xe_gt_fini(void *arg)
+ 	struct xe_gt *gt = arg;
+ 	int i;
+ 
++	xe_gt_tlb_invalidation_fini(gt);
++
+ 	for (i = 0; i < XE_ENGINE_CLASS_MAX; ++i)
+ 		xe_hw_fence_irq_finish(&gt->fence_irq[i]);
+ 
+diff --git a/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c b/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
+index 086c12ee3d9de..64cd6cf0ab8df 100644
+--- a/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
++++ b/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c
+@@ -173,6 +173,18 @@ void xe_gt_tlb_invalidation_reset(struct xe_gt *gt)
+ 	mutex_unlock(&gt->uc.guc.ct.lock);
+ }
+ 
++/**
++ *
++ * xe_gt_tlb_invalidation_fini - Clean up GT TLB invalidation state
++ *
++ * Cancel pending fence workers and clean up any additional
++ * GT TLB invalidation state.
++ */
++void xe_gt_tlb_invalidation_fini(struct xe_gt *gt)
++{
++	xe_gt_tlb_invalidation_reset(gt);
++}
++
+ static bool tlb_invalidation_seqno_past(struct xe_gt *gt, int seqno)
+ {
+ 	int seqno_recv = READ_ONCE(gt->tlb_invalidation.seqno_recv);
+diff --git a/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h b/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h
+index f7f0f2eaf4b59..3e4cff3922d6f 100644
+--- a/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h
++++ b/drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h
+@@ -16,6 +16,7 @@ struct xe_vm;
+ struct xe_vma;
+ 
+ int xe_gt_tlb_invalidation_init_early(struct xe_gt *gt);
++void xe_gt_tlb_invalidation_fini(struct xe_gt *gt);
+ 
+ void xe_gt_tlb_invalidation_reset(struct xe_gt *gt);
+ int xe_gt_tlb_invalidation_ggtt(struct xe_gt *gt);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-configfs-enforce-canonical-device-names.patch b/queue-6.17/drm-xe-configfs-enforce-canonical-device-names.patch
new file mode 100644
index 0000000000..8064950200
--- /dev/null
+++ b/queue-6.17/drm-xe-configfs-enforce-canonical-device-names.patch
@@ -0,0 +1,70 @@
+From 1184cc586101282be8cbbb93dc0bf2c4bcefad84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 16:10:55 +0200
+Subject: drm/xe/configfs: Enforce canonical device names
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 400a6da1e967c4f117e4757412df06dcfaea0e6a ]
+
+While we expect config directory names to match PCI device name,
+currently we are only scanning provided names for domain, bus,
+device and function numbers, without checking their format.
+This would pass slightly broken entries like:
+
+  /sys/kernel/config/xe/
+  ├── 0000:00:02.0000000000000
+  │   └── ...
+  ├── 0000:00:02.0x
+  │   └── ...
+  ├──  0: 0: 2. 0
+  │   └── ...
+  └── 0:0:2.0
+      └── ...
+
+To avoid such mistakes, check if the name provided exactly matches
+the canonical PCI device address format, which we recreated from
+the parsed BDF data. Also simplify scanf format as it can't really
+catch all formatting errors.
+
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://lore.kernel.org/r/20250722141059.30707-3-michal.wajdeczko@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_configfs.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_configfs.c b/drivers/gpu/drm/xe/xe_configfs.c
+index 58c1f397c68c9..797508cc6eb17 100644
+--- a/drivers/gpu/drm/xe/xe_configfs.c
++++ b/drivers/gpu/drm/xe/xe_configfs.c
+@@ -259,12 +259,19 @@ static struct config_group *xe_config_make_device_group(struct config_group *gro
+ 	unsigned int domain, bus, slot, function;
+ 	struct xe_config_device *dev;
+ 	struct pci_dev *pdev;
++	char canonical[16];
+ 	int ret;
+ 
+-	ret = sscanf(name, "%04x:%02x:%02x.%x", &domain, &bus, &slot, &function);
++	ret = sscanf(name, "%x:%x:%x.%x", &domain, &bus, &slot, &function);
+ 	if (ret != 4)
+ 		return ERR_PTR(-EINVAL);
+ 
++	ret = scnprintf(canonical, sizeof(canonical), "%04x:%02x:%02x.%d", domain, bus,
++			PCI_SLOT(PCI_DEVFN(slot, function)),
++			PCI_FUNC(PCI_DEVFN(slot, function)));
++	if (ret != 12 || strcmp(name, canonical))
++		return ERR_PTR(-EINVAL);
++
+ 	pdev = pci_get_domain_bus_and_slot(domain, bus, PCI_DEVFN(slot, function));
+ 	if (!pdev)
+ 		return ERR_PTR(-ENODEV);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-ensure-gt-is-in-c0-during-resumes.patch b/queue-6.17/drm-xe-ensure-gt-is-in-c0-during-resumes.patch
new file mode 100644
index 0000000000..00fd84440c
--- /dev/null
+++ b/queue-6.17/drm-xe-ensure-gt-is-in-c0-during-resumes.patch
@@ -0,0 +1,66 @@
+From 77e627faf7fd741a86a4bdb2700370e3503b6702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:06:33 -0700
+Subject: drm/xe: Ensure GT is in C0 during resumes
+
+From: Xin Wang <x.wang@intel.com>
+
+[ Upstream commit 95d0883ac8105717f59c2dcdc0d8b9150f13aa12 ]
+
+This patch ensures the gt will be awake for the entire duration
+of the resume sequences until GuCRC takes over and GT-C6 gets
+re-enabled.
+
+Before suspending GT-C6 is kept enabled, but upon resume, GuCRC
+is not yet alive to properly control the exits and some cases of
+instability and corruption related to GT-C6 can be observed.
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037
+
+Suggested-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Xin Wang <x.wang@intel.com>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4037
+Link: https://lore.kernel.org/r/20250827000633.1369890-3-x.wang@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pm.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pm.c b/drivers/gpu/drm/xe/xe_pm.c
+index 3e301e42b2f19..9fccc7a855f30 100644
+--- a/drivers/gpu/drm/xe/xe_pm.c
++++ b/drivers/gpu/drm/xe/xe_pm.c
+@@ -18,7 +18,7 @@
+ #include "xe_device.h"
+ #include "xe_ggtt.h"
+ #include "xe_gt.h"
+-#include "xe_guc.h"
++#include "xe_gt_idle.h"
+ #include "xe_i2c.h"
+ #include "xe_irq.h"
+ #include "xe_pcode.h"
+@@ -177,6 +177,9 @@ int xe_pm_resume(struct xe_device *xe)
+ 	drm_dbg(&xe->drm, "Resuming device\n");
+ 	trace_xe_pm_resume(xe, __builtin_return_address(0));
+ 
++	for_each_gt(gt, xe, id)
++		xe_gt_idle_disable_c6(gt);
++
+ 	for_each_tile(tile, xe, id)
+ 		xe_wa_apply_tile_workarounds(tile);
+ 
+@@ -547,6 +550,9 @@ int xe_pm_runtime_resume(struct xe_device *xe)
+ 
+ 	xe_rpm_lockmap_acquire(xe);
+ 
++	for_each_gt(gt, xe, id)
++		xe_gt_idle_disable_c6(gt);
++
+ 	if (xe->d3cold.allowed) {
+ 		err = xe_pcode_ready(xe, true);
+ 		if (err)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-extend-wa_13012615864-to-additional-xe2-and-x.patch b/queue-6.17/drm-xe-extend-wa_13012615864-to-additional-xe2-and-x.patch
new file mode 100644
index 0000000000..57f1144e6f
--- /dev/null
+++ b/queue-6.17/drm-xe-extend-wa_13012615864-to-additional-xe2-and-x.patch
@@ -0,0 +1,66 @@
+From cd640b18e7598a12dc911782dc60ddad52310680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 22:01:44 +0000
+Subject: drm/xe: Extend wa_13012615864 to additional Xe2 and Xe3 platforms
+
+From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+
+[ Upstream commit bcddb12c027434fdf0491c1a05a3fe4fd2263d71 ]
+
+Extend WA 13012615864 to Graphics Versions 20.01,20.02,20.04
+and 30.03.
+
+Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Link: https://lore.kernel.org/r/20250731220143.72942-2-jonathan.cavitt@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_wa.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index 22a98600fd8f2..535067e7fb0c9 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -538,6 +538,11 @@ static const struct xe_rtp_entry_sr engine_was[] = {
+ 	  XE_RTP_RULES(GRAPHICS_VERSION(2004), ENGINE_CLASS(RENDER)),
+ 	  XE_RTP_ACTIONS(SET(HALF_SLICE_CHICKEN7, CLEAR_OPTIMIZATION_DISABLE))
+ 	},
++	{ XE_RTP_NAME("13012615864"),
++	  XE_RTP_RULES(GRAPHICS_VERSION(2004),
++		       FUNC(xe_rtp_match_first_render_or_compute)),
++	  XE_RTP_ACTIONS(SET(TDL_TSL_CHICKEN, RES_CHK_SPR_DIS))
++	},
+ 
+ 	/* Xe2_HPG */
+ 
+@@ -602,6 +607,11 @@ static const struct xe_rtp_entry_sr engine_was[] = {
+ 		       FUNC(xe_rtp_match_first_render_or_compute)),
+ 	  XE_RTP_ACTIONS(SET(TDL_TSL_CHICKEN, STK_ID_RESTRICT))
+ 	},
++	{ XE_RTP_NAME("13012615864"),
++	  XE_RTP_RULES(GRAPHICS_VERSION_RANGE(2001, 2002),
++		       FUNC(xe_rtp_match_first_render_or_compute)),
++	  XE_RTP_ACTIONS(SET(TDL_TSL_CHICKEN, RES_CHK_SPR_DIS))
++	},
+ 
+ 	/* Xe2_LPM */
+ 
+@@ -647,7 +657,8 @@ static const struct xe_rtp_entry_sr engine_was[] = {
+ 	  XE_RTP_ACTIONS(SET(TDL_CHICKEN, QID_WAIT_FOR_THREAD_NOT_RUN_DISABLE))
+ 	},
+ 	{ XE_RTP_NAME("13012615864"),
+-	  XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3001),
++	  XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3001), OR,
++		       GRAPHICS_VERSION(3003),
+ 		       FUNC(xe_rtp_match_first_render_or_compute)),
+ 	  XE_RTP_ACTIONS(SET(TDL_TSL_CHICKEN, RES_CHK_SPR_DIS))
+ 	},
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-extend-wa_22021007897-to-xe3-platforms.patch b/queue-6.17/drm-xe-extend-wa_22021007897-to-xe3-platforms.patch
new file mode 100644
index 0000000000..92417eb657
--- /dev/null
+++ b/queue-6.17/drm-xe-extend-wa_22021007897-to-xe3-platforms.patch
@@ -0,0 +1,43 @@
+From c6bc298a0033b8b5c4364b74b13782b1c1346710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 12:57:55 -0700
+Subject: drm/xe: Extend Wa_22021007897 to Xe3 platforms
+
+From: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+
+[ Upstream commit 8d6f16f1f082881aa50ea7ae537b604dec647ed6 ]
+
+WA 22021007897 should also be applied to Graphics Versions 30.00, 30.01
+and 30.03. To make it simple, simply use the range [3000, 3003] that
+should be ok as there isn't a 3002 and if it's added, the WA list would
+need to be revisited anyway.
+
+Cc: Matt Atwood <matthew.s.atwood@intel.com>
+Cc: Gustavo Sousa <gustavo.sousa@intel.com>
+Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com>
+Reviewed-by: Matt Atwood <matthew.s.atwood@intel.com>
+Link: https://lore.kernel.org/r/20250827-wa-22021007897-v1-1-96922eb52af4@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_wa.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_wa.c b/drivers/gpu/drm/xe/xe_wa.c
+index 535067e7fb0c9..f14bdaac674bb 100644
+--- a/drivers/gpu/drm/xe/xe_wa.c
++++ b/drivers/gpu/drm/xe/xe_wa.c
+@@ -879,6 +879,10 @@ static const struct xe_rtp_entry_sr lrc_was[] = {
+ 			     DIS_PARTIAL_AUTOSTRIP |
+ 			     DIS_AUTOSTRIP))
+ 	},
++	{ XE_RTP_NAME("22021007897"),
++	  XE_RTP_RULES(GRAPHICS_VERSION_RANGE(3000, 3003), ENGINE_CLASS(RENDER)),
++	  XE_RTP_ACTIONS(SET(COMMON_SLICE_CHICKEN4, SBE_PUSH_CONSTANT_BEHIND_FIX_ENABLE))
++	},
+ };
+ 
+ static __maybe_unused const struct xe_rtp_entry oob_was[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch b/queue-6.17/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
new file mode 100644
index 0000000000..9e0447eb33
--- /dev/null
+++ b/queue-6.17/drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
@@ -0,0 +1,77 @@
+From c6155a04fad1dfe9c86349cf722836922808fae3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jul 2025 17:20:58 +0200
+Subject: drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
+
+From: Maarten Lankhorst <dev@lankhorst.se>
+
+[ Upstream commit 1cda3c755bb7770be07d75949bb0f45fb88651f6 ]
+
+I saw an oops in xe_gem_fault when running the xe-fast-feedback
+testlist against the realtime kernel without debug options enabled.
+
+The panic happens after core_hotunplug unbind-rebind finishes.
+Presumably what happens is that a process mmaps, unlocks because
+of the FAULT_FLAG_RETRY_NOWAIT logic, has no process memory left,
+causing ttm_bo_vm_dummy_page() to return VM_FAULT_NOPAGE, since
+there was nothing left to populate, and then oopses in
+"mem_type_is_vram(tbo->resource->mem_type)" because tbo->resource
+is NULL.
+
+It's convoluted, but fits the data and explains the oops after
+the test exits.
+
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://lore.kernel.org/r/20250715152057.23254-2-dev@lankhorst.se
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c | 28 ++++++++++++++++------------
+ 1 file changed, 16 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index 50c79049ccea0..d07e23eb1a54d 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -1711,22 +1711,26 @@ static vm_fault_t xe_gem_fault(struct vm_fault *vmf)
+ 		ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
+ 					       TTM_BO_VM_NUM_PREFAULT);
+ 		drm_dev_exit(idx);
++
++		if (ret == VM_FAULT_RETRY &&
++		    !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
++			goto out;
++
++		/*
++		 * ttm_bo_vm_reserve() already has dma_resv_lock.
++		 */
++		if (ret == VM_FAULT_NOPAGE &&
++		    mem_type_is_vram(tbo->resource->mem_type)) {
++			mutex_lock(&xe->mem_access.vram_userfault.lock);
++			if (list_empty(&bo->vram_userfault_link))
++				list_add(&bo->vram_userfault_link,
++					 &xe->mem_access.vram_userfault.list);
++			mutex_unlock(&xe->mem_access.vram_userfault.lock);
++		}
+ 	} else {
+ 		ret = ttm_bo_vm_dummy_page(vmf, vmf->vma->vm_page_prot);
+ 	}
+ 
+-	if (ret == VM_FAULT_RETRY && !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT))
+-		goto out;
+-	/*
+-	 * ttm_bo_vm_reserve() already has dma_resv_lock.
+-	 */
+-	if (ret == VM_FAULT_NOPAGE && mem_type_is_vram(tbo->resource->mem_type)) {
+-		mutex_lock(&xe->mem_access.vram_userfault.lock);
+-		if (list_empty(&bo->vram_userfault_link))
+-			list_add(&bo->vram_userfault_link, &xe->mem_access.vram_userfault.list);
+-		mutex_unlock(&xe->mem_access.vram_userfault.lock);
+-	}
+-
+ 	dma_resv_unlock(tbo->base.resv);
+ out:
+ 	if (needs_rpm)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-add-devm-release-action-to-safely-tear-do.patch b/queue-6.17/drm-xe-guc-add-devm-release-action-to-safely-tear-do.patch
new file mode 100644
index 0000000000..21d49d8426
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-add-devm-release-action-to-safely-tear-do.patch
@@ -0,0 +1,155 @@
+From f1120d01923e1962aa1e4a1f7cff0ebd5fb3c2b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 12:55:41 +0530
+Subject: drm/xe/guc: Add devm release action to safely tear down CT
+
+From: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
+
+[ Upstream commit ee4b32220a6b41e71512e8804585325e685456ba ]
+
+When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE
+flag, the driver initiates TLB invalidation requests via the CTB mechanism
+while releasing the BO. However a premature release of the CTB BO can lead
+to system crashes, as observed in:
+
+Oops: Oops: 0000 [#1] SMP NOPTI
+RIP: 0010:h2g_write+0x2f3/0x7c0 [xe]
+Call Trace:
+ guc_ct_send_locked+0x8b/0x670 [xe]
+ xe_guc_ct_send_locked+0x19/0x60 [xe]
+ send_tlb_invalidation+0xb4/0x460 [xe]
+ xe_gt_tlb_invalidation_ggtt+0x15e/0x2e0 [xe]
+ ggtt_invalidate_gt_tlb.part.0+0x16/0x90 [xe]
+ ggtt_node_remove+0x110/0x140 [xe]
+ xe_ggtt_node_remove+0x40/0xa0 [xe]
+ xe_ggtt_remove_bo+0x87/0x250 [xe]
+
+Introduce a devm-managed release action during xe_guc_ct_init() and
+xe_guc_ct_init_post_hwconfig() to ensure proper CTB disablement before
+resource deallocation, preventing the use-after-free scenario.
+
+Signed-off-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: Summers Stuart <stuart.summers@intel.com>
+Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Link: https://lore.kernel.org/r/20250901072541.31461-1-satyanarayana.k.v.p@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc.c    |  8 +++----
+ drivers/gpu/drm/xe/xe_guc_ct.c | 41 +++++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/xe/xe_guc_ct.h |  1 +
+ 3 files changed, 45 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 9e0ed8fabcd54..62c76760fd26f 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -701,10 +701,6 @@ static int xe_guc_realloc_post_hwconfig(struct xe_guc *guc)
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = xe_managed_bo_reinit_in_vram(xe, tile, &guc->ct.bo);
+-	if (ret)
+-		return ret;
+-
+ 	return 0;
+ }
+ 
+@@ -839,6 +835,10 @@ int xe_guc_init_post_hwconfig(struct xe_guc *guc)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = xe_guc_ct_init_post_hwconfig(&guc->ct);
++	if (ret)
++		return ret;
++
+ 	guc_init_params_post_hwconfig(guc);
+ 
+ 	ret = xe_guc_submit_init(guc, ~0);
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index 3f4e6a46ff163..6d70dd1c106d4 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -39,6 +39,8 @@ static void receive_g2h(struct xe_guc_ct *ct);
+ static void g2h_worker_func(struct work_struct *w);
+ static void safe_mode_worker_func(struct work_struct *w);
+ static void ct_exit_safe_mode(struct xe_guc_ct *ct);
++static void guc_ct_change_state(struct xe_guc_ct *ct,
++				enum xe_guc_ct_state state);
+ 
+ #if IS_ENABLED(CONFIG_DRM_XE_DEBUG)
+ enum {
+@@ -252,6 +254,13 @@ int xe_guc_ct_init_noalloc(struct xe_guc_ct *ct)
+ }
+ ALLOW_ERROR_INJECTION(xe_guc_ct_init_noalloc, ERRNO); /* See xe_pci_probe() */
+ 
++static void guc_action_disable_ct(void *arg)
++{
++	struct xe_guc_ct *ct = arg;
++
++	guc_ct_change_state(ct, XE_GUC_CT_STATE_DISABLED);
++}
++
+ int xe_guc_ct_init(struct xe_guc_ct *ct)
+ {
+ 	struct xe_device *xe = ct_to_xe(ct);
+@@ -268,10 +277,40 @@ int xe_guc_ct_init(struct xe_guc_ct *ct)
+ 		return PTR_ERR(bo);
+ 
+ 	ct->bo = bo;
+-	return 0;
++
++	return devm_add_action_or_reset(xe->drm.dev, guc_action_disable_ct, ct);
+ }
+ ALLOW_ERROR_INJECTION(xe_guc_ct_init, ERRNO); /* See xe_pci_probe() */
+ 
++/**
++ * xe_guc_ct_init_post_hwconfig - Reinitialize the GuC CTB in VRAM
++ * @ct: the &xe_guc_ct
++ *
++ * Allocate a new BO in VRAM and free the previous BO that was allocated
++ * in system memory (SMEM). Applicable only for DGFX products.
++ *
++ * Return: 0 on success, or a negative errno on failure.
++ */
++int xe_guc_ct_init_post_hwconfig(struct xe_guc_ct *ct)
++{
++	struct xe_device *xe = ct_to_xe(ct);
++	struct xe_gt *gt = ct_to_gt(ct);
++	struct xe_tile *tile = gt_to_tile(gt);
++	int ret;
++
++	xe_assert(xe, !xe_guc_ct_enabled(ct));
++
++	if (!IS_DGFX(xe))
++		return 0;
++
++	ret = xe_managed_bo_reinit_in_vram(xe, tile, &ct->bo);
++	if (ret)
++		return ret;
++
++	devm_release_action(xe->drm.dev, guc_action_disable_ct, ct);
++	return devm_add_action_or_reset(xe->drm.dev, guc_action_disable_ct, ct);
++}
++
+ #define desc_read(xe_, guc_ctb__, field_)			\
+ 	xe_map_rd_field(xe_, &guc_ctb__->desc, 0,		\
+ 			struct guc_ct_buffer_desc, field_)
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.h b/drivers/gpu/drm/xe/xe_guc_ct.h
+index 18d4225e65024..cf41210ab30ae 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.h
++++ b/drivers/gpu/drm/xe/xe_guc_ct.h
+@@ -13,6 +13,7 @@ struct xe_device;
+ 
+ int xe_guc_ct_init_noalloc(struct xe_guc_ct *ct);
+ int xe_guc_ct_init(struct xe_guc_ct *ct);
++int xe_guc_ct_init_post_hwconfig(struct xe_guc_ct *ct);
+ int xe_guc_ct_enable(struct xe_guc_ct *ct);
+ void xe_guc_ct_disable(struct xe_guc_ct *ct);
+ void xe_guc_ct_stop(struct xe_guc_ct *ct);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-add-more-guc-load-error-status-codes.patch b/queue-6.17/drm-xe-guc-add-more-guc-load-error-status-codes.patch
new file mode 100644
index 0000000000..6f930ff851
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-add-more-guc-load-error-status-codes.patch
@@ -0,0 +1,103 @@
+From 328926b4ceb1278321b0565a56e617d4dc50a619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 19:43:37 -0700
+Subject: drm/xe/guc: Add more GuC load error status codes
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 45fbb51050e72723c2bdcedc1ce32305256c70ed ]
+
+The GuC load process will abort if certain status codes (which are
+indicative of a fatal error) are reported. Otherwise, it keeps waiting
+until the 'success' code is returned. New error codes have been added
+in recent GuC releases, so add support for aborting on those as well.
+
+v2: Shuffle HWCONFIG_START to the front of the switch to keep the
+ordering as per the enum define for clarity (review feedback by
+Jonathan). Also add a description for the basic 'invalid init data'
+code which was missing.
+
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250726024337.4056272-1-John.C.Harrison@Intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/abi/guc_errors_abi.h |  3 +++
+ drivers/gpu/drm/xe/xe_guc.c             | 19 +++++++++++++++++--
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/abi/guc_errors_abi.h b/drivers/gpu/drm/xe/abi/guc_errors_abi.h
+index ecf748fd87df3..ad76b4baf42e9 100644
+--- a/drivers/gpu/drm/xe/abi/guc_errors_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_errors_abi.h
+@@ -63,6 +63,7 @@ enum xe_guc_load_status {
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_START                   = 0x05,
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_DONE                    = 0x06,
+ 	XE_GUC_LOAD_STATUS_HWCONFIG_ERROR                   = 0x07,
++	XE_GUC_LOAD_STATUS_BOOTROM_VERSION_MISMATCH         = 0x08,
+ 	XE_GUC_LOAD_STATUS_GDT_DONE                         = 0x10,
+ 	XE_GUC_LOAD_STATUS_IDT_DONE                         = 0x20,
+ 	XE_GUC_LOAD_STATUS_LAPIC_DONE                       = 0x30,
+@@ -75,6 +76,8 @@ enum xe_guc_load_status {
+ 	XE_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_START,
+ 	XE_GUC_LOAD_STATUS_MPU_DATA_INVALID                 = 0x73,
+ 	XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID   = 0x74,
++	XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR        = 0x75,
++	XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG                 = 0x76,
+ 	XE_GUC_LOAD_STATUS_INVALID_INIT_DATA_RANGE_END,
+ 
+ 	XE_GUC_LOAD_STATUS_READY                            = 0xF0,
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 270fc37924936..9e0ed8fabcd54 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -990,11 +990,14 @@ static int guc_load_done(u32 status)
+ 	case XE_GUC_LOAD_STATUS_GUC_PREPROD_BUILD_MISMATCH:
+ 	case XE_GUC_LOAD_STATUS_ERROR_DEVID_INVALID_GUCTYPE:
+ 	case XE_GUC_LOAD_STATUS_HWCONFIG_ERROR:
++	case XE_GUC_LOAD_STATUS_BOOTROM_VERSION_MISMATCH:
+ 	case XE_GUC_LOAD_STATUS_DPC_ERROR:
+ 	case XE_GUC_LOAD_STATUS_EXCEPTION:
+ 	case XE_GUC_LOAD_STATUS_INIT_DATA_INVALID:
+ 	case XE_GUC_LOAD_STATUS_MPU_DATA_INVALID:
+ 	case XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID:
++	case XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
++	case XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG:
+ 		return -1;
+ 	}
+ 
+@@ -1134,17 +1137,29 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 		}
+ 
+ 		switch (ukernel) {
++		case XE_GUC_LOAD_STATUS_HWCONFIG_START:
++			xe_gt_err(gt, "still extracting hwconfig table.\n");
++			break;
++
+ 		case XE_GUC_LOAD_STATUS_EXCEPTION:
+ 			xe_gt_err(gt, "firmware exception. EIP: %#x\n",
+ 				  xe_mmio_read32(mmio, SOFT_SCRATCH(13)));
+ 			break;
+ 
++		case XE_GUC_LOAD_STATUS_INIT_DATA_INVALID:
++			xe_gt_err(gt, "illegal init/ADS data\n");
++			break;
++
+ 		case XE_GUC_LOAD_STATUS_INIT_MMIO_SAVE_RESTORE_INVALID:
+ 			xe_gt_err(gt, "illegal register in save/restore workaround list\n");
+ 			break;
+ 
+-		case XE_GUC_LOAD_STATUS_HWCONFIG_START:
+-			xe_gt_err(gt, "still extracting hwconfig table.\n");
++		case XE_GUC_LOAD_STATUS_KLV_WORKAROUND_INIT_ERROR:
++			xe_gt_err(gt, "illegal workaround KLV data\n");
++			break;
++
++		case XE_GUC_LOAD_STATUS_INVALID_FTR_FLAG:
++			xe_gt_err(gt, "illegal feature flag specified\n");
+ 			break;
+ 		}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-always-add-ct-disable-action-during-secon.patch b/queue-6.17/drm-xe-guc-always-add-ct-disable-action-during-secon.patch
new file mode 100644
index 0000000000..409ad8badc
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-always-add-ct-disable-action-during-secon.patch
@@ -0,0 +1,55 @@
+From 24f83f99e4543cae998b30c6023d88a895fdb190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 12:20:51 +0200
+Subject: drm/xe/guc: Always add CT disable action during second init step
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 955f3bc4af440bb950c7a1567197aaf6aa2213ae ]
+
+On DGFX, during init_post_hwconfig() step, we are reinitializing
+CTB BO in VRAM and we have to replace cleanup action to disable CT
+communication prior to release of underlying BO.
+
+But that introduces some discrepancy between DGFX and iGFX, as for
+iGFX we keep previously added disable CT action that would be called
+during unwind much later.
+
+To keep the same flow on both types of platforms, always replace old
+cleanup action and register new one.
+
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
+Link: https://lore.kernel.org/r/20250908102053.539-2-michal.wajdeczko@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index ff622628d823f..22eff8476ad48 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -300,12 +300,11 @@ int xe_guc_ct_init_post_hwconfig(struct xe_guc_ct *ct)
+ 
+ 	xe_assert(xe, !xe_guc_ct_enabled(ct));
+ 
+-	if (!IS_DGFX(xe))
+-		return 0;
+-
+-	ret = xe_managed_bo_reinit_in_vram(xe, tile, &ct->bo);
+-	if (ret)
+-		return ret;
++	if (IS_DGFX(xe)) {
++		ret = xe_managed_bo_reinit_in_vram(xe, tile, &ct->bo);
++		if (ret)
++			return ret;
++	}
+ 
+ 	devm_release_action(xe->drm.dev, guc_action_disable_ct, ct);
+ 	return devm_add_action_or_reset(xe->drm.dev, guc_action_disable_ct, ct);
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch b/queue-6.17/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
new file mode 100644
index 0000000000..35b3753d39
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
@@ -0,0 +1,37 @@
+From d92e8341145e023b040457ff10da80a40005eb62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 12:04:27 -0400
+Subject: drm/xe/guc: Increase GuC crash dump buffer size
+
+From: Zhanjun Dong <zhanjun.dong@intel.com>
+
+[ Upstream commit ad83b1da5b786ee2d245e41ce55cb1c71fed7c22 ]
+
+There are platforms already have a maximum dump size of 12KB, to avoid
+data truncating, increase GuC crash dump buffer size to 16KB.
+
+Signed-off-by: Zhanjun Dong <zhanjun.dong@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Link: https://lore.kernel.org/r/20250829160427.1245732-1-zhanjun.dong@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_log.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_log.h b/drivers/gpu/drm/xe/xe_guc_log.h
+index f1e2b0be90a9f..98a47ac42b08f 100644
+--- a/drivers/gpu/drm/xe/xe_guc_log.h
++++ b/drivers/gpu/drm/xe/xe_guc_log.h
+@@ -17,7 +17,7 @@ struct xe_device;
+ #define DEBUG_BUFFER_SIZE       SZ_8M
+ #define CAPTURE_BUFFER_SIZE     SZ_2M
+ #else
+-#define CRASH_BUFFER_SIZE	SZ_8K
++#define CRASH_BUFFER_SIZE	SZ_16K
+ #define DEBUG_BUFFER_SIZE	SZ_64K
+ #define CAPTURE_BUFFER_SIZE	SZ_1M
+ #endif
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch b/queue-6.17/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
new file mode 100644
index 0000000000..9ae80b8c57
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
@@ -0,0 +1,94 @@
+From d7cb990c9a1b65313280b9996ff53b8de5ddeb53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:41:31 -0700
+Subject: drm/xe/guc: Return an error code if the GuC load fails
+
+From: John Harrison <John.C.Harrison@Intel.com>
+
+[ Upstream commit 3b09b11805bfee32d5a0000f5ede42c07237a6c4 ]
+
+Due to multiple explosion issues in the early days of the Xe driver,
+the GuC load was hacked to never return a failure. That prevented
+kernel panics and such initially, but now all it achieves is creating
+more confusing errors when the driver tries to submit commands to a
+GuC it already knows is not there. So fix that up.
+
+As a stop-gap and to help with debug of load failures due to invalid
+GuC init params, a wedge call had been added to the inner GuC load
+function. The reason being that it leaves the GuC log accessible via
+debugfs. However, for an end user, simply aborting the module load is
+much cleaner than wedging and trying to continue. The wedge blocks
+user submissions but it seems that various bits of the driver itself
+still try to submit to a dead GuC and lots of subsequent errors occur.
+And with regards to developers debugging why their particular code
+change is being rejected by the GuC, it is trivial to either add the
+wedge back in and hack the return code to zero again or to just do a
+GuC log dump to dmesg.
+
+v2: Add support for error injection testing and drop the now redundant
+wedge call.
+
+CC: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: John Harrison <John.C.Harrison@Intel.com>
+Reviewed-by: Matt Atwood <matthew.s.atwood@intel.com>
+Link: https://lore.kernel.org/r/20250909224132.536320-1-John.C.Harrison@Intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
+index 62c76760fd26f..ab5b69cee3bff 100644
+--- a/drivers/gpu/drm/xe/xe_guc.c
++++ b/drivers/gpu/drm/xe/xe_guc.c
+@@ -1056,7 +1056,7 @@ static s32 guc_pc_get_cur_freq(struct xe_guc_pc *guc_pc)
+ #endif
+ #define GUC_LOAD_TIME_WARN_MS      200
+ 
+-static void guc_wait_ucode(struct xe_guc *guc)
++static int guc_wait_ucode(struct xe_guc *guc)
+ {
+ 	struct xe_gt *gt = guc_to_gt(guc);
+ 	struct xe_mmio *mmio = &gt->mmio;
+@@ -1163,7 +1163,7 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 			break;
+ 		}
+ 
+-		xe_device_declare_wedged(gt_to_xe(gt));
++		return -EPROTO;
+ 	} else if (delta_ms > GUC_LOAD_TIME_WARN_MS) {
+ 		xe_gt_warn(gt, "excessive init time: %lldms! [status = 0x%08X, timeouts = %d]\n",
+ 			   delta_ms, status, count);
+@@ -1175,7 +1175,10 @@ static void guc_wait_ucode(struct xe_guc *guc)
+ 			  delta_ms, xe_guc_pc_get_act_freq(guc_pc), guc_pc_get_cur_freq(guc_pc),
+ 			  before_freq, status, count);
+ 	}
++
++	return 0;
+ }
++ALLOW_ERROR_INJECTION(guc_wait_ucode, ERRNO);
+ 
+ static int __xe_guc_upload(struct xe_guc *guc)
+ {
+@@ -1207,14 +1210,16 @@ static int __xe_guc_upload(struct xe_guc *guc)
+ 		goto out;
+ 
+ 	/* Wait for authentication */
+-	guc_wait_ucode(guc);
++	ret = guc_wait_ucode(guc);
++	if (ret)
++		goto out;
+ 
+ 	xe_uc_fw_change_status(&guc->fw, XE_UC_FIRMWARE_RUNNING);
+ 	return 0;
+ 
+ out:
+ 	xe_uc_fw_change_status(&guc->fw, XE_UC_FIRMWARE_LOAD_FAIL);
+-	return 0	/* FIXME: ret, don't want to stop load currently */;
++	return ret;
+ }
+ 
+ static int vf_guc_min_load_for_hwconfig(struct xe_guc *guc)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch b/queue-6.17/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
new file mode 100644
index 0000000000..765ba24213
--- /dev/null
+++ b/queue-6.17/drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
@@ -0,0 +1,76 @@
+From 13a639b62137ebd607e00704bf6f320041a6a438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 00:33:30 +0200
+Subject: drm/xe/guc: Set upper limit of H2G retries over CTB
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 2506af5f8109a387a5e8e9e3d7c498480b8033db ]
+
+The GuC communication protocol allows GuC to send NO_RESPONSE_RETRY
+reply message to indicate that due to some interim condition it can
+not handle incoming H2G request and the host shall resend it.
+
+But in some cases, due to errors, this unsatisfied condition might
+be final and this could lead to endless retries as it was recently
+seen on the CI:
+
+ [drm] GT0: PF: VF1 FLR didn't finish in 5000 ms (-ETIMEDOUT)
+ [drm] GT0: PF: VF1 resource sanitizing failed (-ETIMEDOUT)
+ [drm] GT0: PF: VF1 FLR failed!
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+ [drm:guc_ct_send_recv [xe]] GT0: H2G action 0x5503 retrying: reason 0x0
+
+To avoid such dangerous loops allow only limited number of retries
+(for now 50) and add some delays (n * 5ms) to slow down the rate of
+resending this repeated request.
+
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: John Harrison <John.C.Harrison@Intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://lore.kernel.org/r/20250903223330.6408-1-michal.wajdeczko@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_guc_ct.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_guc_ct.c b/drivers/gpu/drm/xe/xe_guc_ct.c
+index 6d70dd1c106d4..ff622628d823f 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ct.c
++++ b/drivers/gpu/drm/xe/xe_guc_ct.c
+@@ -1079,11 +1079,15 @@ static bool retry_failure(struct xe_guc_ct *ct, int ret)
+ 	return true;
+ }
+ 
++#define GUC_SEND_RETRY_LIMIT	50
++#define GUC_SEND_RETRY_MSLEEP	5
++
+ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+ 			    u32 *response_buffer, bool no_fail)
+ {
+ 	struct xe_gt *gt = ct_to_gt(ct);
+ 	struct g2h_fence g2h_fence;
++	unsigned int retries = 0;
+ 	int ret = 0;
+ 
+ 	/*
+@@ -1148,6 +1152,12 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len,
+ 		xe_gt_dbg(gt, "H2G action %#x retrying: reason %#x\n",
+ 			  action[0], g2h_fence.reason);
+ 		mutex_unlock(&ct->lock);
++		if (++retries > GUC_SEND_RETRY_LIMIT) {
++			xe_gt_err(gt, "H2G action %#x reached retry limit=%u, aborting\n",
++				  action[0], GUC_SEND_RETRY_LIMIT);
++			return -ELOOP;
++		}
++		msleep(GUC_SEND_RETRY_MSLEEP * retries);
+ 		goto retry;
+ 	}
+ 	if (g2h_fence.fail) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-i2c-enable-bus-mastering.patch b/queue-6.17/drm-xe-i2c-enable-bus-mastering.patch
new file mode 100644
index 0000000000..7d4b961700
--- /dev/null
+++ b/queue-6.17/drm-xe-i2c-enable-bus-mastering.patch
@@ -0,0 +1,37 @@
+From 60f5da9f582844d1bb0491bafcfe4542ab03581b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 11:23:20 +0530
+Subject: drm/xe/i2c: Enable bus mastering
+
+From: Raag Jadav <raag.jadav@intel.com>
+
+[ Upstream commit fce99326c9cf5a0e57c4283a61c6b622ef5b0de8 ]
+
+Enable bus mastering for I2C controller to support device initiated
+in-band transactions.
+
+Signed-off-by: Raag Jadav <raag.jadav@intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250908055320.2549722-1-raag.jadav@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_i2c.c b/drivers/gpu/drm/xe/xe_i2c.c
+index bc7dc2099470c..983e8e08e4739 100644
+--- a/drivers/gpu/drm/xe/xe_i2c.c
++++ b/drivers/gpu/drm/xe/xe_i2c.c
+@@ -245,7 +245,7 @@ void xe_i2c_pm_resume(struct xe_device *xe, bool d3cold)
+ 		return;
+ 
+ 	if (d3cold)
+-		xe_mmio_rmw32(mmio, I2C_CONFIG_CMD, 0, PCI_COMMAND_MEMORY);
++		xe_mmio_rmw32(mmio, I2C_CONFIG_CMD, 0, PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+ 
+ 	xe_mmio_rmw32(mmio, I2C_CONFIG_PMCSR, PCI_PM_CTRL_STATE_MASK, (__force u32)PCI_D0);
+ 	drm_dbg(&xe->drm, "pmcsr: 0x%08x\n", xe_mmio_read32(mmio, I2C_CONFIG_PMCSR));
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-improve-dma-resv-handling-for-backup-object.patch b/queue-6.17/drm-xe-improve-dma-resv-handling-for-backup-object.patch
new file mode 100644
index 0000000000..60d9ac2989
--- /dev/null
+++ b/queue-6.17/drm-xe-improve-dma-resv-handling-for-backup-object.patch
@@ -0,0 +1,92 @@
+From 2866aee1927bb4538e744003b46244c307da373a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:47:16 +0100
+Subject: drm/xe: improve dma-resv handling for backup object
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit edb1745fc618ba8ef63a45ce3ae60de1bdf29231 ]
+
+Since the dma-resv is shared we don't need to reserve and add a fence
+slot fence twice, plus no need to loop through the dependencies.
+
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Link: https://lore.kernel.org/r/20250829164715.720735-2-matthew.auld@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c      | 13 +------------
+ drivers/gpu/drm/xe/xe_migrate.c |  2 +-
+ 2 files changed, 2 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index d07e23eb1a54d..5a61441d68af5 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -1242,14 +1242,11 @@ int xe_bo_evict_pinned(struct xe_bo *bo)
+ 		else
+ 			migrate = mem_type_to_migrate(xe, bo->ttm.resource->mem_type);
+ 
++		xe_assert(xe, bo->ttm.base.resv == backup->ttm.base.resv);
+ 		ret = dma_resv_reserve_fences(bo->ttm.base.resv, 1);
+ 		if (ret)
+ 			goto out_backup;
+ 
+-		ret = dma_resv_reserve_fences(backup->ttm.base.resv, 1);
+-		if (ret)
+-			goto out_backup;
+-
+ 		fence = xe_migrate_copy(migrate, bo, backup, bo->ttm.resource,
+ 					backup->ttm.resource, false);
+ 		if (IS_ERR(fence)) {
+@@ -1259,8 +1256,6 @@ int xe_bo_evict_pinned(struct xe_bo *bo)
+ 
+ 		dma_resv_add_fence(bo->ttm.base.resv, fence,
+ 				   DMA_RESV_USAGE_KERNEL);
+-		dma_resv_add_fence(backup->ttm.base.resv, fence,
+-				   DMA_RESV_USAGE_KERNEL);
+ 		dma_fence_put(fence);
+ 	} else {
+ 		ret = xe_bo_vmap(backup);
+@@ -1338,10 +1333,6 @@ int xe_bo_restore_pinned(struct xe_bo *bo)
+ 		if (ret)
+ 			goto out_unlock_bo;
+ 
+-		ret = dma_resv_reserve_fences(backup->ttm.base.resv, 1);
+-		if (ret)
+-			goto out_unlock_bo;
+-
+ 		fence = xe_migrate_copy(migrate, backup, bo,
+ 					backup->ttm.resource, bo->ttm.resource,
+ 					false);
+@@ -1352,8 +1343,6 @@ int xe_bo_restore_pinned(struct xe_bo *bo)
+ 
+ 		dma_resv_add_fence(bo->ttm.base.resv, fence,
+ 				   DMA_RESV_USAGE_KERNEL);
+-		dma_resv_add_fence(backup->ttm.base.resv, fence,
+-				   DMA_RESV_USAGE_KERNEL);
+ 		dma_fence_put(fence);
+ 	} else {
+ 		ret = xe_bo_vmap(backup);
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index 2a627ed64b8f8..ba9b8590eccb2 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -901,7 +901,7 @@ struct dma_fence *xe_migrate_copy(struct xe_migrate *m,
+ 		if (!fence) {
+ 			err = xe_sched_job_add_deps(job, src_bo->ttm.base.resv,
+ 						    DMA_RESV_USAGE_BOOKKEEP);
+-			if (!err && src_bo != dst_bo)
++			if (!err && src_bo->ttm.base.resv != dst_bo->ttm.base.resv)
+ 				err = xe_sched_job_add_deps(job, dst_bo->ttm.base.resv,
+ 							    DMA_RESV_USAGE_BOOKKEEP);
+ 			if (err)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-make-page-size-consistent-in-loop.patch b/queue-6.17/drm-xe-make-page-size-consistent-in-loop.patch
new file mode 100644
index 0000000000..ad6b6b4ae5
--- /dev/null
+++ b/queue-6.17/drm-xe-make-page-size-consistent-in-loop.patch
@@ -0,0 +1,40 @@
+From 9daedd99f1bd042c3a047aabbfbd09701b5177f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 15:47:35 +0900
+Subject: drm/xe: Make page size consistent in loop
+
+From: Simon Richter <Simon.Richter@hogyros.de>
+
+[ Upstream commit b85bb2d677153d990924d31be9416166d22382eb ]
+
+If PAGE_SIZE != XE_PAGE_SIZE (which is currently locked behind
+CONFIG_BROKEN), this would generate the wrong number of PDEs.
+
+Since these PDEs are consumed by the GPU, the GPU page size needs to be
+used.
+
+Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://lore.kernel.org/r/20250818064806.2835-1-Simon.Richter@hogyros.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index 9b1e3dce1aea3..2a627ed64b8f8 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -291,7 +291,7 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,
+ 	}
+ 
+ 	/* Write PDE's that point to our BO. */
+-	for (i = 0; i < map_ofs / PAGE_SIZE; i++) {
++	for (i = 0; i < map_ofs / XE_PAGE_SIZE; i++) {
+ 		entry = vm->pt_ops->pde_encode_bo(bo, (u64)i * XE_PAGE_SIZE);
+ 
+ 		xe_map_wr(xe, &bo->vmap, map_ofs + XE_PAGE_SIZE +
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-pcode-initialize-data0-for-pcode-read-routine.patch b/queue-6.17/drm-xe-pcode-initialize-data0-for-pcode-read-routine.patch
new file mode 100644
index 0000000000..b6e517a672
--- /dev/null
+++ b/queue-6.17/drm-xe-pcode-initialize-data0-for-pcode-read-routine.patch
@@ -0,0 +1,137 @@
+From 9891a04f06e7d3478ed0422079b2636e3ccfa3eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:10:54 +0000
+Subject: drm/xe/pcode: Initialize data0 for pcode read routine
+
+From: Stuart Summers <stuart.summers@intel.com>
+
+[ Upstream commit 2515d2b9ab4108c11a0b23935e68de27abb8b2a7 ]
+
+There are two registers filled in when reading data from
+pcode besides the mailbox itself. Currently, we allow a NULL
+value for the second of these two (data1) and assume the first
+is defined. However, many of the routines that are calling
+this function assume that pcode will ignore the value being
+passed in and so leave that first value (data0) defined but
+uninitialized. To be safe, make sure this value is always
+initialized to something (0 generally) in the event pcode
+behavior changes and starts using this value.
+
+v2: Fix sob/author
+
+Signed-off-by: Stuart Summers <stuart.summers@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Link: https://lore.kernel.org/r/20250819201054.393220-1-stuart.summers@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device_sysfs.c | 8 ++++----
+ drivers/gpu/drm/xe/xe_hwmon.c        | 8 ++++----
+ drivers/gpu/drm/xe/xe_vram_freq.c    | 4 ++--
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device_sysfs.c b/drivers/gpu/drm/xe/xe_device_sysfs.c
+index 927ee7991696b..896484c8fbcc7 100644
+--- a/drivers/gpu/drm/xe/xe_device_sysfs.c
++++ b/drivers/gpu/drm/xe/xe_device_sysfs.c
+@@ -76,7 +76,7 @@ lb_fan_control_version_show(struct device *dev, struct device_attribute *attr, c
+ {
+ 	struct xe_device *xe = pdev_to_xe_device(to_pci_dev(dev));
+ 	struct xe_tile *root = xe_device_get_root_tile(xe);
+-	u32 cap, ver_low = FAN_TABLE, ver_high = FAN_TABLE;
++	u32 cap = 0, ver_low = FAN_TABLE, ver_high = FAN_TABLE;
+ 	u16 major = 0, minor = 0, hotfix = 0, build = 0;
+ 	int ret;
+ 
+@@ -115,7 +115,7 @@ lb_voltage_regulator_version_show(struct device *dev, struct device_attribute *a
+ {
+ 	struct xe_device *xe = pdev_to_xe_device(to_pci_dev(dev));
+ 	struct xe_tile *root = xe_device_get_root_tile(xe);
+-	u32 cap, ver_low = VR_CONFIG, ver_high = VR_CONFIG;
++	u32 cap = 0, ver_low = VR_CONFIG, ver_high = VR_CONFIG;
+ 	u16 major = 0, minor = 0, hotfix = 0, build = 0;
+ 	int ret;
+ 
+@@ -153,7 +153,7 @@ static int late_bind_create_files(struct device *dev)
+ {
+ 	struct xe_device *xe = pdev_to_xe_device(to_pci_dev(dev));
+ 	struct xe_tile *root = xe_device_get_root_tile(xe);
+-	u32 cap;
++	u32 cap = 0;
+ 	int ret;
+ 
+ 	xe_pm_runtime_get(xe);
+@@ -186,7 +186,7 @@ static void late_bind_remove_files(struct device *dev)
+ {
+ 	struct xe_device *xe = pdev_to_xe_device(to_pci_dev(dev));
+ 	struct xe_tile *root = xe_device_get_root_tile(xe);
+-	u32 cap;
++	u32 cap = 0;
+ 	int ret;
+ 
+ 	xe_pm_runtime_get(xe);
+diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
+index c5b63e10bb911..5ade08f90b89a 100644
+--- a/drivers/gpu/drm/xe/xe_hwmon.c
++++ b/drivers/gpu/drm/xe/xe_hwmon.c
+@@ -179,7 +179,7 @@ static int xe_hwmon_pcode_rmw_power_limit(const struct xe_hwmon *hwmon, u32 attr
+ 					  u32 clr, u32 set)
+ {
+ 	struct xe_tile *root_tile = xe_device_get_root_tile(hwmon->xe);
+-	u32 val0, val1;
++	u32 val0 = 0, val1 = 0;
+ 	int ret = 0;
+ 
+ 	ret = xe_pcode_read(root_tile, PCODE_MBOX(PCODE_POWER_SETUP,
+@@ -737,7 +737,7 @@ static int xe_hwmon_power_curr_crit_read(struct xe_hwmon *hwmon, int channel,
+ 					 long *value, u32 scale_factor)
+ {
+ 	int ret;
+-	u32 uval;
++	u32 uval = 0;
+ 
+ 	mutex_lock(&hwmon->hwmon_lock);
+ 
+@@ -921,7 +921,7 @@ xe_hwmon_power_write(struct xe_hwmon *hwmon, u32 attr, int channel, long val)
+ static umode_t
+ xe_hwmon_curr_is_visible(const struct xe_hwmon *hwmon, u32 attr, int channel)
+ {
+-	u32 uval;
++	u32 uval = 0;
+ 
+ 	/* hwmon sysfs attribute of current available only for package */
+ 	if (channel != CHANNEL_PKG)
+@@ -1023,7 +1023,7 @@ xe_hwmon_energy_read(struct xe_hwmon *hwmon, u32 attr, int channel, long *val)
+ static umode_t
+ xe_hwmon_fan_is_visible(struct xe_hwmon *hwmon, u32 attr, int channel)
+ {
+-	u32 uval;
++	u32 uval = 0;
+ 
+ 	if (!hwmon->xe->info.has_fan_control)
+ 		return 0;
+diff --git a/drivers/gpu/drm/xe/xe_vram_freq.c b/drivers/gpu/drm/xe/xe_vram_freq.c
+index b26e26d73dae6..17bc84da4cdcc 100644
+--- a/drivers/gpu/drm/xe/xe_vram_freq.c
++++ b/drivers/gpu/drm/xe/xe_vram_freq.c
+@@ -34,7 +34,7 @@ static ssize_t max_freq_show(struct device *dev, struct device_attribute *attr,
+ 			     char *buf)
+ {
+ 	struct xe_tile *tile = dev_to_tile(dev);
+-	u32 val, mbox;
++	u32 val = 0, mbox;
+ 	int err;
+ 
+ 	mbox = REG_FIELD_PREP(PCODE_MB_COMMAND, PCODE_FREQUENCY_CONFIG)
+@@ -56,7 +56,7 @@ static ssize_t min_freq_show(struct device *dev, struct device_attribute *attr,
+ 			     char *buf)
+ {
+ 	struct xe_tile *tile = dev_to_tile(dev);
+-	u32 val, mbox;
++	u32 val = 0, mbox;
+ 	int err;
+ 
+ 	mbox = REG_FIELD_PREP(PCODE_MB_COMMAND, PCODE_FREQUENCY_CONFIG)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-pf-don-t-resume-device-from-restart-worker.patch b/queue-6.17/drm-xe-pf-don-t-resume-device-from-restart-worker.patch
new file mode 100644
index 0000000000..f73e7d34c9
--- /dev/null
+++ b/queue-6.17/drm-xe-pf-don-t-resume-device-from-restart-worker.patch
@@ -0,0 +1,89 @@
+From 5b91f3890ed9ff08a3ba2aebe3d7a9876714da7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Aug 2025 16:28:22 +0200
+Subject: drm/xe/pf: Don't resume device from restart worker
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Wajdeczko <michal.wajdeczko@intel.com>
+
+[ Upstream commit 9fd9f221440024b7451678898facfb34af054310 ]
+
+The PF's restart worker shouldn't attempt to resume the device on
+its own, since its goal is to finish PF and VFs reprovisioning on
+the recently reset GuC. Take extra RPM reference while scheduling
+a work and release it from the worker or when we cancel a work.
+
+Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Link: https://lore.kernel.org/r/20250801142822.180530-4-michal.wajdeczko@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gt_sriov_pf.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_pf.c b/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
+index bdbd15f3afe38..c4dda87b47cc8 100644
+--- a/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
++++ b/drivers/gpu/drm/xe/xe_gt_sriov_pf.c
+@@ -55,7 +55,12 @@ static void pf_init_workers(struct xe_gt *gt)
+ static void pf_fini_workers(struct xe_gt *gt)
+ {
+ 	xe_gt_assert(gt, IS_SRIOV_PF(gt_to_xe(gt)));
+-	disable_work_sync(&gt->sriov.pf.workers.restart);
++
++	if (disable_work_sync(&gt->sriov.pf.workers.restart)) {
++		xe_gt_sriov_dbg_verbose(gt, "pending restart disabled!\n");
++		/* release an rpm reference taken on the worker's behalf */
++		xe_pm_runtime_put(gt_to_xe(gt));
++	}
+ }
+ 
+ /**
+@@ -207,8 +212,11 @@ static void pf_cancel_restart(struct xe_gt *gt)
+ {
+ 	xe_gt_assert(gt, IS_SRIOV_PF(gt_to_xe(gt)));
+ 
+-	if (cancel_work_sync(&gt->sriov.pf.workers.restart))
++	if (cancel_work_sync(&gt->sriov.pf.workers.restart)) {
+ 		xe_gt_sriov_dbg_verbose(gt, "pending restart canceled!\n");
++		/* release an rpm reference taken on the worker's behalf */
++		xe_pm_runtime_put(gt_to_xe(gt));
++	}
+ }
+ 
+ /**
+@@ -226,9 +234,12 @@ static void pf_restart(struct xe_gt *gt)
+ {
+ 	struct xe_device *xe = gt_to_xe(gt);
+ 
+-	xe_pm_runtime_get(xe);
++	xe_gt_assert(gt, !xe_pm_runtime_suspended(xe));
++
+ 	xe_gt_sriov_pf_config_restart(gt);
+ 	xe_gt_sriov_pf_control_restart(gt);
++
++	/* release an rpm reference taken on our behalf */
+ 	xe_pm_runtime_put(xe);
+ 
+ 	xe_gt_sriov_dbg(gt, "restart completed\n");
+@@ -247,8 +258,13 @@ static void pf_queue_restart(struct xe_gt *gt)
+ 
+ 	xe_gt_assert(gt, IS_SRIOV_PF(xe));
+ 
+-	if (!queue_work(xe->sriov.wq, &gt->sriov.pf.workers.restart))
++	/* take an rpm reference on behalf of the worker */
++	xe_pm_runtime_get_noresume(xe);
++
++	if (!queue_work(xe->sriov.wq, &gt->sriov.pf.workers.restart)) {
+ 		xe_gt_sriov_dbg(gt, "restart already in queue!\n");
++		xe_pm_runtime_put(xe);
++	}
+ }
+ 
+ /**
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-pf-program-lmtt-directory-pointer-on-all-gts-.patch b/queue-6.17/drm-xe-pf-program-lmtt-directory-pointer-on-all-gts-.patch
new file mode 100644
index 0000000000..640a884808
--- /dev/null
+++ b/queue-6.17/drm-xe-pf-program-lmtt-directory-pointer-on-all-gts-.patch
@@ -0,0 +1,59 @@
+From 543dc47bbed6b14c3e651c23c54d978398452857 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 11:18:50 +0200
+Subject: drm/xe/pf: Program LMTT directory pointer on all GTs within a tile
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Piotr Piórkowski <piotr.piorkowski@intel.com>
+
+[ Upstream commit ad69d62588cd6bf8cddaff5e3e2eb1b8dd876d35 ]
+
+Previously, the LMTT directory pointer was only programmed for primary GT
+within a tile. However, to ensure correct Local Memory access by VFs,
+the LMTT configuration must be programmed on all GTs within the tile.
+Lets program the LMTT directory pointer on every GT of the tile
+to guarantee proper LMEM access across all GTs on VFs.
+
+HSD: 18042797646
+Bspec: 67468
+Signed-off-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
+Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
+Cc: Michał Winiarski <michal.winiarski@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250805091850.1508240-1-piotr.piorkowski@intel.com
+Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_lmtt.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_lmtt.c b/drivers/gpu/drm/xe/xe_lmtt.c
+index a2000307d5bf9..a78c9d474a6ef 100644
+--- a/drivers/gpu/drm/xe/xe_lmtt.c
++++ b/drivers/gpu/drm/xe/xe_lmtt.c
+@@ -195,14 +195,17 @@ static void lmtt_setup_dir_ptr(struct xe_lmtt *lmtt)
+ 	struct xe_tile *tile = lmtt_to_tile(lmtt);
+ 	struct xe_device *xe = tile_to_xe(tile);
+ 	dma_addr_t offset = xe_bo_main_addr(lmtt->pd->bo, XE_PAGE_SIZE);
++	struct xe_gt *gt;
++	u8 id;
+ 
+ 	lmtt_debug(lmtt, "DIR offset %pad\n", &offset);
+ 	lmtt_assert(lmtt, xe_bo_is_vram(lmtt->pd->bo));
+ 	lmtt_assert(lmtt, IS_ALIGNED(offset, SZ_64K));
+ 
+-	xe_mmio_write32(&tile->mmio,
+-			GRAPHICS_VER(xe) >= 20 ? XE2_LMEM_CFG : LMEM_CFG,
+-			LMEM_EN | REG_FIELD_PREP(LMTT_DIR_PTR, offset / SZ_64K));
++	for_each_gt_on_tile(gt, tile, id)
++		xe_mmio_write32(&gt->mmio,
++				GRAPHICS_VER(xe) >= 20 ? XE2_LMEM_CFG : LMEM_CFG,
++				LMEM_EN | REG_FIELD_PREP(LMTT_DIR_PTR, offset / SZ_64K));
+ }
+ 
+ /**
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-ptl-apply-wa_16026007364.patch b/queue-6.17/drm-xe-ptl-apply-wa_16026007364.patch
new file mode 100644
index 0000000000..24385a0f27
--- /dev/null
+++ b/queue-6.17/drm-xe-ptl-apply-wa_16026007364.patch
@@ -0,0 +1,100 @@
+From becdef35489e6cbdf88b47864821504919a9a8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jul 2025 15:46:23 +0530
+Subject: drm/xe/ptl: Apply Wa_16026007364
+
+From: Sk Anirban <sk.anirban@intel.com>
+
+[ Upstream commit d72779c29d82c6e371cea8b427550bd6923c2577 ]
+
+As part of this WA GuC will save and restore value of two XE3_Media
+control registers that were not included in the HW power context.
+
+Signed-off-by: Sk Anirban <sk.anirban@intel.com>
+Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Link: https://lore.kernel.org/r/20250716101622.3421480-2-sk.anirban@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/abi/guc_klvs_abi.h |  1 +
+ drivers/gpu/drm/xe/xe_guc_ads.c       | 35 +++++++++++++++++++++++++++
+ drivers/gpu/drm/xe/xe_wa_oob.rules    |  1 +
+ 3 files changed, 37 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+index d7719d0e36ca7..45a321d0099f1 100644
+--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
++++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+@@ -421,6 +421,7 @@ enum xe_guc_klv_ids {
+ 	GUC_WORKAROUND_KLV_ID_BACK_TO_BACK_RCS_ENGINE_RESET				= 0x9009,
+ 	GUC_WA_KLV_WAKE_POWER_DOMAINS_FOR_OUTBOUND_MMIO					= 0x900a,
+ 	GUC_WA_KLV_RESET_BB_STACK_PTR_ON_VF_SWITCH					= 0x900b,
++	GUC_WA_KLV_RESTORE_UNSAVED_MEDIA_CONTROL_REG					= 0x900c,
+ };
+ 
+ #endif
+diff --git a/drivers/gpu/drm/xe/xe_guc_ads.c b/drivers/gpu/drm/xe/xe_guc_ads.c
+index 131cfc56be00a..8ff8626227ae4 100644
+--- a/drivers/gpu/drm/xe/xe_guc_ads.c
++++ b/drivers/gpu/drm/xe/xe_guc_ads.c
+@@ -284,6 +284,35 @@ static size_t calculate_golden_lrc_size(struct xe_guc_ads *ads)
+ 	return total_size;
+ }
+ 
++static void guc_waklv_enable_two_word(struct xe_guc_ads *ads,
++				      enum xe_guc_klv_ids klv_id,
++				      u32 value1,
++				      u32 value2,
++				      u32 *offset, u32 *remain)
++{
++	u32 size;
++	u32 klv_entry[] = {
++			/* 16:16 key/length */
++			FIELD_PREP(GUC_KLV_0_KEY, klv_id) |
++			FIELD_PREP(GUC_KLV_0_LEN, 2),
++			value1,
++			value2,
++			/* 2 dword data */
++	};
++
++	size = sizeof(klv_entry);
++
++	if (*remain < size) {
++		drm_warn(&ads_to_xe(ads)->drm,
++			 "w/a klv buffer too small to add klv id %d\n", klv_id);
++	} else {
++		xe_map_memcpy_to(ads_to_xe(ads), ads_to_map(ads), *offset,
++				 klv_entry, size);
++		*offset += size;
++		*remain -= size;
++	}
++}
++
+ static void guc_waklv_enable_one_word(struct xe_guc_ads *ads,
+ 				      enum xe_guc_klv_ids klv_id,
+ 				      u32 value,
+@@ -381,6 +410,12 @@ static void guc_waklv_init(struct xe_guc_ads *ads)
+ 		guc_waklv_enable_simple(ads,
+ 					GUC_WA_KLV_RESET_BB_STACK_PTR_ON_VF_SWITCH,
+ 					&offset, &remain);
++	if (GUC_FIRMWARE_VER(&gt->uc.guc) >= MAKE_GUC_VER(70, 47, 0) && XE_WA(gt, 16026007364))
++		guc_waklv_enable_two_word(ads,
++					  GUC_WA_KLV_RESTORE_UNSAVED_MEDIA_CONTROL_REG,
++					  0x0,
++					  0xF,
++					  &offset, &remain);
+ 
+ 	size = guc_ads_waklv_size(ads) - remain;
+ 	if (!size)
+diff --git a/drivers/gpu/drm/xe/xe_wa_oob.rules b/drivers/gpu/drm/xe/xe_wa_oob.rules
+index 710f4423726c9..48c7a42e2fcad 100644
+--- a/drivers/gpu/drm/xe/xe_wa_oob.rules
++++ b/drivers/gpu/drm/xe/xe_wa_oob.rules
+@@ -73,3 +73,4 @@ no_media_l3	MEDIA_VERSION(3000)
+ 14022085890	GRAPHICS_VERSION(2001)
+ 
+ 15015404425_disable	PLATFORM(PANTHERLAKE), MEDIA_STEP(B0, FOREVER)
++16026007364    MEDIA_VERSION(3000)
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-rework-pde-pat-index-selection.patch b/queue-6.17/drm-xe-rework-pde-pat-index-selection.patch
new file mode 100644
index 0000000000..93a7d3eed7
--- /dev/null
+++ b/queue-6.17/drm-xe-rework-pde-pat-index-selection.patch
@@ -0,0 +1,181 @@
+From 14c567dfee1fde78bcc56710fbbfebf1c7fcd5a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Aug 2025 11:34:56 +0100
+Subject: drm/xe: rework PDE PAT index selection
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 17593a69b75f098280ad88b625f2d8c5bfe4c6a1 ]
+
+For non-leaf paging structures we end up selecting a random index
+between [0, 3], depending on the first user if the page-table is shared,
+since non-leaf structures only have two bits in the HW for encoding the
+PAT index, and here we are just passing along the full user provided
+index, which can be an index as large as ~31 on xe2+. The user provided
+index is meant for the leaf node, which maps the actual BO pages where
+we have more PAT bits, and not the non-leaf nodes which are only mapping
+other paging structures, and so only needs a minimal PAT index range.
+Also the chosen index might need to consider how the driver mapped the
+paging structures on the host side, like wc vs wb, which is separate
+from the user provided index.
+
+With that move the PDE PAT index selection under driver control. For now
+just use a coherent index on platforms with page-tables that are cached
+on host side, and incoherent otherwise. Using a coherent index could
+potentially be expensive, and would be overkill if we know the page-table
+is always uncached on host side.
+
+v2 (Stuart):
+  - Add some documentation and split into separate helper.
+
+BSpec: 59510
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Stuart Summers <stuart.summers@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Stuart Summers <stuart.summers@intel.com>
+Link: https://lore.kernel.org/r/20250808103455.462424-2-matthew.auld@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_migrate.c  | 10 ++++------
+ drivers/gpu/drm/xe/xe_pt.c       |  4 ++--
+ drivers/gpu/drm/xe/xe_pt_types.h |  3 +--
+ drivers/gpu/drm/xe/xe_vm.c       | 34 +++++++++++++++++++++++++++-----
+ 4 files changed, 36 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
+index 13e287e037096..9b1e3dce1aea3 100644
+--- a/drivers/gpu/drm/xe/xe_migrate.c
++++ b/drivers/gpu/drm/xe/xe_migrate.c
+@@ -163,8 +163,7 @@ static void xe_migrate_program_identity(struct xe_device *xe, struct xe_vm *vm,
+ 	for (pos = dpa_base; pos < vram_limit;
+ 	     pos += SZ_1G, ofs += 8) {
+ 		if (pos + SZ_1G >= vram_limit) {
+-			entry = vm->pt_ops->pde_encode_bo(bo, pt_2m_ofs,
+-							  pat_index);
++			entry = vm->pt_ops->pde_encode_bo(bo, pt_2m_ofs);
+ 			xe_map_wr(xe, &bo->vmap, ofs, u64, entry);
+ 
+ 			flags = vm->pt_ops->pte_encode_addr(xe, 0,
+@@ -218,7 +217,7 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,
+ 
+ 	/* PT30 & PT31 reserved for 2M identity map */
+ 	pt29_ofs = xe_bo_size(bo) - 3 * XE_PAGE_SIZE;
+-	entry = vm->pt_ops->pde_encode_bo(bo, pt29_ofs, pat_index);
++	entry = vm->pt_ops->pde_encode_bo(bo, pt29_ofs);
+ 	xe_pt_write(xe, &vm->pt_root[id]->bo->vmap, 0, entry);
+ 
+ 	map_ofs = (num_entries - num_setup) * XE_PAGE_SIZE;
+@@ -286,15 +285,14 @@ static int xe_migrate_prepare_vm(struct xe_tile *tile, struct xe_migrate *m,
+ 			flags = XE_PDE_64K;
+ 
+ 		entry = vm->pt_ops->pde_encode_bo(bo, map_ofs + (u64)(level - 1) *
+-						  XE_PAGE_SIZE, pat_index);
++						  XE_PAGE_SIZE);
+ 		xe_map_wr(xe, &bo->vmap, map_ofs + XE_PAGE_SIZE * level, u64,
+ 			  entry | flags);
+ 	}
+ 
+ 	/* Write PDE's that point to our BO. */
+ 	for (i = 0; i < map_ofs / PAGE_SIZE; i++) {
+-		entry = vm->pt_ops->pde_encode_bo(bo, (u64)i * XE_PAGE_SIZE,
+-						  pat_index);
++		entry = vm->pt_ops->pde_encode_bo(bo, (u64)i * XE_PAGE_SIZE);
+ 
+ 		xe_map_wr(xe, &bo->vmap, map_ofs + XE_PAGE_SIZE +
+ 			  (i + 1) * 8, u64, entry);
+diff --git a/drivers/gpu/drm/xe/xe_pt.c b/drivers/gpu/drm/xe/xe_pt.c
+index c8e63bd23300e..eb9774a8f683c 100644
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -69,7 +69,7 @@ static u64 __xe_pt_empty_pte(struct xe_tile *tile, struct xe_vm *vm,
+ 
+ 	if (level > MAX_HUGEPTE_LEVEL)
+ 		return vm->pt_ops->pde_encode_bo(vm->scratch_pt[id][level - 1]->bo,
+-						 0, pat_index);
++						 0);
+ 
+ 	return vm->pt_ops->pte_encode_addr(xe, 0, pat_index, level, IS_DGFX(xe), 0) |
+ 		XE_PTE_NULL;
+@@ -616,7 +616,7 @@ xe_pt_stage_bind_entry(struct xe_ptw *parent, pgoff_t offset,
+ 			xe_child->is_compact = true;
+ 		}
+ 
+-		pte = vm->pt_ops->pde_encode_bo(xe_child->bo, 0, pat_index) | flags;
++		pte = vm->pt_ops->pde_encode_bo(xe_child->bo, 0) | flags;
+ 		ret = xe_pt_insert_entry(xe_walk, xe_parent, offset, xe_child,
+ 					 pte);
+ 	}
+diff --git a/drivers/gpu/drm/xe/xe_pt_types.h b/drivers/gpu/drm/xe/xe_pt_types.h
+index 69eab6f37cfe6..17cdd7c7e9f5e 100644
+--- a/drivers/gpu/drm/xe/xe_pt_types.h
++++ b/drivers/gpu/drm/xe/xe_pt_types.h
+@@ -45,8 +45,7 @@ struct xe_pt_ops {
+ 	u64 (*pte_encode_addr)(struct xe_device *xe, u64 addr,
+ 			       u16 pat_index,
+ 			       u32 pt_level, bool devmem, u64 flags);
+-	u64 (*pde_encode_bo)(struct xe_bo *bo, u64 bo_offset,
+-			     u16 pat_index);
++	u64 (*pde_encode_bo)(struct xe_bo *bo, u64 bo_offset);
+ };
+ 
+ struct xe_pt_entry {
+diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
+index bf44cd5bf49c0..30c32717a980e 100644
+--- a/drivers/gpu/drm/xe/xe_vm.c
++++ b/drivers/gpu/drm/xe/xe_vm.c
+@@ -1547,14 +1547,39 @@ static u64 pte_encode_ps(u32 pt_level)
+ 	return 0;
+ }
+ 
+-static u64 xelp_pde_encode_bo(struct xe_bo *bo, u64 bo_offset,
+-			      const u16 pat_index)
++static u16 pde_pat_index(struct xe_bo *bo)
++{
++	struct xe_device *xe = xe_bo_device(bo);
++	u16 pat_index;
++
++	/*
++	 * We only have two bits to encode the PAT index in non-leaf nodes, but
++	 * these only point to other paging structures so we only need a minimal
++	 * selection of options. The user PAT index is only for encoding leaf
++	 * nodes, where we have use of more bits to do the encoding. The
++	 * non-leaf nodes are instead under driver control so the chosen index
++	 * here should be distict from the user PAT index. Also the
++	 * corresponding coherency of the PAT index should be tied to the
++	 * allocation type of the page table (or at least we should pick
++	 * something which is always safe).
++	 */
++	if (!xe_bo_is_vram(bo) && bo->ttm.ttm->caching == ttm_cached)
++		pat_index = xe->pat.idx[XE_CACHE_WB];
++	else
++		pat_index = xe->pat.idx[XE_CACHE_NONE];
++
++	xe_assert(xe, pat_index <= 3);
++
++	return pat_index;
++}
++
++static u64 xelp_pde_encode_bo(struct xe_bo *bo, u64 bo_offset)
+ {
+ 	u64 pde;
+ 
+ 	pde = xe_bo_addr(bo, bo_offset, XE_PAGE_SIZE);
+ 	pde |= XE_PAGE_PRESENT | XE_PAGE_RW;
+-	pde |= pde_encode_pat_index(pat_index);
++	pde |= pde_encode_pat_index(pde_pat_index(bo));
+ 
+ 	return pde;
+ }
+@@ -2085,8 +2110,7 @@ struct xe_vm *xe_vm_lookup(struct xe_file *xef, u32 id)
+ 
+ u64 xe_vm_pdp4_descriptor(struct xe_vm *vm, struct xe_tile *tile)
+ {
+-	return vm->pt_ops->pde_encode_bo(vm->pt_root[tile->id]->bo, 0,
+-					 tile_to_xe(tile)->pat.idx[XE_CACHE_WB]);
++	return vm->pt_ops->pde_encode_bo(vm->pt_root[tile->id]->bo, 0);
+ }
+ 
+ static struct xe_exec_queue *
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-set-gt-as-wedged-before-sending-wedged-uevent.patch b/queue-6.17/drm-xe-set-gt-as-wedged-before-sending-wedged-uevent.patch
new file mode 100644
index 0000000000..402de8b9dd
--- /dev/null
+++ b/queue-6.17/drm-xe-set-gt-as-wedged-before-sending-wedged-uevent.patch
@@ -0,0 +1,61 @@
+From fb2c2bec201cb99e9ce1fd26d4a89da5a896628c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 12:04:10 +0530
+Subject: drm/xe: Set GT as wedged before sending wedged uevent
+
+From: Riana Tauro <riana.tauro@intel.com>
+
+[ Upstream commit 90fdcf5f89e9288c153923f16a60e6f7da18ba76 ]
+
+Userspace should be notified after setting the device as wedged.
+Re-order function calls to set gt wedged before sending uevent.
+
+Cc: Matthew Brost <matthew.brost@intel.com>
+Suggested-by: Raag Jadav <raag.jadav@intel.com>
+Signed-off-by: Riana Tauro <riana.tauro@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://lore.kernel.org/r/20250826063419.3022216-4-riana.tauro@intel.com
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_device.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
+index 1c9907b8a4e9e..d399c2628fa33 100644
+--- a/drivers/gpu/drm/xe/xe_device.c
++++ b/drivers/gpu/drm/xe/xe_device.c
+@@ -1157,8 +1157,10 @@ static void xe_device_wedged_fini(struct drm_device *drm, void *arg)
+  * xe_device_declare_wedged - Declare device wedged
+  * @xe: xe device instance
+  *
+- * This is a final state that can only be cleared with a module
++ * This is a final state that can only be cleared with the recovery method
++ * specified in the drm wedged uevent. The default recovery method is
+  * re-probe (unbind + bind).
++ *
+  * In this state every IOCTL will be blocked so the GT cannot be used.
+  * In general it will be called upon any critical error such as gt reset
+  * failure or guc loading failure. Userspace will be notified of this state
+@@ -1192,13 +1194,15 @@ void xe_device_declare_wedged(struct xe_device *xe)
+ 			"IOCTLs and executions are blocked. Only a rebind may clear the failure\n"
+ 			"Please file a _new_ bug report at https://gitlab.freedesktop.org/drm/xe/kernel/issues/new\n",
+ 			dev_name(xe->drm.dev));
++	}
++
++	for_each_gt(gt, xe, id)
++		xe_gt_declare_wedged(gt);
+ 
++	if (xe_device_wedged(xe)) {
+ 		/* Notify userspace of wedged device */
+ 		drm_dev_wedged_event(&xe->drm,
+ 				     DRM_WEDGE_RECOVERY_REBIND | DRM_WEDGE_RECOVERY_BUS_RESET,
+ 				     NULL);
+ 	}
+-
+-	for_each_gt(gt, xe, id)
+-		xe_gt_declare_wedged(gt);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/drm-xe-wcl-extend-l3bank-mask-workaround.patch b/queue-6.17/drm-xe-wcl-extend-l3bank-mask-workaround.patch
new file mode 100644
index 0000000000..ec957ee347
--- /dev/null
+++ b/queue-6.17/drm-xe-wcl-extend-l3bank-mask-workaround.patch
@@ -0,0 +1,40 @@
+From db70a57b3cdbe9efbee97683f8ebc5db1024c443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 05:55:12 +0530
+Subject: drm/xe/wcl: Extend L3bank mask workaround
+
+From: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+
+[ Upstream commit d738e1be2b2b4364403babc43ae7343d45e99d41 ]
+
+The commit 9ab440a9d042 ("drm/xe/ptl: L3bank mask is not
+available on the media GT") added a workaround to ignore
+the fuse register that L3 bank availability as it did not
+contain valid values. Same is true for WCL therefore extend
+the workaround to cover it.
+
+Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
+Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com>
+Link: https://lore.kernel.org/r/20250822002512.1129144-1-chaitanya.kumar.borah@intel.com
+Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_wa_oob.rules | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_wa_oob.rules b/drivers/gpu/drm/xe/xe_wa_oob.rules
+index 48c7a42e2fcad..382719ac4a779 100644
+--- a/drivers/gpu/drm/xe/xe_wa_oob.rules
++++ b/drivers/gpu/drm/xe/xe_wa_oob.rules
+@@ -47,7 +47,7 @@
+ 16023588340	GRAPHICS_VERSION(2001), FUNC(xe_rtp_match_not_sriov_vf)
+ 14019789679	GRAPHICS_VERSION(1255)
+ 		GRAPHICS_VERSION_RANGE(1270, 2004)
+-no_media_l3	MEDIA_VERSION(3000)
++no_media_l3	MEDIA_VERSION_RANGE(3000, 3002)
+ 14022866841	GRAPHICS_VERSION(3000), GRAPHICS_STEP(A0, B0)
+ 		MEDIA_VERSION(3000), MEDIA_STEP(A0, B0)
+ 16021333562	GRAPHICS_VERSION_RANGE(1200, 1274)
+-- 
+2.51.0
+
diff --git a/queue-6.17/dt-bindings-display-msm-gmu-update-adreno-623-bindin.patch b/queue-6.17/dt-bindings-display-msm-gmu-update-adreno-623-bindin.patch
new file mode 100644
index 0000000000..c6c7555b7d
--- /dev/null
+++ b/queue-6.17/dt-bindings-display-msm-gmu-update-adreno-623-bindin.patch
@@ -0,0 +1,70 @@
+From 3d697ec8afce0b2ca63228133608dea60e6a6ba0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 12:49:52 +0530
+Subject: dt-bindings: display/msm/gmu: Update Adreno 623 bindings
+
+From: Jie Zhang <quic_jiezh@quicinc.com>
+
+[ Upstream commit c2cc1e60c1afff4f23c22561b57a5d5157dde20d ]
+
+Update Adreno 623's dt-binding to remove smmu_clk which is not required
+for this GMU.
+
+Signed-off-by: Jie Zhang <quic_jiezh@quicinc.com>
+Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/672455/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/display/msm/gmu.yaml  | 34 +++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/Documentation/devicetree/bindings/display/msm/gmu.yaml b/Documentation/devicetree/bindings/display/msm/gmu.yaml
+index 4392aa7a4ffe2..afc1879357440 100644
+--- a/Documentation/devicetree/bindings/display/msm/gmu.yaml
++++ b/Documentation/devicetree/bindings/display/msm/gmu.yaml
+@@ -124,6 +124,40 @@ allOf:
+           contains:
+             enum:
+               - qcom,adreno-gmu-623.0
++    then:
++      properties:
++        reg:
++          items:
++            - description: Core GMU registers
++            - description: Resource controller registers
++            - description: GMU PDC registers
++        reg-names:
++          items:
++            - const: gmu
++            - const: rscc
++            - const: gmu_pdc
++        clocks:
++          items:
++            - description: GMU clock
++            - description: GPU CX clock
++            - description: GPU AXI clock
++            - description: GPU MEMNOC clock
++            - description: GPU AHB clock
++            - description: GPU HUB CX clock
++        clock-names:
++          items:
++            - const: gmu
++            - const: cxo
++            - const: axi
++            - const: memnoc
++            - const: ahb
++            - const: hub
++
++  - if:
++      properties:
++        compatible:
++          contains:
++            enum:
+               - qcom,adreno-gmu-635.0
+               - qcom,adreno-gmu-660.1
+               - qcom,adreno-gmu-663.0
+-- 
+2.51.0
+
diff --git a/queue-6.17/eeprom-at25-support-cypress-frams-without-device-id.patch b/queue-6.17/eeprom-at25-support-cypress-frams-without-device-id.patch
new file mode 100644
index 0000000000..c8e014f688
--- /dev/null
+++ b/queue-6.17/eeprom-at25-support-cypress-frams-without-device-id.patch
@@ -0,0 +1,150 @@
+From 1bb38f2a5d5ee4018c45c753bd9f8f6cb79997a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 11:58:37 +0200
+Subject: eeprom: at25: support Cypress FRAMs without device ID
+
+From: Markus Heidelberg <m.heidelberg@cab.de>
+
+[ Upstream commit 1b434ed000cd474f074e62e8ab876f87449bb4ac ]
+
+Not all FRAM chips have a device ID and implement the corresponding read
+command. For such chips this led to the following error on module
+loading:
+
+    at25 spi2.0: Error: no Cypress FRAM (id 00)
+
+The device ID contains the memory size, so devices without this ID are
+supported now by setting the size manually in Devicetree using the
+"size" property.
+
+Tested with FM25L16B and "size = <2048>;":
+
+    at25 spi2.0: 2 KByte fm25 fram, pagesize 4096
+
+According to Infineon/Cypress datasheets, these FRAMs have a device ID:
+
+    FM25V01A
+    FM25V02A
+    FM25V05
+    FM25V10
+    FM25V20A
+    FM25VN10
+
+but these do not:
+
+    FM25040B
+    FM25640B
+    FM25C160B
+    FM25CL64B
+    FM25L04B
+    FM25L16B
+    FM25W256
+
+So all "FM25V*" FRAMs and only these have a device ID. The letter after
+"FM25" (V/C/L/W) only describes the voltage range, though.
+
+Link: https://lore.kernel.org/all/20250401133148.38330-1-m.heidelberg@cab.de/
+Signed-off-by: Markus Heidelberg <m.heidelberg@cab.de>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
+Link: https://lore.kernel.org/r/20250815095839.4219-3-m.heidelberg@cab.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/at25.c | 67 ++++++++++++++++++++------------------
+ 1 file changed, 36 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
+index 2d0492867054f..c90150f728369 100644
+--- a/drivers/misc/eeprom/at25.c
++++ b/drivers/misc/eeprom/at25.c
+@@ -379,37 +379,49 @@ static int at25_fram_to_chip(struct device *dev, struct spi_eeprom *chip)
+ 	struct at25_data *at25 = container_of(chip, struct at25_data, chip);
+ 	u8 sernum[FM25_SN_LEN];
+ 	u8 id[FM25_ID_LEN];
++	u32 val;
+ 	int i;
+ 
+ 	strscpy(chip->name, "fm25", sizeof(chip->name));
+ 
+-	/* Get ID of chip */
+-	fm25_aux_read(at25, id, FM25_RDID, FM25_ID_LEN);
+-	/* There are inside-out FRAM variations, detect them and reverse the ID bytes */
+-	if (id[6] == 0x7f && id[2] == 0xc2)
+-		for (i = 0; i < ARRAY_SIZE(id) / 2; i++) {
+-			u8 tmp = id[i];
+-			int j = ARRAY_SIZE(id) - i - 1;
++	if (!device_property_read_u32(dev, "size", &val)) {
++		chip->byte_len = val;
++	} else {
++		/* Get ID of chip */
++		fm25_aux_read(at25, id, FM25_RDID, FM25_ID_LEN);
++		/* There are inside-out FRAM variations, detect them and reverse the ID bytes */
++		if (id[6] == 0x7f && id[2] == 0xc2)
++			for (i = 0; i < ARRAY_SIZE(id) / 2; i++) {
++				u8 tmp = id[i];
++				int j = ARRAY_SIZE(id) - i - 1;
++
++				id[i] = id[j];
++				id[j] = tmp;
++			}
++		if (id[6] != 0xc2) {
++			dev_err(dev, "Error: no Cypress FRAM (id %02x)\n", id[6]);
++			return -ENODEV;
++		}
+ 
+-			id[i] = id[j];
+-			id[j] = tmp;
++		switch (id[7]) {
++		case 0x21 ... 0x26:
++			chip->byte_len = BIT(id[7] - 0x21 + 4) * 1024;
++			break;
++		case 0x2a ... 0x30:
++			/* CY15B116QN ... CY15B116QN */
++			chip->byte_len = BIT(((id[7] >> 1) & 0xf) + 13);
++			break;
++		default:
++			dev_err(dev, "Error: unsupported size (id %02x)\n", id[7]);
++			return -ENODEV;
+ 		}
+-	if (id[6] != 0xc2) {
+-		dev_err(dev, "Error: no Cypress FRAM (id %02x)\n", id[6]);
+-		return -ENODEV;
+-	}
+ 
+-	switch (id[7]) {
+-	case 0x21 ... 0x26:
+-		chip->byte_len = BIT(id[7] - 0x21 + 4) * 1024;
+-		break;
+-	case 0x2a ... 0x30:
+-		/* CY15B116QN ... CY15B116QN */
+-		chip->byte_len = BIT(((id[7] >> 1) & 0xf) + 13);
+-		break;
+-	default:
+-		dev_err(dev, "Error: unsupported size (id %02x)\n", id[7]);
+-		return -ENODEV;
++		if (id[8]) {
++			fm25_aux_read(at25, sernum, FM25_RDSN, FM25_SN_LEN);
++			/* Swap byte order */
++			for (i = 0; i < FM25_SN_LEN; i++)
++				at25->sernum[i] = sernum[FM25_SN_LEN - 1 - i];
++		}
+ 	}
+ 
+ 	if (chip->byte_len > 64 * 1024)
+@@ -417,13 +429,6 @@ static int at25_fram_to_chip(struct device *dev, struct spi_eeprom *chip)
+ 	else
+ 		chip->flags |= EE_ADDR2;
+ 
+-	if (id[8]) {
+-		fm25_aux_read(at25, sernum, FM25_RDSN, FM25_SN_LEN);
+-		/* Swap byte order */
+-		for (i = 0; i < FM25_SN_LEN; i++)
+-			at25->sernum[i] = sernum[FM25_SN_LEN - 1 - i];
+-	}
+-
+ 	chip->page_size = PAGE_SIZE;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-6.17/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..817310ee53
--- /dev/null
+++ b/queue-6.17/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From 44030724f9f17ed480193bf6698f25ebd657dfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index fe136f61586fe..272c83bfdc6ce 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-6.17/eth-fbnic-reset-hw-stats-upon-pci-error.patch b/queue-6.17/eth-fbnic-reset-hw-stats-upon-pci-error.patch
new file mode 100644
index 0000000000..00339bfaa1
--- /dev/null
+++ b/queue-6.17/eth-fbnic-reset-hw-stats-upon-pci-error.patch
@@ -0,0 +1,43 @@
+From 153d900590b56587e0c1e39607af8b1731d7b821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 13:02:02 -0700
+Subject: eth: fbnic: Reset hw stats upon PCI error
+
+From: Mohsin Bashir <mohsin.bashr@gmail.com>
+
+[ Upstream commit b1161b1863c5f3d592adba5accd6e5c79741720f ]
+
+Upon experiencing a PCI error, fbnic reset the device to recover from
+the failure. Reset the hardware stats as part of the device reset to
+ensure accurate stats reporting.
+
+Note that the reset is not really resetting the aggregate value to 0,
+which may result in a spike for a system collecting deltas in stats.
+Rather, the reset re-latches the current value as previous, in case HW
+got reset.
+
+Signed-off-by: Mohsin Bashir <mohsin.bashr@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250825200206.2357713-3-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_pci.c b/drivers/net/ethernet/meta/fbnic/fbnic_pci.c
+index 28e23e3ffca88..c4d51490140eb 100644
+--- a/drivers/net/ethernet/meta/fbnic/fbnic_pci.c
++++ b/drivers/net/ethernet/meta/fbnic/fbnic_pci.c
+@@ -489,6 +489,8 @@ static void __fbnic_pm_attach(struct device *dev)
+ 	struct net_device *netdev = fbd->netdev;
+ 	struct fbnic_net *fbn;
+ 
++	fbnic_reset_hw_stats(fbd);
++
+ 	if (fbnic_init_failure(fbd))
+ 		return;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/ethernet-extend-device_get_mac_address-to-use-nvmem.patch b/queue-6.17/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
new file mode 100644
index 0000000000..39ceadf862
--- /dev/null
+++ b/queue-6.17/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
@@ -0,0 +1,42 @@
+From 64ef2e62350401d6f2e3429f12c0c5560f49b686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:03:32 +0200
+Subject: ethernet: Extend device_get_mac_address() to use NVMEM
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
+
+A lot of modern SoC have the ability to store MAC addresses in their
+NVMEM. So extend the generic function device_get_mac_address() to
+obtain the MAC address from an nvmem cell named 'mac-address' in
+case there is no firmware node which contains the MAC address directly.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethernet/eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 4e3651101b866..43e211e611b16 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -613,7 +613,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);
+  */
+ int device_get_mac_address(struct device *dev, char *addr)
+ {
+-	return fwnode_get_mac_address(dev_fwnode(dev), addr);
++	if (!fwnode_get_mac_address(dev_fwnode(dev), addr))
++		return 0;
++
++	return nvmem_get_mac_address(dev, addr);
+ }
+ EXPORT_SYMBOL(device_get_mac_address);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/exfat-limit-log-print-for-io-error.patch b/queue-6.17/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..61a5b93fb7
--- /dev/null
+++ b/queue-6.17/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From 4beaa631bf3cf7d56f0441c634f59ce36d7ba4fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 232cc7f8ab92f..825083634ba2d 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-6.17/exfat-validate-cluster-allocation-bits-of-the-alloca.patch b/queue-6.17/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
new file mode 100644
index 0000000000..5300e6e51f
--- /dev/null
+++ b/queue-6.17/exfat-validate-cluster-allocation-bits-of-the-alloca.patch
@@ -0,0 +1,130 @@
+From d87976b52099898d862d9a301e0536525a49e093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 14:44:35 +0900
+Subject: exfat: validate cluster allocation bits of the allocation bitmap
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 79c1587b6cda74deb0c86fc7ba194b92958c793c ]
+
+syzbot created an exfat image with cluster bits not set for the allocation
+bitmap. exfat-fs reads and uses the allocation bitmap without checking
+this. The problem is that if the start cluster of the allocation bitmap
+is 6, cluster 6 can be allocated when creating a directory with mkdir.
+exfat zeros out this cluster in exfat_mkdir, which can delete existing
+entries. This can reallocate the allocated entries. In addition,
+the allocation bitmap is also zeroed out, so cluster 6 can be reallocated.
+This patch adds exfat_test_bitmap_range to validate that clusters used for
+the allocation bitmap are correctly marked as in-use.
+
+Reported-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com
+Tested-by: syzbot+a725ab460fc1def9896f@syzkaller.appspotmail.com
+Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
+Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/balloc.c | 72 +++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 60 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c
+index cc01556c9d9b3..071448adbd5d9 100644
+--- a/fs/exfat/balloc.c
++++ b/fs/exfat/balloc.c
+@@ -26,12 +26,55 @@
+ /*
+  *  Allocation Bitmap Management Functions
+  */
++static bool exfat_test_bitmap_range(struct super_block *sb, unsigned int clu,
++		unsigned int count)
++{
++	struct exfat_sb_info *sbi = EXFAT_SB(sb);
++	unsigned int start = clu;
++	unsigned int end = clu + count;
++	unsigned int ent_idx, i, b;
++	unsigned int bit_offset, bits_to_check;
++	__le_long *bitmap_le;
++	unsigned long mask, word;
++
++	if (!is_valid_cluster(sbi, start) || !is_valid_cluster(sbi, end - 1))
++		return false;
++
++	while (start < end) {
++		ent_idx = CLUSTER_TO_BITMAP_ENT(start);
++		i = BITMAP_OFFSET_SECTOR_INDEX(sb, ent_idx);
++		b = BITMAP_OFFSET_BIT_IN_SECTOR(sb, ent_idx);
++
++		bitmap_le = (__le_long *)sbi->vol_amap[i]->b_data;
++
++		/* Calculate how many bits we can check in the current word */
++		bit_offset = b % BITS_PER_LONG;
++		bits_to_check = min(end - start,
++				    (unsigned int)(BITS_PER_LONG - bit_offset));
++
++		/* Create a bitmask for the range of bits to check */
++		if (bits_to_check >= BITS_PER_LONG)
++			mask = ~0UL;
++		else
++			mask = ((1UL << bits_to_check) - 1) << bit_offset;
++		word = lel_to_cpu(bitmap_le[b / BITS_PER_LONG]);
++
++		/* Check if all bits in the mask are set */
++		if ((word & mask) != mask)
++			return false;
++
++		start += bits_to_check;
++	}
++
++	return true;
++}
++
+ static int exfat_allocate_bitmap(struct super_block *sb,
+ 		struct exfat_dentry *ep)
+ {
+ 	struct exfat_sb_info *sbi = EXFAT_SB(sb);
+ 	long long map_size;
+-	unsigned int i, need_map_size;
++	unsigned int i, j, need_map_size;
+ 	sector_t sector;
+ 
+ 	sbi->map_clu = le32_to_cpu(ep->dentry.bitmap.start_clu);
+@@ -58,20 +101,25 @@ static int exfat_allocate_bitmap(struct super_block *sb,
+ 	sector = exfat_cluster_to_sector(sbi, sbi->map_clu);
+ 	for (i = 0; i < sbi->map_sectors; i++) {
+ 		sbi->vol_amap[i] = sb_bread(sb, sector + i);
+-		if (!sbi->vol_amap[i]) {
+-			/* release all buffers and free vol_amap */
+-			int j = 0;
+-
+-			while (j < i)
+-				brelse(sbi->vol_amap[j++]);
+-
+-			kvfree(sbi->vol_amap);
+-			sbi->vol_amap = NULL;
+-			return -EIO;
+-		}
++		if (!sbi->vol_amap[i])
++			goto err_out;
+ 	}
+ 
++	if (exfat_test_bitmap_range(sb, sbi->map_clu,
++		EXFAT_B_TO_CLU_ROUND_UP(map_size, sbi)) == false)
++		goto err_out;
++
+ 	return 0;
++
++err_out:
++	j = 0;
++	/* release all buffers and free vol_amap */
++	while (j < i)
++		brelse(sbi->vol_amap[j++]);
++
++	kvfree(sbi->vol_amap);
++	sbi->vol_amap = NULL;
++	return -EIO;
+ }
+ 
+ int exfat_load_bitmap(struct super_block *sb)
+-- 
+2.51.0
+
diff --git a/queue-6.17/ext4-increase-io-priority-of-fastcommit.patch b/queue-6.17/ext4-increase-io-priority-of-fastcommit.patch
new file mode 100644
index 0000000000..5a6e5ecc64
--- /dev/null
+++ b/queue-6.17/ext4-increase-io-priority-of-fastcommit.patch
@@ -0,0 +1,50 @@
+From 5011e47ddf33415b695cca17362ccad44113cc1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:18:12 +0800
+Subject: ext4: increase IO priority of fastcommit
+
+From: Julian Sun <sunjunchao@bytedance.com>
+
+[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
+
+The following code paths may result in high latency or even task hangs:
+   1. fastcommit io is throttled by wbt.
+   2. jbd2_fc_wait_bufs() might wait for a long time while
+JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then
+jbd2_journal_commit_transaction() waits for the
+JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write
+lock of j_state_lock.
+   3. start_this_handle() waits for read lock of j_state_lock which
+results in high latency or task hang.
+
+Given the fact that ext4_fc_commit() already modifies the current
+process' IO priority to match that of the jbd2 thread, it should be
+reasonable to match jbd2's IO submission flags as well.
+
+Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/fast_commit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
+index 42bee1d4f9f97..fa66b08de9994 100644
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -663,7 +663,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star
+ 
+ static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail)
+ {
+-	blk_opf_t write_flags = REQ_SYNC;
++	blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS;
+ 	struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh;
+ 
+ 	/* Add REQ_FUA | REQ_PREFLUSH only its tail */
+-- 
+2.51.0
+
diff --git a/queue-6.17/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-6.17/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..2133d18b64
--- /dev/null
+++ b/queue-6.17/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From 38a3eb0786d7854ce18d0b8dd0ec85c626d21068 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 46c40d85c2ac8..557930394abd2 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -164,6 +164,7 @@ static void adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/extcon-axp288-fix-wakeup-source-leaks-on-device-unbi.patch b/queue-6.17/extcon-axp288-fix-wakeup-source-leaks-on-device-unbi.patch
new file mode 100644
index 0000000000..2ad0a1796a
--- /dev/null
+++ b/queue-6.17/extcon-axp288-fix-wakeup-source-leaks-on-device-unbi.patch
@@ -0,0 +1,37 @@
+From 4c85303d19f356789a9af77d693c8913978cd843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:22 +0200
+Subject: extcon: axp288: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 93ccf3f2f22ceaa975b462156f98527febee4fe5 ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-2-7af77802cbea@linaro.org/
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-axp288.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
+index d3bcbe839c095..19856dddade62 100644
+--- a/drivers/extcon/extcon-axp288.c
++++ b/drivers/extcon/extcon-axp288.c
+@@ -470,7 +470,7 @@ static int axp288_extcon_probe(struct platform_device *pdev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	device_init_wakeup(dev, true);
++	devm_device_init_wakeup(dev);
+ 	platform_set_drvdata(pdev, info);
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/extcon-fsa9480-fix-wakeup-source-leaks-on-device-unb.patch b/queue-6.17/extcon-fsa9480-fix-wakeup-source-leaks-on-device-unb.patch
new file mode 100644
index 0000000000..44c8f9372f
--- /dev/null
+++ b/queue-6.17/extcon-fsa9480-fix-wakeup-source-leaks-on-device-unb.patch
@@ -0,0 +1,37 @@
+From 8185c945b65de3241f61fd4ccd95b285678a9f1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:23 +0200
+Subject: extcon: fsa9480: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 6f982d55f8c5d1e9189906a2a352dba8de421f5f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-3-7af77802cbea@linaro.org/
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-fsa9480.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/extcon/extcon-fsa9480.c b/drivers/extcon/extcon-fsa9480.c
+index b11b43171063d..a031eb0914a0b 100644
+--- a/drivers/extcon/extcon-fsa9480.c
++++ b/drivers/extcon/extcon-fsa9480.c
+@@ -317,7 +317,7 @@ static int fsa9480_probe(struct i2c_client *client)
+ 		return ret;
+ 	}
+ 
+-	device_init_wakeup(info->dev, true);
++	devm_device_init_wakeup(info->dev);
+ 	fsa9480_detect_dev(info);
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch b/queue-6.17/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
new file mode 100644
index 0000000000..a71ea318b3
--- /dev/null
+++ b/queue-6.17/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
@@ -0,0 +1,42 @@
+From 4205d78b4414b23e97e3d9936211c0df58545fd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:22 +0800
+Subject: f2fs: fix infinite loop in __insert_extent_tree()
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 23361bd54966b437e1ed3eb1a704572f4b279e58 ]
+
+When we get wrong extent info data, and look up extent_node in rb tree,
+it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by
+return NULL and print some kernel messages in that case.
+
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/extent_cache.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 199c1e7a83ef3..ba0a07bfd3463 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -604,7 +604,13 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ 			p = &(*p)->rb_right;
+ 			leftmost = false;
+ 		} else {
++			f2fs_err_ratelimited(sbi, "%s: corrupted extent, type: %d, "
++				"extent node in rb tree [%u, %u, %u], age [%llu, %llu], "
++				"extent node to insert [%u, %u, %u], age [%llu, %llu]",
++				__func__, et->type, en->ei.fofs, en->ei.blk, en->ei.len, en->ei.age,
++				en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks);
+ 			f2fs_bug_on(sbi, 1);
++			return NULL;
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch b/queue-6.17/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
new file mode 100644
index 0000000000..a7ea05a4ad
--- /dev/null
+++ b/queue-6.17/f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
@@ -0,0 +1,76 @@
+From ad960506c65c4f2897ef451c800abd4270954bc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:44:31 +0800
+Subject: f2fs: fix to detect potential corrupted nid in free_nid_list
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8fc6056dcf79937c46c97fa4996cda65956437a9 ]
+
+As reported, on-disk footer.ino and footer.nid is the same and
+out-of-range, let's add sanity check on f2fs_alloc_nid() to detect
+any potential corruption in free_nid_list.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c          | 17 ++++++++++++++++-
+ include/linux/f2fs_fs.h |  1 +
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 92054dcbe20d0..4254db453b2d3 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -27,12 +27,17 @@ static struct kmem_cache *free_nid_slab;
+ static struct kmem_cache *nat_entry_set_slab;
+ static struct kmem_cache *fsync_node_entry_slab;
+ 
++static inline bool is_invalid_nid(struct f2fs_sb_info *sbi, nid_t nid)
++{
++	return nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid;
++}
++
+ /*
+  * Check whether the given nid is within node id range.
+  */
+ int f2fs_check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
+ {
+-	if (unlikely(nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid)) {
++	if (unlikely(is_invalid_nid(sbi, nid))) {
+ 		set_sbi_flag(sbi, SBI_NEED_FSCK);
+ 		f2fs_warn(sbi, "%s: out-of-range nid=%x, run fsck to fix.",
+ 			  __func__, nid);
+@@ -2654,6 +2659,16 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid)
+ 		f2fs_bug_on(sbi, list_empty(&nm_i->free_nid_list));
+ 		i = list_first_entry(&nm_i->free_nid_list,
+ 					struct free_nid, list);
++
++		if (unlikely(is_invalid_nid(sbi, i->nid))) {
++			spin_unlock(&nm_i->nid_list_lock);
++			f2fs_err(sbi, "Corrupted nid %u in free_nid_list",
++								i->nid);
++			f2fs_stop_checkpoint(sbi, false,
++					STOP_CP_REASON_CORRUPTED_NID);
++			return false;
++		}
++
+ 		*nid = i->nid;
+ 
+ 		__move_free_nid(sbi, i, FREE_NID, PREALLOC_NID);
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index 2f8b8bfc0e731..6afb4a13b81d6 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -79,6 +79,7 @@ enum stop_cp_reason {
+ 	STOP_CP_REASON_FLUSH_FAIL,
+ 	STOP_CP_REASON_NO_SEGMENT,
+ 	STOP_CP_REASON_CORRUPTED_FREE_BITMAP,
++	STOP_CP_REASON_CORRUPTED_NID,
+ 	STOP_CP_REASON_MAX,
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/f2fs-fix-wrong-layout-information-on-16kb-page.patch b/queue-6.17/f2fs-fix-wrong-layout-information-on-16kb-page.patch
new file mode 100644
index 0000000000..bf3791e21a
--- /dev/null
+++ b/queue-6.17/f2fs-fix-wrong-layout-information-on-16kb-page.patch
@@ -0,0 +1,44 @@
+From 8f2f89f79959c3f593b7445ace54daeabd38f6cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 00:26:06 +0000
+Subject: f2fs: fix wrong layout information on 16KB page
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit a33be64b98d0723748d2fab0832b926613e1fce0 ]
+
+This patch fixes to support different block size.
+
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index f736052dea50a..902ffb3faa1ff 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -1723,12 +1723,15 @@ static int __maybe_unused disk_map_seq_show(struct seq_file *seq,
+ 	seq_printf(seq, " Main          : 0x%010x (%10d)\n",
+ 			SM_I(sbi)->main_blkaddr,
+ 			le32_to_cpu(F2FS_RAW_SUPER(sbi)->segment_count_main));
+-	seq_printf(seq, " # of Sections : %12d\n",
+-			le32_to_cpu(F2FS_RAW_SUPER(sbi)->section_count));
++	seq_printf(seq, " Block size    : %12lu KB\n", F2FS_BLKSIZE >> 10);
++	seq_printf(seq, " Segment size  : %12d MB\n",
++			(BLKS_PER_SEG(sbi) << (F2FS_BLKSIZE_BITS - 10)) >> 10);
+ 	seq_printf(seq, " Segs/Sections : %12d\n",
+ 			SEGS_PER_SEC(sbi));
+ 	seq_printf(seq, " Section size  : %12d MB\n",
+-			SEGS_PER_SEC(sbi) << 1);
++			(BLKS_PER_SEC(sbi) << (F2FS_BLKSIZE_BITS - 10)) >> 10);
++	seq_printf(seq, " # of Sections : %12d\n",
++			le32_to_cpu(F2FS_RAW_SUPER(sbi)->section_count));
+ 
+ 	if (!f2fs_is_multi_device(sbi))
+ 		return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/fbcon-use-screen-info-to-find-primary-device.patch b/queue-6.17/fbcon-use-screen-info-to-find-primary-device.patch
new file mode 100644
index 0000000000..2e768ad73a
--- /dev/null
+++ b/queue-6.17/fbcon-use-screen-info-to-find-primary-device.patch
@@ -0,0 +1,79 @@
+From cdd33a2635d820cb97191715c9ae131f843f048a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:26:05 -0500
+Subject: fbcon: Use screen info to find primary device
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit ad90860bd10ee3ed387077aed88828b139339976 ]
+
+On systems with non VGA GPUs fbcon can't find the primary GPU because
+video_is_primary_device() only checks the VGA arbiter.
+
+Add a screen info check to video_is_primary_device() so that callers
+can get accurate data on such systems.
+
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Suggested-by: Thomas Zimmermann <tzimmermann@suse.de>
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://lore.kernel.org/r/20250811162606.587759-4-superm1@kernel.org
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/video/video-common.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/video/video-common.c b/arch/x86/video/video-common.c
+index 81fc97a2a837a..e0aeee99bc99e 100644
+--- a/arch/x86/video/video-common.c
++++ b/arch/x86/video/video-common.c
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/module.h>
+ #include <linux/pci.h>
++#include <linux/screen_info.h>
+ #include <linux/vgaarb.h>
+ 
+ #include <asm/video.h>
+@@ -27,6 +28,11 @@ EXPORT_SYMBOL(pgprot_framebuffer);
+ 
+ bool video_is_primary_device(struct device *dev)
+ {
++#ifdef CONFIG_SCREEN_INFO
++	struct screen_info *si = &screen_info;
++	struct resource res[SCREEN_INFO_MAX_RESOURCES];
++	ssize_t i, numres;
++#endif
+ 	struct pci_dev *pdev;
+ 
+ 	if (!dev_is_pci(dev))
+@@ -34,7 +40,24 @@ bool video_is_primary_device(struct device *dev)
+ 
+ 	pdev = to_pci_dev(dev);
+ 
+-	return (pdev == vga_default_device());
++	if (!pci_is_display(pdev))
++		return false;
++
++	if (pdev == vga_default_device())
++		return true;
++
++#ifdef CONFIG_SCREEN_INFO
++	numres = screen_info_resources(si, res, ARRAY_SIZE(res));
++	for (i = 0; i < numres; ++i) {
++		if (!(res[i].flags & IORESOURCE_MEM))
++			continue;
++
++		if (pci_find_resource(pdev, &res[i]))
++			return true;
++	}
++#endif
++
++	return false;
+ }
+ EXPORT_SYMBOL(video_is_primary_device);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/fix-access-to-video_is_primary_device-when-compiled-.patch b/queue-6.17/fix-access-to-video_is_primary_device-when-compiled-.patch
new file mode 100644
index 0000000000..c54a6b21fd
--- /dev/null
+++ b/queue-6.17/fix-access-to-video_is_primary_device-when-compiled-.patch
@@ -0,0 +1,74 @@
+From e5aa3a162de53bd29f327761daf25404f9a1d732 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:26:03 -0500
+Subject: Fix access to video_is_primary_device() when compiled without
+ CONFIG_VIDEO
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 6e490dea61b88aac9762c9f79a54aad4ea2e6cd1 ]
+
+When compiled without CONFIG_VIDEO the architecture specific
+implementations of video_is_primary_device() include prototypes and
+assume that video-common.c will be linked. Guard against this so that the
+fallback inline implementation that returns false will be used when
+compiled without CONFIG_VIDEO.
+
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202506221312.49Fy1aNA-lkp@intel.com/
+Link: https://lore.kernel.org/r/20250811162606.587759-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/video.h | 2 +-
+ arch/sparc/include/asm/video.h  | 2 ++
+ arch/x86/include/asm/video.h    | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/parisc/include/asm/video.h b/arch/parisc/include/asm/video.h
+index c5dff3223194a..a9d50ebd6e769 100644
+--- a/arch/parisc/include/asm/video.h
++++ b/arch/parisc/include/asm/video.h
+@@ -6,7 +6,7 @@
+ 
+ struct device;
+ 
+-#if defined(CONFIG_STI_CORE)
++#if defined(CONFIG_STI_CORE) && defined(CONFIG_VIDEO)
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
+ #endif
+diff --git a/arch/sparc/include/asm/video.h b/arch/sparc/include/asm/video.h
+index a6f48f52db584..773717b6d4914 100644
+--- a/arch/sparc/include/asm/video.h
++++ b/arch/sparc/include/asm/video.h
+@@ -19,8 +19,10 @@ static inline pgprot_t pgprot_framebuffer(pgprot_t prot,
+ #define pgprot_framebuffer pgprot_framebuffer
+ #endif
+ 
++#ifdef CONFIG_VIDEO
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
++#endif
+ 
+ static inline void fb_memcpy_fromio(void *to, const volatile void __iomem *from, size_t n)
+ {
+diff --git a/arch/x86/include/asm/video.h b/arch/x86/include/asm/video.h
+index 0950c9535fae9..08ec328203ef8 100644
+--- a/arch/x86/include/asm/video.h
++++ b/arch/x86/include/asm/video.h
+@@ -13,8 +13,10 @@ pgprot_t pgprot_framebuffer(pgprot_t prot,
+ 			    unsigned long offset);
+ #define pgprot_framebuffer pgprot_framebuffer
+ 
++#ifdef CONFIG_VIDEO
+ bool video_is_primary_device(struct device *dev);
+ #define video_is_primary_device video_is_primary_device
++#endif
+ 
+ #include <asm-generic/video.h>
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-6.17/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..8acc58ba15
--- /dev/null
+++ b/queue-6.17/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 4e96247085396a8d27f591678b902ad57f692282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index b0e60a44dae9d..ce7253b3f5499 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1535,7 +1535,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.17/ftrace-fix-softlockup-in-ftrace_module_enable.patch b/queue-6.17/ftrace-fix-softlockup-in-ftrace_module_enable.patch
new file mode 100644
index 0000000000..5badd49980
--- /dev/null
+++ b/queue-6.17/ftrace-fix-softlockup-in-ftrace_module_enable.patch
@@ -0,0 +1,44 @@
+From 64c0cfd519b61859392c83136320c3f2be0efa25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 13:28:55 +0200
+Subject: ftrace: Fix softlockup in ftrace_module_enable
+
+From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+
+[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
+
+A soft lockup was observed when loading amdgpu module.
+If a module has a lot of tracable functions, multiple calls
+to kallsyms_lookup can spend too much time in RCU critical
+section and with disabled preemption, causing kernel panic.
+This is the same issue that was fixed in
+commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY
+kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to
+ftrace_graph_set_hash()").
+
+Fix it the same way by adding cond_resched() in ftrace_module_enable.
+
+Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc
+Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index a69067367c296..42bd2ba68a821 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -7535,6 +7535,8 @@ void ftrace_module_enable(struct module *mod)
+ 		if (!within_module(rec->ip, mod))
+ 			break;
+ 
++		cond_resched();
++
+ 		/* Weak functions should still be ignored */
+ 		if (!test_for_valid_rec(rec)) {
+ 			/* Clear all other flags. Should not be enabled anyway */
+-- 
+2.51.0
+
diff --git a/queue-6.17/fuse-zero-initialize-inode-private-data.patch b/queue-6.17/fuse-zero-initialize-inode-private-data.patch
new file mode 100644
index 0000000000..db8d8330dd
--- /dev/null
+++ b/queue-6.17/fuse-zero-initialize-inode-private-data.patch
@@ -0,0 +1,46 @@
+From a45bc29bbeb6f2be2cbb90712328ffff3be513cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 16:44:02 +0200
+Subject: fuse: zero initialize inode private data
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 3ca1b311181072415b6432a169de765ac2034e5a ]
+
+This is slightly tricky, since the VFS uses non-zeroing allocation to
+preserve some fields that are left in a consistent state.
+
+Reported-by: Chunsheng Luo <luochunsheng@ustc.edu>
+Closes: https://lore.kernel.org/all/20250818083224.229-1-luochunsheng@ustc.edu/
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/inode.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 7ddfd2b3cc9c4..7c0403a002e75 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -101,14 +101,11 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ 	if (!fi)
+ 		return NULL;
+ 
+-	fi->i_time = 0;
++	/* Initialize private data (i.e. everything except fi->inode) */
++	BUILD_BUG_ON(offsetof(struct fuse_inode, inode) != 0);
++	memset((void *) fi + sizeof(fi->inode), 0, sizeof(*fi) - sizeof(fi->inode));
++
+ 	fi->inval_mask = ~0;
+-	fi->nodeid = 0;
+-	fi->nlookup = 0;
+-	fi->attr_version = 0;
+-	fi->orig_ino = 0;
+-	fi->state = 0;
+-	fi->submount_lookup = NULL;
+ 	mutex_init(&fi->mutex);
+ 	spin_lock_init(&fi->lock);
+ 	fi->forget = fuse_alloc_forget();
+-- 
+2.51.0
+
diff --git a/queue-6.17/gpu-nova-core-register-allow-fields-named-offset.patch b/queue-6.17/gpu-nova-core-register-allow-fields-named-offset.patch
new file mode 100644
index 0000000000..dcad66d04d
--- /dev/null
+++ b/queue-6.17/gpu-nova-core-register-allow-fields-named-offset.patch
@@ -0,0 +1,70 @@
+From 775ba0ebf34ee4215b5f97d72ae13cec803e527e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jul 2025 16:26:08 +0900
+Subject: gpu: nova-core: register: allow fields named `offset`
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+[ Upstream commit c5aeb264b6b27c52fc6c9ef3b50eaaebff5d9b60 ]
+
+`offset` is a common field name, yet using it triggers a build error due
+to the conflict between the uppercased field constant (which becomes
+`OFFSET` in this case) containing the bitrange of the field, and the
+`OFFSET` constant constaining the offset of the register.
+
+Fix this by adding `_RANGE` the field's range constant to avoid the
+name collision.
+
+[acourbot@nvidia.com: fix merge conflict due to switch from `as u32` to
+`u32::from`.]
+
+Reported-by: Timur Tabi <ttabi@nvidia.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20250718-nova-regs-v2-3-7b6a762aa1cd@nvidia.com
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/nova-core/regs.rs        | 5 +++--
+ drivers/gpu/nova-core/regs/macros.rs | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/nova-core/regs.rs b/drivers/gpu/nova-core/regs.rs
+index d49fddf6a3c6e..c8f8adb24f6e4 100644
+--- a/drivers/gpu/nova-core/regs.rs
++++ b/drivers/gpu/nova-core/regs.rs
+@@ -28,7 +28,7 @@ impl NV_PMC_BOOT_0 {
+     /// Combines `architecture_0` and `architecture_1` to obtain the architecture of the chip.
+     pub(crate) fn architecture(self) -> Result<Architecture> {
+         Architecture::try_from(
+-            self.architecture_0() | (self.architecture_1() << Self::ARCHITECTURE_0.len()),
++            self.architecture_0() | (self.architecture_1() << Self::ARCHITECTURE_0_RANGE.len()),
+         )
+     }
+ 
+@@ -36,7 +36,8 @@ impl NV_PMC_BOOT_0 {
+     pub(crate) fn chipset(self) -> Result<Chipset> {
+         self.architecture()
+             .map(|arch| {
+-                ((arch as u32) << Self::IMPLEMENTATION.len()) | u32::from(self.implementation())
++                ((arch as u32) << Self::IMPLEMENTATION_RANGE.len())
++                    | u32::from(self.implementation())
+             })
+             .and_then(Chipset::try_from)
+     }
+diff --git a/drivers/gpu/nova-core/regs/macros.rs b/drivers/gpu/nova-core/regs/macros.rs
+index a3e6de1779d41..00b398522ea18 100644
+--- a/drivers/gpu/nova-core/regs/macros.rs
++++ b/drivers/gpu/nova-core/regs/macros.rs
+@@ -278,7 +278,7 @@ macro_rules! register {
+             { $process:expr } $to_type:ty => $res_type:ty $(, $comment:literal)?;
+     ) => {
+         ::kernel::macros::paste!(
+-        const [<$field:upper>]: ::core::ops::RangeInclusive<u8> = $lo..=$hi;
++        const [<$field:upper _RANGE>]: ::core::ops::RangeInclusive<u8> = $lo..=$hi;
+         const [<$field:upper _MASK>]: u32 = ((((1 << $hi) - 1) << 1) + 1) - ((1 << $lo) - 1);
+         const [<$field:upper _SHIFT>]: u32 = Self::[<$field:upper _MASK>].trailing_zeros();
+         );
+-- 
+2.51.0
+
diff --git a/queue-6.17/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch b/queue-6.17/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
new file mode 100644
index 0000000000..3c2d0d5662
--- /dev/null
+++ b/queue-6.17/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
@@ -0,0 +1,65 @@
+From 6545240d32a521336a1b56982ce2f1dcd6d141ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:01:51 +0200
+Subject: HID: asus: add Z13 folio to generic group for multitouch to work
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit b595974b4afe0e171dd707da570964ff642742e3 ]
+
+The Asus Z13 folio has a multitouch touchpad that needs to bind
+to the hid-multitouch driver in order to work properly. So bind
+it to the HID_GROUP_GENERIC group to release the touchpad and
+move it to the bottom so that the comment applies to it.
+
+While at it, change the generic KEYBOARD3 name to Z13_FOLIO.
+
+Reviewed-by: Luke D. Jones <luke@ljones.dev>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-asus.c | 6 +++---
+ drivers/hid/hid-ids.h  | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index 8db9d4e7c3b0b..a444d41e53b6c 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1387,9 +1387,6 @@ static const struct hid_device_id asus_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+-	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3),
+-	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+@@ -1419,6 +1416,9 @@ static const struct hid_device_id asus_devices[] = {
+ 	 * Note bind to the HID_GROUP_GENERIC group, so that we only bind to the keyboard
+ 	 * part, while letting hid-multitouch.c handle the touchpad.
+ 	 */
++	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO),
++	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T101HA_KEYBOARD) },
+ 	{ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ded5348d190c5..5721b8414bbdf 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -223,7 +223,7 @@
+ #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3 0x1822
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD	0x1866
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2	0x19b6
+-#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3	0x1a30
++#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO		0x1a30
+ #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR		0x18c6
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY		0x1abe
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
+-- 
+2.51.0
+
diff --git a/queue-6.17/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch b/queue-6.17/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
new file mode 100644
index 0000000000..ae79ab7896
--- /dev/null
+++ b/queue-6.17/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
@@ -0,0 +1,130 @@
+From 8f1a0d0d0ce294cfb6c5ad80ddc8e4008f94a843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 06:00:06 -0500
+Subject: HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 7d62beb102d6fa9a4e5e874be7fbf47a62fcc4f6 ]
+
+Dell systems utilize an EC-based touchpad emulation when the ACPI
+touchpad _DSM is not invoked. This emulation acts as a secondary
+master on the I2C bus, designed for scenarios where the I2C touchpad
+driver is absent, such as in BIOS menus. Typically, loading the
+i2c-hid module triggers the _DSM at initialization, disabling the
+EC-based emulation.
+
+However, if the i2c-hid module is missing from the boot kernel
+used for hibernation snapshot restoration, the _DSM remains
+uncalled, resulting in dual masters on the I2C bus and
+subsequent arbitration errors. This issue arises when i2c-hid
+resides in the rootfs instead of the kernel or initramfs.
+
+To address this, switch from using the SYSTEM_SLEEP_PM_OPS()
+macro to dedicated callbacks, introducing a specific
+callback for restoring the S4 image. This callback ensures
+the _DSM is invoked.
+
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-acpi.c |  8 ++++++++
+ drivers/hid/i2c-hid/i2c-hid-core.c | 28 +++++++++++++++++++++++++++-
+ drivers/hid/i2c-hid/i2c-hid.h      |  2 ++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+index 1b49243adb16a..abd700a101f46 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-acpi.c
++++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+@@ -76,6 +76,13 @@ static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi)
+ 	return hid_descriptor_address;
+ }
+ 
++static void i2c_hid_acpi_restore_sequence(struct i2chid_ops *ops)
++{
++	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
++
++	i2c_hid_acpi_get_descriptor(ihid_acpi);
++}
++
+ static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops)
+ {
+ 	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
+@@ -96,6 +103,7 @@ static int i2c_hid_acpi_probe(struct i2c_client *client)
+ 
+ 	ihid_acpi->adev = ACPI_COMPANION(dev);
+ 	ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail;
++	ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence;
+ 
+ 	ret = i2c_hid_acpi_get_descriptor(ihid_acpi);
+ 	if (ret < 0)
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 30ebde1273be3..63f46a2e57882 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -961,6 +961,14 @@ static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid)
+ 	ihid->ops->shutdown_tail(ihid->ops);
+ }
+ 
++static void i2c_hid_core_restore_sequence(struct i2c_hid *ihid)
++{
++	if (!ihid->ops->restore_sequence)
++		return;
++
++	ihid->ops->restore_sequence(ihid->ops);
++}
++
+ static int i2c_hid_core_suspend(struct i2c_hid *ihid, bool force_poweroff)
+ {
+ 	struct i2c_client *client = ihid->client;
+@@ -1370,8 +1378,26 @@ static int i2c_hid_core_pm_resume(struct device *dev)
+ 	return i2c_hid_core_resume(ihid);
+ }
+ 
++static int i2c_hid_core_pm_restore(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++	if (ihid->is_panel_follower)
++		return 0;
++
++	i2c_hid_core_restore_sequence(ihid);
++
++	return i2c_hid_core_resume(ihid);
++}
++
+ const struct dev_pm_ops i2c_hid_core_pm = {
+-	SYSTEM_SLEEP_PM_OPS(i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume)
++	.suspend = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.resume = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.freeze = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.thaw = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.poweroff = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.restore = pm_sleep_ptr(i2c_hid_core_pm_restore),
+ };
+ EXPORT_SYMBOL_GPL(i2c_hid_core_pm);
+ 
+diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
+index 2c7b66d5caa0f..1724a435c783a 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.h
++++ b/drivers/hid/i2c-hid/i2c-hid.h
+@@ -27,11 +27,13 @@ static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+  * @power_up: do sequencing to power up the device.
+  * @power_down: do sequencing to power down the device.
+  * @shutdown_tail: called at the end of shutdown.
++ * @restore_sequence: hibernation restore sequence.
+  */
+ struct i2chid_ops {
+ 	int (*power_up)(struct i2chid_ops *ops);
+ 	void (*power_down)(struct i2chid_ops *ops);
+ 	void (*shutdown_tail)(struct i2chid_ops *ops);
++	void (*restore_sequence)(struct i2chid_ops *ops);
+ };
+ 
+ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+-- 
+2.51.0
+
diff --git a/queue-6.17/hid-pidff-permissive_control-quirk-autodetection.patch b/queue-6.17/hid-pidff-permissive_control-quirk-autodetection.patch
new file mode 100644
index 0000000000..3eaadb78ab
--- /dev/null
+++ b/queue-6.17/hid-pidff-permissive_control-quirk-autodetection.patch
@@ -0,0 +1,59 @@
+From 1f06e5d338a2cc044b858d438201e008ea60f273 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 22:10:00 +0200
+Subject: HID: pidff: PERMISSIVE_CONTROL quirk autodetection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit c2dc9f0b368c08c34674311cf78407718d5715a7 ]
+
+Fixes force feedback for devices built with MMOS firmware and many more
+not yet detected devices.
+
+Update quirks mask debug message to always contain all 32 bits of data.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/usbhid/hid-pidff.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index c6b4f61e535d5..711eefff853bb 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -1151,8 +1151,16 @@ static int pidff_find_special_fields(struct pidff_device *pidff)
+ 					 PID_DIRECTION, 0);
+ 	pidff->device_control =
+ 		pidff_find_special_field(pidff->reports[PID_DEVICE_CONTROL],
+-			PID_DEVICE_CONTROL_ARRAY,
+-			!(pidff->quirks & HID_PIDFF_QUIRK_PERMISSIVE_CONTROL));
++			PID_DEVICE_CONTROL_ARRAY, 1);
++
++	/* Detect and set permissive control quirk */
++	if (!pidff->device_control) {
++		pr_debug("Setting PERMISSIVE_CONTROL quirk\n");
++		pidff->quirks |= HID_PIDFF_QUIRK_PERMISSIVE_CONTROL;
++		pidff->device_control = pidff_find_special_field(
++			pidff->reports[PID_DEVICE_CONTROL],
++			PID_DEVICE_CONTROL_ARRAY, 0);
++	}
+ 
+ 	pidff->block_load_status =
+ 		pidff_find_special_field(pidff->reports[PID_BLOCK_LOAD],
+@@ -1492,7 +1500,7 @@ int hid_pidff_init_with_quirks(struct hid_device *hid, u32 initial_quirks)
+ 	ff->playback = pidff_playback;
+ 
+ 	hid_info(dev, "Force feedback for USB HID PID devices by Anssi Hannula <anssi.hannula@gmail.com>\n");
+-	hid_dbg(dev, "Active quirks mask: 0x%x\n", pidff->quirks);
++	hid_dbg(dev, "Active quirks mask: 0x%08x\n", pidff->quirks);
+ 
+ 	hid_device_io_stop(hid);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/hid-pidff-use-direction-fix-only-for-conditional-eff.patch b/queue-6.17/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
new file mode 100644
index 0000000000..9fe498d4ae
--- /dev/null
+++ b/queue-6.17/hid-pidff-use-direction-fix-only-for-conditional-eff.patch
@@ -0,0 +1,150 @@
+From 76f6ddf13d31576981128ff297db0a97c8f7dcf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 22:09:49 +0200
+Subject: HID: pidff: Use direction fix only for conditional effects
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+
+[ Upstream commit f345a4798dab800159b09d088e7bdae0f16076c3 ]
+
+The already fixed bug in SDL only affected conditional effects. This
+should fix FFB in Forza Horizion 4/5 on Moza Devices as Forza Horizon
+flips the constant force direction instead of using negative magnitude
+values.
+
+Changing the direction in the effect directly in pidff_upload_effect()
+would affect it's value in further operations like comparing to the old
+effect and/or just reading the effect values in the user application.
+
+This, in turn, would lead to constant PID_SET_EFFECT spam as the effect
+direction would constantly not match the value that's set by the
+application.
+
+This way, it's still transparent to any software/API.
+
+Only affects conditional effects now so it's better for it to explicitly
+state that in the name. If any HW ever needs fixed direction for other
+effects, we'll add more quirks.
+
+Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
+Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-universal-pidff.c | 20 ++++++++++----------
+ drivers/hid/usbhid/hid-pidff.c    | 28 +++++++++++++++++++++++-----
+ drivers/hid/usbhid/hid-pidff.h    |  2 +-
+ 3 files changed, 34 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/hid/hid-universal-pidff.c b/drivers/hid/hid-universal-pidff.c
+index 554a6559aeb73..70fce0f88e825 100644
+--- a/drivers/hid/hid-universal-pidff.c
++++ b/drivers/hid/hid-universal-pidff.c
+@@ -144,25 +144,25 @@ static int universal_pidff_input_configured(struct hid_device *hdev,
+ 
+ static const struct hid_device_id universal_pidff_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R3_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R5_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R9_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R12_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MOZA, USB_DEVICE_ID_MOZA_R16_R21_2),
+-		.driver_data = HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION },
++		.driver_data = HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C5) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CAMMUS, USB_DEVICE_ID_CAMMUS_C12) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_VRS, USB_DEVICE_ID_VRS_DFP),
+diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
+index 614a20b620231..c6b4f61e535d5 100644
+--- a/drivers/hid/usbhid/hid-pidff.c
++++ b/drivers/hid/usbhid/hid-pidff.c
+@@ -205,6 +205,14 @@ struct pidff_device {
+ 	u8 effect_count;
+ };
+ 
++static int pidff_is_effect_conditional(struct ff_effect *effect)
++{
++	return effect->type == FF_SPRING  ||
++	       effect->type == FF_DAMPER  ||
++	       effect->type == FF_INERTIA ||
++	       effect->type == FF_FRICTION;
++}
++
+ /*
+  * Clamp value for a given field
+  */
+@@ -294,6 +302,20 @@ static void pidff_set_duration(struct pidff_usage *usage, u16 duration)
+ 	pidff_set_time(usage, duration);
+ }
+ 
++static void pidff_set_effect_direction(struct pidff_device *pidff,
++				       struct ff_effect *effect)
++{
++	u16 direction = effect->direction;
++
++	/* Use fixed direction if needed */
++	if (pidff->quirks & HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION &&
++	    pidff_is_effect_conditional(effect))
++		direction = PIDFF_FIXED_WHEEL_DIRECTION;
++
++	pidff->effect_direction->value[0] =
++		pidff_rescale(direction, U16_MAX, pidff->effect_direction);
++}
++
+ /*
+  * Send envelope report to the device
+  */
+@@ -395,11 +417,7 @@ static void pidff_set_effect_report(struct pidff_device *pidff,
+ 		pidff->set_effect[PID_GAIN].field->logical_maximum;
+ 	pidff->set_effect[PID_DIRECTION_ENABLE].value[0] = 1;
+ 
+-	/* Use fixed direction if needed */
+-	pidff->effect_direction->value[0] = pidff_rescale(
+-		pidff->quirks & HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION ?
+-		PIDFF_FIXED_WHEEL_DIRECTION : effect->direction,
+-		U16_MAX, pidff->effect_direction);
++	pidff_set_effect_direction(pidff, effect);
+ 
+ 	/* Omit setting delay field if it's missing */
+ 	if (!(pidff->quirks & HID_PIDFF_QUIRK_MISSING_DELAY))
+diff --git a/drivers/hid/usbhid/hid-pidff.h b/drivers/hid/usbhid/hid-pidff.h
+index a53a8b436baa6..f321f675e1318 100644
+--- a/drivers/hid/usbhid/hid-pidff.h
++++ b/drivers/hid/usbhid/hid-pidff.h
+@@ -16,7 +16,7 @@
+ #define HID_PIDFF_QUIRK_PERMISSIVE_CONTROL	BIT(2)
+ 
+ /* Use fixed 0x4000 direction during SET_EFFECT report upload */
+-#define HID_PIDFF_QUIRK_FIX_WHEEL_DIRECTION	BIT(3)
++#define HID_PIDFF_QUIRK_FIX_CONDITIONAL_DIRECTION	BIT(3)
+ 
+ /* Force all periodic effects to be uploaded as SINE */
+ #define HID_PIDFF_QUIRK_PERIODIC_SINE_ONLY	BIT(4)
+-- 
+2.51.0
+
diff --git a/queue-6.17/hinic3-fix-missing-napi-dev-in-netif_queue_set_napi.patch b/queue-6.17/hinic3-fix-missing-napi-dev-in-netif_queue_set_napi.patch
new file mode 100644
index 0000000000..3575dc6c3b
--- /dev/null
+++ b/queue-6.17/hinic3-fix-missing-napi-dev-in-netif_queue_set_napi.patch
@@ -0,0 +1,44 @@
+From 25de2eac9d37f797cd9b762079c940464863aa1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 14:28:30 +0800
+Subject: hinic3: Fix missing napi->dev in netif_queue_set_napi
+
+From: Fan Gong <gongfan1@huawei.com>
+
+[ Upstream commit 4404f6af810829588a51968959c6b85574109c13 ]
+
+As netif_queue_set_napi checks napi->dev, if it doesn't have it and
+it will warn_on and return. So we should use netif_napi_add before
+netif_queue_set_napi because netif_napi_add has "napi->dev = dev".
+
+Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com>
+Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com>
+Signed-off-by: Fan Gong <gongfan1@huawei.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/a17a5a087350eaf2e081dcd879779ca2c69b0908.1757653621.git.zhuyikai1@h-partners.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/huawei/hinic3/hinic3_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_irq.c b/drivers/net/ethernet/huawei/hinic3/hinic3_irq.c
+index 8b92eed25edfe..aba1a1d579c50 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_irq.c
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_irq.c
+@@ -42,11 +42,11 @@ void qp_add_napi(struct hinic3_irq_cfg *irq_cfg)
+ {
+ 	struct hinic3_nic_dev *nic_dev = netdev_priv(irq_cfg->netdev);
+ 
++	netif_napi_add(nic_dev->netdev, &irq_cfg->napi, hinic3_poll);
+ 	netif_queue_set_napi(irq_cfg->netdev, irq_cfg->irq_id,
+ 			     NETDEV_QUEUE_TYPE_RX, &irq_cfg->napi);
+ 	netif_queue_set_napi(irq_cfg->netdev, irq_cfg->irq_id,
+ 			     NETDEV_QUEUE_TYPE_TX, &irq_cfg->napi);
+-	netif_napi_add(nic_dev->netdev, &irq_cfg->napi, hinic3_poll);
+ 	napi_enable(&irq_cfg->napi);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/hinic3-queue-pair-endianness-improvements.patch b/queue-6.17/hinic3-queue-pair-endianness-improvements.patch
new file mode 100644
index 0000000000..85c4a73b06
--- /dev/null
+++ b/queue-6.17/hinic3-queue-pair-endianness-improvements.patch
@@ -0,0 +1,376 @@
+From e507389f10232ae259c178ede1f38d8bf85b958c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 14:28:24 +0800
+Subject: hinic3: Queue pair endianness improvements
+
+From: Fan Gong <gongfan1@huawei.com>
+
+[ Upstream commit 6b822b658aafe840ffd6d7f1af5bf4f77df15a11 ]
+
+Explicitly use little-endian & big-endian structs to support big
+endian hosts.
+
+Co-developed-by: Zhu Yikai <zhuyikai1@h-partners.com>
+Signed-off-by: Zhu Yikai <zhuyikai1@h-partners.com>
+Signed-off-by: Fan Gong <gongfan1@huawei.com>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/9b995a10f1e209a878bf98e4e1cdfb926f386695.1757653621.git.zhuyikai1@h-partners.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/huawei/hinic3/hinic3_nic_io.h    | 15 ++--
+ .../net/ethernet/huawei/hinic3/hinic3_rx.c    | 10 +--
+ .../net/ethernet/huawei/hinic3/hinic3_rx.h    | 24 +++---
+ .../net/ethernet/huawei/hinic3/hinic3_tx.c    | 81 ++++++++++---------
+ .../net/ethernet/huawei/hinic3/hinic3_tx.h    | 18 ++---
+ 5 files changed, 79 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h
+index 865ba6878c483..1808d37e7cf71 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h
+@@ -75,8 +75,8 @@ static inline u16 hinic3_get_sq_hw_ci(const struct hinic3_io_queue *sq)
+ #define DB_CFLAG_DP_RQ   1
+ 
+ struct hinic3_nic_db {
+-	u32 db_info;
+-	u32 pi_hi;
++	__le32 db_info;
++	__le32 pi_hi;
+ };
+ 
+ static inline void hinic3_write_db(struct hinic3_io_queue *queue, int cos,
+@@ -84,11 +84,12 @@ static inline void hinic3_write_db(struct hinic3_io_queue *queue, int cos,
+ {
+ 	struct hinic3_nic_db db;
+ 
+-	db.db_info = DB_INFO_SET(DB_SRC_TYPE, TYPE) |
+-		     DB_INFO_SET(cflag, CFLAG) |
+-		     DB_INFO_SET(cos, COS) |
+-		     DB_INFO_SET(queue->q_id, QID);
+-	db.pi_hi = DB_PI_HIGH(pi);
++	db.db_info =
++		cpu_to_le32(DB_INFO_SET(DB_SRC_TYPE, TYPE) |
++			    DB_INFO_SET(cflag, CFLAG) |
++			    DB_INFO_SET(cos, COS) |
++			    DB_INFO_SET(queue->q_id, QID));
++	db.pi_hi = cpu_to_le32(DB_PI_HIGH(pi));
+ 
+ 	writeq(*((u64 *)&db), DB_ADDR(queue, pi));
+ }
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_rx.c b/drivers/net/ethernet/huawei/hinic3/hinic3_rx.c
+index 860163e9d66cf..ac04e3a192ada 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_rx.c
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_rx.c
+@@ -66,8 +66,8 @@ static void rq_wqe_buf_set(struct hinic3_io_queue *rq, uint32_t wqe_idx,
+ 	struct hinic3_rq_wqe *rq_wqe;
+ 
+ 	rq_wqe = get_q_element(&rq->wq.qpages, wqe_idx, NULL);
+-	rq_wqe->buf_hi_addr = upper_32_bits(dma_addr);
+-	rq_wqe->buf_lo_addr = lower_32_bits(dma_addr);
++	rq_wqe->buf_hi_addr = cpu_to_le32(upper_32_bits(dma_addr));
++	rq_wqe->buf_lo_addr = cpu_to_le32(lower_32_bits(dma_addr));
+ }
+ 
+ static u32 hinic3_rx_fill_buffers(struct hinic3_rxq *rxq)
+@@ -279,7 +279,7 @@ static int recv_one_pkt(struct hinic3_rxq *rxq, struct hinic3_rq_cqe *rx_cqe,
+ 	if (skb_is_nonlinear(skb))
+ 		hinic3_pull_tail(skb);
+ 
+-	offload_type = rx_cqe->offload_type;
++	offload_type = le32_to_cpu(rx_cqe->offload_type);
+ 	hinic3_rx_csum(rxq, offload_type, status, skb);
+ 
+ 	num_lro = RQ_CQE_STATUS_GET(status, NUM_LRO);
+@@ -311,14 +311,14 @@ int hinic3_rx_poll(struct hinic3_rxq *rxq, int budget)
+ 	while (likely(nr_pkts < budget)) {
+ 		sw_ci = rxq->cons_idx & rxq->q_mask;
+ 		rx_cqe = rxq->cqe_arr + sw_ci;
+-		status = rx_cqe->status;
++		status = le32_to_cpu(rx_cqe->status);
+ 		if (!RQ_CQE_STATUS_GET(status, RXDONE))
+ 			break;
+ 
+ 		/* make sure we read rx_done before packet length */
+ 		rmb();
+ 
+-		vlan_len = rx_cqe->vlan_len;
++		vlan_len = le32_to_cpu(rx_cqe->vlan_len);
+ 		pkt_len = RQ_CQE_SGE_GET(vlan_len, LEN);
+ 		if (recv_one_pkt(rxq, rx_cqe, pkt_len, vlan_len, status))
+ 			break;
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_rx.h b/drivers/net/ethernet/huawei/hinic3/hinic3_rx.h
+index 1cca21858d40e..e7b496d13a697 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_rx.h
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_rx.h
+@@ -27,21 +27,21 @@
+ 
+ /* RX Completion information that is provided by HW for a specific RX WQE */
+ struct hinic3_rq_cqe {
+-	u32 status;
+-	u32 vlan_len;
+-	u32 offload_type;
+-	u32 rsvd3;
+-	u32 rsvd4;
+-	u32 rsvd5;
+-	u32 rsvd6;
+-	u32 pkt_info;
++	__le32 status;
++	__le32 vlan_len;
++	__le32 offload_type;
++	__le32 rsvd3;
++	__le32 rsvd4;
++	__le32 rsvd5;
++	__le32 rsvd6;
++	__le32 pkt_info;
+ };
+ 
+ struct hinic3_rq_wqe {
+-	u32 buf_hi_addr;
+-	u32 buf_lo_addr;
+-	u32 cqe_hi_addr;
+-	u32 cqe_lo_addr;
++	__le32 buf_hi_addr;
++	__le32 buf_lo_addr;
++	__le32 cqe_hi_addr;
++	__le32 cqe_lo_addr;
+ };
+ 
+ struct hinic3_rx_info {
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
+index 3f7f73430be41..dd8f362ded185 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
+@@ -81,10 +81,10 @@ static int hinic3_tx_map_skb(struct net_device *netdev, struct sk_buff *skb,
+ 
+ 	dma_info[0].len = skb_headlen(skb);
+ 
+-	wqe_desc->hi_addr = upper_32_bits(dma_info[0].dma);
+-	wqe_desc->lo_addr = lower_32_bits(dma_info[0].dma);
++	wqe_desc->hi_addr = cpu_to_le32(upper_32_bits(dma_info[0].dma));
++	wqe_desc->lo_addr = cpu_to_le32(lower_32_bits(dma_info[0].dma));
+ 
+-	wqe_desc->ctrl_len = dma_info[0].len;
++	wqe_desc->ctrl_len = cpu_to_le32(dma_info[0].len);
+ 
+ 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+ 		frag = &(skb_shinfo(skb)->frags[i]);
+@@ -197,7 +197,8 @@ static int hinic3_tx_csum(struct hinic3_txq *txq, struct hinic3_sq_task *task,
+ 		union hinic3_ip ip;
+ 		u8 l4_proto;
+ 
+-		task->pkt_info0 |= SQ_TASK_INFO0_SET(1, TUNNEL_FLAG);
++		task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1,
++								 TUNNEL_FLAG));
+ 
+ 		ip.hdr = skb_network_header(skb);
+ 		if (ip.v4->version == 4) {
+@@ -226,7 +227,7 @@ static int hinic3_tx_csum(struct hinic3_txq *txq, struct hinic3_sq_task *task,
+ 		}
+ 	}
+ 
+-	task->pkt_info0 |= SQ_TASK_INFO0_SET(1, INNER_L4_EN);
++	task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1, INNER_L4_EN));
+ 
+ 	return 1;
+ }
+@@ -255,26 +256,28 @@ static void get_inner_l3_l4_type(struct sk_buff *skb, union hinic3_ip *ip,
+ 	}
+ }
+ 
+-static void hinic3_set_tso_info(struct hinic3_sq_task *task, u32 *queue_info,
++static void hinic3_set_tso_info(struct hinic3_sq_task *task, __le32 *queue_info,
+ 				enum hinic3_l4_offload_type l4_offload,
+ 				u32 offset, u32 mss)
+ {
+ 	if (l4_offload == HINIC3_L4_OFFLOAD_TCP) {
+-		*queue_info |= SQ_CTRL_QUEUE_INFO_SET(1, TSO);
+-		task->pkt_info0 |= SQ_TASK_INFO0_SET(1, INNER_L4_EN);
++		*queue_info |= cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(1, TSO));
++		task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1,
++								 INNER_L4_EN));
+ 	} else if (l4_offload == HINIC3_L4_OFFLOAD_UDP) {
+-		*queue_info |= SQ_CTRL_QUEUE_INFO_SET(1, UFO);
+-		task->pkt_info0 |= SQ_TASK_INFO0_SET(1, INNER_L4_EN);
++		*queue_info |= cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(1, UFO));
++		task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1,
++								 INNER_L4_EN));
+ 	}
+ 
+ 	/* enable L3 calculation */
+-	task->pkt_info0 |= SQ_TASK_INFO0_SET(1, INNER_L3_EN);
++	task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1, INNER_L3_EN));
+ 
+-	*queue_info |= SQ_CTRL_QUEUE_INFO_SET(offset >> 1, PLDOFF);
++	*queue_info |= cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(offset >> 1, PLDOFF));
+ 
+ 	/* set MSS value */
+-	*queue_info &= ~SQ_CTRL_QUEUE_INFO_MSS_MASK;
+-	*queue_info |= SQ_CTRL_QUEUE_INFO_SET(mss, MSS);
++	*queue_info &= cpu_to_le32(~SQ_CTRL_QUEUE_INFO_MSS_MASK);
++	*queue_info |= cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(mss, MSS));
+ }
+ 
+ static __sum16 csum_magic(union hinic3_ip *ip, unsigned short proto)
+@@ -284,7 +287,7 @@ static __sum16 csum_magic(union hinic3_ip *ip, unsigned short proto)
+ 		csum_ipv6_magic(&ip->v6->saddr, &ip->v6->daddr, 0, proto, 0);
+ }
+ 
+-static int hinic3_tso(struct hinic3_sq_task *task, u32 *queue_info,
++static int hinic3_tso(struct hinic3_sq_task *task, __le32 *queue_info,
+ 		      struct sk_buff *skb)
+ {
+ 	enum hinic3_l4_offload_type l4_offload;
+@@ -305,15 +308,17 @@ static int hinic3_tso(struct hinic3_sq_task *task, u32 *queue_info,
+ 	if (skb->encapsulation) {
+ 		u32 gso_type = skb_shinfo(skb)->gso_type;
+ 		/* L3 checksum is always enabled */
+-		task->pkt_info0 |= SQ_TASK_INFO0_SET(1, OUT_L3_EN);
+-		task->pkt_info0 |= SQ_TASK_INFO0_SET(1, TUNNEL_FLAG);
++		task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1, OUT_L3_EN));
++		task->pkt_info0 |= cpu_to_le32(SQ_TASK_INFO0_SET(1,
++								 TUNNEL_FLAG));
+ 
+ 		l4.hdr = skb_transport_header(skb);
+ 		ip.hdr = skb_network_header(skb);
+ 
+ 		if (gso_type & SKB_GSO_UDP_TUNNEL_CSUM) {
+ 			l4.udp->check = ~csum_magic(&ip, IPPROTO_UDP);
+-			task->pkt_info0 |= SQ_TASK_INFO0_SET(1, OUT_L4_EN);
++			task->pkt_info0 |=
++				cpu_to_le32(SQ_TASK_INFO0_SET(1, OUT_L4_EN));
+ 		}
+ 
+ 		ip.hdr = skb_inner_network_header(skb);
+@@ -343,13 +348,14 @@ static void hinic3_set_vlan_tx_offload(struct hinic3_sq_task *task,
+ 	 * 2=select TPID2 in IPSU, 3=select TPID3 in IPSU,
+ 	 * 4=select TPID4 in IPSU
+ 	 */
+-	task->vlan_offload = SQ_TASK_INFO3_SET(vlan_tag, VLAN_TAG) |
+-			     SQ_TASK_INFO3_SET(vlan_tpid, VLAN_TPID) |
+-			     SQ_TASK_INFO3_SET(1, VLAN_TAG_VALID);
++	task->vlan_offload =
++		cpu_to_le32(SQ_TASK_INFO3_SET(vlan_tag, VLAN_TAG) |
++			    SQ_TASK_INFO3_SET(vlan_tpid, VLAN_TPID) |
++			    SQ_TASK_INFO3_SET(1, VLAN_TAG_VALID));
+ }
+ 
+ static u32 hinic3_tx_offload(struct sk_buff *skb, struct hinic3_sq_task *task,
+-			     u32 *queue_info, struct hinic3_txq *txq)
++			     __le32 *queue_info, struct hinic3_txq *txq)
+ {
+ 	u32 offload = 0;
+ 	int tso_cs_en;
+@@ -440,39 +446,41 @@ static u16 hinic3_set_wqe_combo(struct hinic3_txq *txq,
+ }
+ 
+ static void hinic3_prepare_sq_ctrl(struct hinic3_sq_wqe_combo *wqe_combo,
+-				   u32 queue_info, int nr_descs, u16 owner)
++				   __le32 queue_info, int nr_descs, u16 owner)
+ {
+ 	struct hinic3_sq_wqe_desc *wqe_desc = wqe_combo->ctrl_bd0;
+ 
+ 	if (wqe_combo->wqe_type == SQ_WQE_COMPACT_TYPE) {
+ 		wqe_desc->ctrl_len |=
+-		    SQ_CTRL_SET(SQ_NORMAL_WQE, DATA_FORMAT) |
+-		    SQ_CTRL_SET(wqe_combo->wqe_type, EXTENDED) |
+-		    SQ_CTRL_SET(owner, OWNER);
++			cpu_to_le32(SQ_CTRL_SET(SQ_NORMAL_WQE, DATA_FORMAT) |
++				    SQ_CTRL_SET(wqe_combo->wqe_type, EXTENDED) |
++				    SQ_CTRL_SET(owner, OWNER));
+ 
+ 		/* compact wqe queue_info will transfer to chip */
+ 		wqe_desc->queue_info = 0;
+ 		return;
+ 	}
+ 
+-	wqe_desc->ctrl_len |= SQ_CTRL_SET(nr_descs, BUFDESC_NUM) |
+-			      SQ_CTRL_SET(wqe_combo->task_type, TASKSECT_LEN) |
+-			      SQ_CTRL_SET(SQ_NORMAL_WQE, DATA_FORMAT) |
+-			      SQ_CTRL_SET(wqe_combo->wqe_type, EXTENDED) |
+-			      SQ_CTRL_SET(owner, OWNER);
++	wqe_desc->ctrl_len |=
++		cpu_to_le32(SQ_CTRL_SET(nr_descs, BUFDESC_NUM) |
++			    SQ_CTRL_SET(wqe_combo->task_type, TASKSECT_LEN) |
++			    SQ_CTRL_SET(SQ_NORMAL_WQE, DATA_FORMAT) |
++			    SQ_CTRL_SET(wqe_combo->wqe_type, EXTENDED) |
++			    SQ_CTRL_SET(owner, OWNER));
+ 
+ 	wqe_desc->queue_info = queue_info;
+-	wqe_desc->queue_info |= SQ_CTRL_QUEUE_INFO_SET(1, UC);
++	wqe_desc->queue_info |= cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(1, UC));
+ 
+ 	if (!SQ_CTRL_QUEUE_INFO_GET(wqe_desc->queue_info, MSS)) {
+ 		wqe_desc->queue_info |=
+-		    SQ_CTRL_QUEUE_INFO_SET(HINIC3_TX_MSS_DEFAULT, MSS);
++		    cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(HINIC3_TX_MSS_DEFAULT, MSS));
+ 	} else if (SQ_CTRL_QUEUE_INFO_GET(wqe_desc->queue_info, MSS) <
+ 		   HINIC3_TX_MSS_MIN) {
+ 		/* mss should not be less than 80 */
+-		wqe_desc->queue_info &= ~SQ_CTRL_QUEUE_INFO_MSS_MASK;
++		wqe_desc->queue_info &=
++		    cpu_to_le32(~SQ_CTRL_QUEUE_INFO_MSS_MASK);
+ 		wqe_desc->queue_info |=
+-		    SQ_CTRL_QUEUE_INFO_SET(HINIC3_TX_MSS_MIN, MSS);
++		    cpu_to_le32(SQ_CTRL_QUEUE_INFO_SET(HINIC3_TX_MSS_MIN, MSS));
+ 	}
+ }
+ 
+@@ -482,12 +490,13 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *skb,
+ {
+ 	struct hinic3_sq_wqe_combo wqe_combo = {};
+ 	struct hinic3_tx_info *tx_info;
+-	u32 offload, queue_info = 0;
+ 	struct hinic3_sq_task task;
+ 	u16 wqebb_cnt, num_sge;
++	__le32 queue_info = 0;
+ 	u16 saved_wq_prod_idx;
+ 	u16 owner, pi = 0;
+ 	u8 saved_sq_owner;
++	u32 offload;
+ 	int err;
+ 
+ 	if (unlikely(skb->len < MIN_SKB_LEN)) {
+diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.h b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.h
+index 9e505cc19dd55..21dfe879a29a2 100644
+--- a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.h
++++ b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.h
+@@ -58,7 +58,7 @@ enum hinic3_tx_offload_type {
+ #define SQ_CTRL_QUEUE_INFO_SET(val, member) \
+ 	FIELD_PREP(SQ_CTRL_QUEUE_INFO_##member##_MASK, val)
+ #define SQ_CTRL_QUEUE_INFO_GET(val, member) \
+-	FIELD_GET(SQ_CTRL_QUEUE_INFO_##member##_MASK, val)
++	FIELD_GET(SQ_CTRL_QUEUE_INFO_##member##_MASK, le32_to_cpu(val))
+ 
+ #define SQ_CTRL_MAX_PLDOFF  221
+ 
+@@ -77,17 +77,17 @@ enum hinic3_tx_offload_type {
+ 	FIELD_PREP(SQ_TASK_INFO3_##member##_MASK, val)
+ 
+ struct hinic3_sq_wqe_desc {
+-	u32 ctrl_len;
+-	u32 queue_info;
+-	u32 hi_addr;
+-	u32 lo_addr;
++	__le32 ctrl_len;
++	__le32 queue_info;
++	__le32 hi_addr;
++	__le32 lo_addr;
+ };
+ 
+ struct hinic3_sq_task {
+-	u32 pkt_info0;
+-	u32 ip_identify;
+-	u32 rsvd;
+-	u32 vlan_offload;
++	__le32 pkt_info0;
++	__le32 ip_identify;
++	__le32 rsvd;
++	__le32 vlan_offload;
+ };
+ 
+ struct hinic3_sq_wqe_combo {
+-- 
+2.51.0
+
diff --git a/queue-6.17/hwrng-timeriomem-use-us_to_ktime-where-appropriate.patch b/queue-6.17/hwrng-timeriomem-use-us_to_ktime-where-appropriate.patch
new file mode 100644
index 0000000000..84d78d6ef0
--- /dev/null
+++ b/queue-6.17/hwrng-timeriomem-use-us_to_ktime-where-appropriate.patch
@@ -0,0 +1,35 @@
+From 38c5711737511d03ec535e7aca9f5bb823d86381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 20:17:27 +0800
+Subject: hwrng: timeriomem - Use us_to_ktime() where appropriate
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit 817fcdbd4ca29834014a5dadbe8e11efeb12800c ]
+
+It is better to replace ns_to_ktime() with us_to_ktime(),
+which can make the code clearer.
+
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/timeriomem-rng.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hw_random/timeriomem-rng.c b/drivers/char/hw_random/timeriomem-rng.c
+index b95f6d0f17ede..e61f063932090 100644
+--- a/drivers/char/hw_random/timeriomem-rng.c
++++ b/drivers/char/hw_random/timeriomem-rng.c
+@@ -150,7 +150,7 @@ static int timeriomem_rng_probe(struct platform_device *pdev)
+ 		priv->rng_ops.quality = pdata->quality;
+ 	}
+ 
+-	priv->period = ns_to_ktime(period * NSEC_PER_USEC);
++	priv->period = us_to_ktime(period);
+ 	init_completion(&priv->completion);
+ 	hrtimer_setup(&priv->timer, timeriomem_rng_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/ib-ipoib-ignore-l3-master-device.patch b/queue-6.17/ib-ipoib-ignore-l3-master-device.patch
new file mode 100644
index 0000000000..ef35413ecb
--- /dev/null
+++ b/queue-6.17/ib-ipoib-ignore-l3-master-device.patch
@@ -0,0 +1,97 @@
+From 00b33bd9f2da1093fc773bd7b974c496625a2214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:11:03 +0300
+Subject: IB/ipoib: Ignore L3 master device
+
+From: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+
+[ Upstream commit 42f993d3439827c4959ea77e60620d7ebfb3a477 ]
+
+Currently, all master upper netdevices (e.g., bond, VRF) are treated
+equally.
+
+When a VRF netdevice is used over an IPoIB netdevice, the expected
+netdev resolution is on the lower IPoIB device which has the IP address
+assigned to it and not the VRF device.
+
+The rdma_cm module (CMA) tries to match incoming requests to a
+particular netdevice. When successful, it also validates that the return
+path points to the same device by performing a routing table lookup.
+Currently, the former would resolve to the VRF netdevice, while the
+latter to the correct lower IPoIB netdevice, leading to failure in
+rdma_cm.
+
+Improve this by ignoring the VRF master netdevice, if it exists, and
+instead return the lower IPoIB device.
+
+Signed-off-by: Vlad Dumitrescu <vdumitrescu@nvidia.com>
+Reviewed-by: Parav Pandit <parav@nvidia.com>
+Signed-off-by: Edward Srouji <edwards@nvidia.com>
+Link: https://patch.msgid.link/20250916111103.84069-5-edwards@nvidia.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 7acafc5c0e09a..5b4d76e97437d 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -351,26 +351,27 @@ static bool ipoib_is_dev_match_addr_rcu(const struct sockaddr *addr,
+ }
+ 
+ /*
+- * Find the master net_device on top of the given net_device.
++ * Find the L2 master net_device on top of the given net_device.
+  * @dev: base IPoIB net_device
+  *
+- * Returns the master net_device with a reference held, or the same net_device
+- * if no master exists.
++ * Returns the L2 master net_device with reference held if the L2 master
++ * exists (such as bond netdevice), or returns same netdev with reference
++ * held when master does not exist or when L3 master (such as VRF netdev).
+  */
+ static struct net_device *ipoib_get_master_net_dev(struct net_device *dev)
+ {
+ 	struct net_device *master;
+ 
+ 	rcu_read_lock();
++
+ 	master = netdev_master_upper_dev_get_rcu(dev);
++	if (!master || netif_is_l3_master(master))
++		master = dev;
++
+ 	dev_hold(master);
+ 	rcu_read_unlock();
+ 
+-	if (master)
+-		return master;
+-
+-	dev_hold(dev);
+-	return dev;
++	return master;
+ }
+ 
+ struct ipoib_walk_data {
+@@ -522,7 +523,7 @@ static struct net_device *ipoib_get_net_dev_by_params(
+ 	if (ret)
+ 		return NULL;
+ 
+-	/* See if we can find a unique device matching the L2 parameters */
++	/* See if we can find a unique device matching the pkey and GID */
+ 	matches = __ipoib_get_net_dev_by_params(dev_list, port, pkey_index,
+ 						gid, NULL, &net_dev);
+ 
+@@ -535,7 +536,7 @@ static struct net_device *ipoib_get_net_dev_by_params(
+ 
+ 	dev_put(net_dev);
+ 
+-	/* Couldn't find a unique device with L2 parameters only. Use L3
++	/* Couldn't find a unique device with pkey and GID only. Use L3
+ 	 * address to uniquely match the net device */
+ 	matches = __ipoib_get_net_dev_by_params(dev_list, port, pkey_index,
+ 						gid, addr, &net_dev);
+-- 
+2.51.0
+
diff --git a/queue-6.17/ice-don-t-use-pk-through-printk-or-tracepoints.patch b/queue-6.17/ice-don-t-use-pk-through-printk-or-tracepoints.patch
new file mode 100644
index 0000000000..abaeff6947
--- /dev/null
+++ b/queue-6.17/ice-don-t-use-pk-through-printk-or-tracepoints.patch
@@ -0,0 +1,104 @@
+From 9aa12b349e05f165d944208314e6cd75d1c20016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:43:18 +0200
+Subject: ice: Don't use %pK through printk or tracepoints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c  |  2 +-
+ drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index 77781277aa8e4..92b95d92d5992 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -9125,7 +9125,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)
+ 		list_add_tail(&ch->list, &vsi->ch_list);
+ 		vsi->tc_map_vsi[i] = ch->ch_vsi;
+ 		dev_dbg(ice_pf_to_dev(pf),
+-			"successfully created channel: VSI %pK\n", ch->ch_vsi);
++			"successfully created channel: VSI %p\n", ch->ch_vsi);
+ 	}
+ 	return 0;
+ 
+diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
+index 07aab6e130cd5..4f35ef8d6b299 100644
+--- a/drivers/net/ethernet/intel/ice/ice_trace.h
++++ b/drivers/net/ethernet/intel/ice/ice_trace.h
+@@ -130,7 +130,7 @@ DECLARE_EVENT_CLASS(ice_tx_template,
+ 				   __entry->buf = buf;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->buf)
+ );
+ 
+@@ -158,7 +158,7 @@ DECLARE_EVENT_CLASS(ice_rx_template,
+ 				   __entry->desc = desc;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc)
+ );
+ DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
+@@ -182,7 +182,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->skb)
+ );
+ 
+@@ -205,7 +205,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname);),
+ 
+-		    TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname),
++		    TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname),
+ 			      __entry->skb, __entry->ring)
+ );
+ 
+@@ -228,7 +228,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template,
+ 		    TP_fast_assign(__entry->skb = skb;
+ 				   __entry->idx = idx;),
+ 
+-		    TP_printk("skb %pK idx %d",
++		    TP_printk("skb %p idx %d",
+ 			      __entry->skb, __entry->idx)
+ );
+ #define DEFINE_TX_TSTAMP_OP_EVENT(name) \
+-- 
+2.51.0
+
diff --git a/queue-6.17/idpf-do-not-linearize-big-tso-packets.patch b/queue-6.17/idpf-do-not-linearize-big-tso-packets.patch
new file mode 100644
index 0000000000..b84d0aef62
--- /dev/null
+++ b/queue-6.17/idpf-do-not-linearize-big-tso-packets.patch
@@ -0,0 +1,345 @@
+From 1779b251b772f937aa4712cb00a331168b6e3050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 19:59:34 +0000
+Subject: idpf: do not linearize big TSO packets
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 02614eee26fbdfd73b944769001cefeff6ed008c ]
+
+idpf has a limit on number of scatter-gather frags
+that can be used per segment.
+
+Currently, idpf_tx_start() checks if the limit is hit
+and forces a linearization of the whole packet.
+
+This requires high order allocations that can fail
+under memory pressure. A full size BIG-TCP packet
+would require order-7 alocation on x86_64 :/
+
+We can move the check earlier from idpf_features_check()
+for TSO packets, to force GSO in this case, removing the
+cost of a big copy.
+
+This means that a linearization will eventually happen
+with sizes smaller than one MSS.
+
+__idpf_chk_linearize() is renamed to idpf_chk_tso_segment()
+and moved to idpf_lib.c
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Cc: Jacob Keller <jacob.e.keller@intel.com>
+Cc: Madhu Chittim <madhu.chittim@intel.com>
+Cc: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Cc: Andrew Lunn <andrew+netdev@lunn.ch>
+Reviewed-by: Joshua Hay <joshua.a.hay@intel.com>
+Tested-by: Brian Vazquez <brianvv@google.com>
+Acked-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Link: https://patch.msgid.link/20250818195934.757936-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf.h      |   2 +
+ drivers/net/ethernet/intel/idpf/idpf_lib.c  | 102 +++++++++++++++-
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 129 ++++----------------
+ 3 files changed, 120 insertions(+), 113 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
+index f4c0eaf9bde33..aafbb280c2e73 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf.h
++++ b/drivers/net/ethernet/intel/idpf/idpf.h
+@@ -148,6 +148,7 @@ enum idpf_vport_state {
+  * @link_speed_mbps: Link speed in mbps
+  * @vport_idx: Relative vport index
+  * @max_tx_hdr_size: Max header length hardware can support
++ * @tx_max_bufs: Max buffers that can be transmitted with scatter-gather
+  * @state: See enum idpf_vport_state
+  * @netstats: Packet and byte stats
+  * @stats_lock: Lock to protect stats update
+@@ -159,6 +160,7 @@ struct idpf_netdev_priv {
+ 	u32 link_speed_mbps;
+ 	u16 vport_idx;
+ 	u16 max_tx_hdr_size;
++	u16 tx_max_bufs;
+ 	enum idpf_vport_state state;
+ 	struct rtnl_link_stats64 netstats;
+ 	spinlock_t stats_lock;
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index 513032cb5f088..e327950c93d8e 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -776,6 +776,7 @@ static int idpf_cfg_netdev(struct idpf_vport *vport)
+ 	np->vport_idx = vport->idx;
+ 	np->vport_id = vport->vport_id;
+ 	np->max_tx_hdr_size = idpf_get_max_tx_hdr_size(adapter);
++	np->tx_max_bufs = idpf_get_max_tx_bufs(adapter);
+ 
+ 	spin_lock_init(&np->stats_lock);
+ 
+@@ -2271,6 +2272,92 @@ static int idpf_change_mtu(struct net_device *netdev, int new_mtu)
+ 	return err;
+ }
+ 
++/**
++ * idpf_chk_tso_segment - Check skb is not using too many buffers
++ * @skb: send buffer
++ * @max_bufs: maximum number of buffers
++ *
++ * For TSO we need to count the TSO header and segment payload separately.  As
++ * such we need to check cases where we have max_bufs-1 fragments or more as we
++ * can potentially require max_bufs+1 DMA transactions, 1 for the TSO header, 1
++ * for the segment payload in the first descriptor, and another max_buf-1 for
++ * the fragments.
++ *
++ * Returns true if the packet needs to be software segmented by core stack.
++ */
++static bool idpf_chk_tso_segment(const struct sk_buff *skb,
++				 unsigned int max_bufs)
++{
++	const struct skb_shared_info *shinfo = skb_shinfo(skb);
++	const skb_frag_t *frag, *stale;
++	int nr_frags, sum;
++
++	/* no need to check if number of frags is less than max_bufs - 1 */
++	nr_frags = shinfo->nr_frags;
++	if (nr_frags < (max_bufs - 1))
++		return false;
++
++	/* We need to walk through the list and validate that each group
++	 * of max_bufs-2 fragments totals at least gso_size.
++	 */
++	nr_frags -= max_bufs - 2;
++	frag = &shinfo->frags[0];
++
++	/* Initialize size to the negative value of gso_size minus 1.  We use
++	 * this as the worst case scenario in which the frag ahead of us only
++	 * provides one byte which is why we are limited to max_bufs-2
++	 * descriptors for a single transmit as the header and previous
++	 * fragment are already consuming 2 descriptors.
++	 */
++	sum = 1 - shinfo->gso_size;
++
++	/* Add size of frags 0 through 4 to create our initial sum */
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++	sum += skb_frag_size(frag++);
++
++	/* Walk through fragments adding latest fragment, testing it, and
++	 * then removing stale fragments from the sum.
++	 */
++	for (stale = &shinfo->frags[0];; stale++) {
++		int stale_size = skb_frag_size(stale);
++
++		sum += skb_frag_size(frag++);
++
++		/* The stale fragment may present us with a smaller
++		 * descriptor than the actual fragment size. To account
++		 * for that we need to remove all the data on the front and
++		 * figure out what the remainder would be in the last
++		 * descriptor associated with the fragment.
++		 */
++		if (stale_size > IDPF_TX_MAX_DESC_DATA) {
++			int align_pad = -(skb_frag_off(stale)) &
++					(IDPF_TX_MAX_READ_REQ_SIZE - 1);
++
++			sum -= align_pad;
++			stale_size -= align_pad;
++
++			do {
++				sum -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
++				stale_size -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
++			} while (stale_size > IDPF_TX_MAX_DESC_DATA);
++		}
++
++		/* if sum is negative we failed to make sufficient progress */
++		if (sum < 0)
++			return true;
++
++		if (!nr_frags--)
++			break;
++
++		sum -= stale_size;
++	}
++
++	return false;
++}
++
+ /**
+  * idpf_features_check - Validate packet conforms to limits
+  * @skb: skb buffer
+@@ -2292,12 +2379,15 @@ static netdev_features_t idpf_features_check(struct sk_buff *skb,
+ 	if (skb->ip_summed != CHECKSUM_PARTIAL)
+ 		return features;
+ 
+-	/* We cannot support GSO if the MSS is going to be less than
+-	 * 88 bytes. If it is then we need to drop support for GSO.
+-	 */
+-	if (skb_is_gso(skb) &&
+-	    (skb_shinfo(skb)->gso_size < IDPF_TX_TSO_MIN_MSS))
+-		features &= ~NETIF_F_GSO_MASK;
++	if (skb_is_gso(skb)) {
++		/* We cannot support GSO if the MSS is going to be less than
++		 * 88 bytes. If it is then we need to drop support for GSO.
++		 */
++		if (skb_shinfo(skb)->gso_size < IDPF_TX_TSO_MIN_MSS)
++			features &= ~NETIF_F_GSO_MASK;
++		else if (idpf_chk_tso_segment(skb, np->tx_max_bufs))
++			features &= ~NETIF_F_GSO_MASK;
++	}
+ 
+ 	/* Ensure MACLEN is <= 126 bytes (63 words) and not an odd size */
+ 	len = skb_network_offset(skb);
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index 50f90ed3107ec..e75a94d7ac2ac 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -11,8 +11,28 @@
+ #define idpf_tx_buf_next(buf)		(*(u32 *)&(buf)->priv)
+ LIBETH_SQE_CHECK_PRIV(u32);
+ 
+-static bool idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs,
+-			       unsigned int count);
++/**
++ * idpf_chk_linearize - Check if skb exceeds max descriptors per packet
++ * @skb: send buffer
++ * @max_bufs: maximum scatter gather buffers for single packet
++ * @count: number of buffers this packet needs
++ *
++ * Make sure we don't exceed maximum scatter gather buffers for a single
++ * packet.
++ * TSO case has been handled earlier from idpf_features_check().
++ */
++static bool idpf_chk_linearize(const struct sk_buff *skb,
++			       unsigned int max_bufs,
++			       unsigned int count)
++{
++	if (likely(count <= max_bufs))
++		return false;
++
++	if (skb_is_gso(skb))
++		return false;
++
++	return true;
++}
+ 
+ /**
+  * idpf_tx_timeout - Respond to a Tx Hang
+@@ -2397,111 +2417,6 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
+ 	return 1;
+ }
+ 
+-/**
+- * __idpf_chk_linearize - Check skb is not using too many buffers
+- * @skb: send buffer
+- * @max_bufs: maximum number of buffers
+- *
+- * For TSO we need to count the TSO header and segment payload separately.  As
+- * such we need to check cases where we have max_bufs-1 fragments or more as we
+- * can potentially require max_bufs+1 DMA transactions, 1 for the TSO header, 1
+- * for the segment payload in the first descriptor, and another max_buf-1 for
+- * the fragments.
+- */
+-static bool __idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs)
+-{
+-	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	const skb_frag_t *frag, *stale;
+-	int nr_frags, sum;
+-
+-	/* no need to check if number of frags is less than max_bufs - 1 */
+-	nr_frags = shinfo->nr_frags;
+-	if (nr_frags < (max_bufs - 1))
+-		return false;
+-
+-	/* We need to walk through the list and validate that each group
+-	 * of max_bufs-2 fragments totals at least gso_size.
+-	 */
+-	nr_frags -= max_bufs - 2;
+-	frag = &shinfo->frags[0];
+-
+-	/* Initialize size to the negative value of gso_size minus 1.  We use
+-	 * this as the worst case scenario in which the frag ahead of us only
+-	 * provides one byte which is why we are limited to max_bufs-2
+-	 * descriptors for a single transmit as the header and previous
+-	 * fragment are already consuming 2 descriptors.
+-	 */
+-	sum = 1 - shinfo->gso_size;
+-
+-	/* Add size of frags 0 through 4 to create our initial sum */
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-	sum += skb_frag_size(frag++);
+-
+-	/* Walk through fragments adding latest fragment, testing it, and
+-	 * then removing stale fragments from the sum.
+-	 */
+-	for (stale = &shinfo->frags[0];; stale++) {
+-		int stale_size = skb_frag_size(stale);
+-
+-		sum += skb_frag_size(frag++);
+-
+-		/* The stale fragment may present us with a smaller
+-		 * descriptor than the actual fragment size. To account
+-		 * for that we need to remove all the data on the front and
+-		 * figure out what the remainder would be in the last
+-		 * descriptor associated with the fragment.
+-		 */
+-		if (stale_size > IDPF_TX_MAX_DESC_DATA) {
+-			int align_pad = -(skb_frag_off(stale)) &
+-					(IDPF_TX_MAX_READ_REQ_SIZE - 1);
+-
+-			sum -= align_pad;
+-			stale_size -= align_pad;
+-
+-			do {
+-				sum -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
+-				stale_size -= IDPF_TX_MAX_DESC_DATA_ALIGNED;
+-			} while (stale_size > IDPF_TX_MAX_DESC_DATA);
+-		}
+-
+-		/* if sum is negative we failed to make sufficient progress */
+-		if (sum < 0)
+-			return true;
+-
+-		if (!nr_frags--)
+-			break;
+-
+-		sum -= stale_size;
+-	}
+-
+-	return false;
+-}
+-
+-/**
+- * idpf_chk_linearize - Check if skb exceeds max descriptors per packet
+- * @skb: send buffer
+- * @max_bufs: maximum scatter gather buffers for single packet
+- * @count: number of buffers this packet needs
+- *
+- * Make sure we don't exceed maximum scatter gather buffers for a single
+- * packet. We have to do some special checking around the boundary (max_bufs-1)
+- * if TSO is on since we need count the TSO header and payload separately.
+- * E.g.: a packet with 7 fragments can require 9 DMA transactions; 1 for TSO
+- * header, 1 for segment payload, and then 7 for the fragments.
+- */
+-static bool idpf_chk_linearize(struct sk_buff *skb, unsigned int max_bufs,
+-			       unsigned int count)
+-{
+-	if (likely(count < max_bufs))
+-		return false;
+-	if (skb_is_gso(skb))
+-		return __idpf_chk_linearize(skb, max_bufs);
+-
+-	return count > max_bufs;
+-}
+ 
+ /**
+  * idpf_tx_splitq_get_ctx_desc - grab next desc and update buffer ring
+-- 
+2.51.0
+
diff --git a/queue-6.17/idpf-link-napis-to-queues.patch b/queue-6.17/idpf-link-napis-to-queues.patch
new file mode 100644
index 0000000000..0b7a0df823
--- /dev/null
+++ b/queue-6.17/idpf-link-napis-to-queues.patch
@@ -0,0 +1,229 @@
+From 63c1b89d3f272b1afbbe09abaf4a4472988b7bff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:54:58 +0200
+Subject: idpf: link NAPIs to queues
+
+From: Alexander Lobakin <aleksander.lobakin@intel.com>
+
+[ Upstream commit bd74a86bc75d35adefbebcec7c3a743d02c06230 ]
+
+Add the missing linking of NAPIs to netdev queues when enabling
+interrupt vectors in order to support NAPI configuration and
+interfaces requiring get_rx_queue()->napi to be set (like XSk
+busy polling).
+
+As currently, idpf_vport_{start,stop}() is called from several flows
+with inconsistent RTNL locking, we need to synchronize them to avoid
+runtime assertions. Notably:
+
+* idpf_{open,stop}() -- regular NDOs, RTNL is always taken;
+* idpf_initiate_soft_reset() -- usually called under RTNL;
+* idpf_init_task -- called from the init work, needs RTNL;
+* idpf_vport_dealloc -- called without RTNL taken, needs it.
+
+Expand common idpf_vport_{start,stop}() to take an additional bool
+telling whether we need to manually take the RTNL lock.
+
+Suggested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> # helper
+Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Tested-by: Ramu R <ramu.r@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/idpf/idpf_lib.c  | 38 +++++++++++++++------
+ drivers/net/ethernet/intel/idpf/idpf_txrx.c | 17 +++++++++
+ 2 files changed, 45 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+index e327950c93d8e..f4b89d222610f 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
+@@ -884,14 +884,18 @@ static void idpf_remove_features(struct idpf_vport *vport)
+ /**
+  * idpf_vport_stop - Disable a vport
+  * @vport: vport to disable
++ * @rtnl: whether to take RTNL lock
+  */
+-static void idpf_vport_stop(struct idpf_vport *vport)
++static void idpf_vport_stop(struct idpf_vport *vport, bool rtnl)
+ {
+ 	struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+ 
+ 	if (np->state <= __IDPF_VPORT_DOWN)
+ 		return;
+ 
++	if (rtnl)
++		rtnl_lock();
++
+ 	netif_carrier_off(vport->netdev);
+ 	netif_tx_disable(vport->netdev);
+ 
+@@ -913,6 +917,9 @@ static void idpf_vport_stop(struct idpf_vport *vport)
+ 	idpf_vport_queues_rel(vport);
+ 	idpf_vport_intr_rel(vport);
+ 	np->state = __IDPF_VPORT_DOWN;
++
++	if (rtnl)
++		rtnl_unlock();
+ }
+ 
+ /**
+@@ -936,7 +943,7 @@ static int idpf_stop(struct net_device *netdev)
+ 	idpf_vport_ctrl_lock(netdev);
+ 	vport = idpf_netdev_to_vport(netdev);
+ 
+-	idpf_vport_stop(vport);
++	idpf_vport_stop(vport, false);
+ 
+ 	idpf_vport_ctrl_unlock(netdev);
+ 
+@@ -1029,7 +1036,7 @@ static void idpf_vport_dealloc(struct idpf_vport *vport)
+ 	idpf_idc_deinit_vport_aux_device(vport->vdev_info);
+ 
+ 	idpf_deinit_mac_addr(vport);
+-	idpf_vport_stop(vport);
++	idpf_vport_stop(vport, true);
+ 
+ 	if (!test_bit(IDPF_HR_RESET_IN_PROG, adapter->flags))
+ 		idpf_decfg_netdev(vport);
+@@ -1370,8 +1377,9 @@ static void idpf_rx_init_buf_tail(struct idpf_vport *vport)
+ /**
+  * idpf_vport_open - Bring up a vport
+  * @vport: vport to bring up
++ * @rtnl: whether to take RTNL lock
+  */
+-static int idpf_vport_open(struct idpf_vport *vport)
++static int idpf_vport_open(struct idpf_vport *vport, bool rtnl)
+ {
+ 	struct idpf_netdev_priv *np = netdev_priv(vport->netdev);
+ 	struct idpf_adapter *adapter = vport->adapter;
+@@ -1381,6 +1389,9 @@ static int idpf_vport_open(struct idpf_vport *vport)
+ 	if (np->state != __IDPF_VPORT_DOWN)
+ 		return -EBUSY;
+ 
++	if (rtnl)
++		rtnl_lock();
++
+ 	/* we do not allow interface up just yet */
+ 	netif_carrier_off(vport->netdev);
+ 
+@@ -1388,7 +1399,7 @@ static int idpf_vport_open(struct idpf_vport *vport)
+ 	if (err) {
+ 		dev_err(&adapter->pdev->dev, "Failed to allocate interrupts for vport %u: %d\n",
+ 			vport->vport_id, err);
+-		return err;
++		goto err_rtnl_unlock;
+ 	}
+ 
+ 	err = idpf_vport_queues_alloc(vport);
+@@ -1475,6 +1486,9 @@ static int idpf_vport_open(struct idpf_vport *vport)
+ 		goto deinit_rss;
+ 	}
+ 
++	if (rtnl)
++		rtnl_unlock();
++
+ 	return 0;
+ 
+ deinit_rss:
+@@ -1492,6 +1506,10 @@ static int idpf_vport_open(struct idpf_vport *vport)
+ intr_rel:
+ 	idpf_vport_intr_rel(vport);
+ 
++err_rtnl_unlock:
++	if (rtnl)
++		rtnl_unlock();
++
+ 	return err;
+ }
+ 
+@@ -1572,7 +1590,7 @@ void idpf_init_task(struct work_struct *work)
+ 	np = netdev_priv(vport->netdev);
+ 	np->state = __IDPF_VPORT_DOWN;
+ 	if (test_and_clear_bit(IDPF_VPORT_UP_REQUESTED, vport_config->flags))
+-		idpf_vport_open(vport);
++		idpf_vport_open(vport, true);
+ 
+ 	/* Spawn and return 'idpf_init_task' work queue until all the
+ 	 * default vports are created
+@@ -1962,7 +1980,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ 		idpf_send_delete_queues_msg(vport);
+ 	} else {
+ 		set_bit(IDPF_VPORT_DEL_QUEUES, vport->flags);
+-		idpf_vport_stop(vport);
++		idpf_vport_stop(vport, false);
+ 	}
+ 
+ 	idpf_deinit_rss(vport);
+@@ -1992,7 +2010,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ 		goto err_open;
+ 
+ 	if (current_state == __IDPF_VPORT_UP)
+-		err = idpf_vport_open(vport);
++		err = idpf_vport_open(vport, false);
+ 
+ 	goto free_vport;
+ 
+@@ -2002,7 +2020,7 @@ int idpf_initiate_soft_reset(struct idpf_vport *vport,
+ 
+ err_open:
+ 	if (current_state == __IDPF_VPORT_UP)
+-		idpf_vport_open(vport);
++		idpf_vport_open(vport, false);
+ 
+ free_vport:
+ 	kfree(new_vport);
+@@ -2240,7 +2258,7 @@ static int idpf_open(struct net_device *netdev)
+ 	if (err)
+ 		goto unlock;
+ 
+-	err = idpf_vport_open(vport);
++	err = idpf_vport_open(vport, false);
+ 
+ unlock:
+ 	idpf_vport_ctrl_unlock(netdev);
+diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+index e75a94d7ac2ac..92634c4bb369a 100644
+--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
++++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+@@ -3430,6 +3430,20 @@ void idpf_vport_intr_rel(struct idpf_vport *vport)
+ 	vport->q_vectors = NULL;
+ }
+ 
++static void idpf_q_vector_set_napi(struct idpf_q_vector *q_vector, bool link)
++{
++	struct napi_struct *napi = link ? &q_vector->napi : NULL;
++	struct net_device *dev = q_vector->vport->netdev;
++
++	for (u32 i = 0; i < q_vector->num_rxq; i++)
++		netif_queue_set_napi(dev, q_vector->rx[i]->idx,
++				     NETDEV_QUEUE_TYPE_RX, napi);
++
++	for (u32 i = 0; i < q_vector->num_txq; i++)
++		netif_queue_set_napi(dev, q_vector->tx[i]->idx,
++				     NETDEV_QUEUE_TYPE_TX, napi);
++}
++
+ /**
+  * idpf_vport_intr_rel_irq - Free the IRQ association with the OS
+  * @vport: main vport structure
+@@ -3450,6 +3464,7 @@ static void idpf_vport_intr_rel_irq(struct idpf_vport *vport)
+ 		vidx = vport->q_vector_idxs[vector];
+ 		irq_num = adapter->msix_entries[vidx].vector;
+ 
++		idpf_q_vector_set_napi(q_vector, false);
+ 		kfree(free_irq(irq_num, q_vector));
+ 	}
+ }
+@@ -3637,6 +3652,8 @@ static int idpf_vport_intr_req_irq(struct idpf_vport *vport)
+ 				   "Request_irq failed, error: %d\n", err);
+ 			goto free_q_irqs;
+ 		}
++
++		idpf_q_vector_set_napi(q_vector, true);
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/iio-adc-ad7124-do-not-require-mclk.patch b/queue-6.17/iio-adc-ad7124-do-not-require-mclk.patch
new file mode 100644
index 0000000000..6bfdfea016
--- /dev/null
+++ b/queue-6.17/iio-adc-ad7124-do-not-require-mclk.patch
@@ -0,0 +1,128 @@
+From e972c0d704a955f889a4f4dd90a1f96859be585e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:54:53 -0500
+Subject: iio: adc: ad7124: do not require mclk
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit aead8e4cc04612f74c7277de137cc995df280829 ]
+
+Make the "mclk" clock optional in the ad7124 driver. The MCLK is an
+internal counter on the ADC, so it is not something that should be
+coming from the devicetree. However, existing users may be using this
+to essentially select the power mode of the ADC from the devicetree.
+In order to not break those users, we have to keep the existing "mclk"
+handling, but now it is optional.
+
+Now, when the "mclk" clock is omitted from the devicetree, the driver
+will default to the full power mode. Support for an external clock
+and dynamic power mode switching can be added later if needed.
+
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250828-iio-adc-ad7124-proper-clock-support-v3-2-0b317b4605e5@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7124.c | 62 ++++++++++++++++++++++++++++------------
+ 1 file changed, 44 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7124.c b/drivers/iio/adc/ad7124.c
+index 4d8c6bafd1c31..ed35d2a8bbf1b 100644
+--- a/drivers/iio/adc/ad7124.c
++++ b/drivers/iio/adc/ad7124.c
+@@ -174,7 +174,6 @@ struct ad7124_state {
+ 	struct ad_sigma_delta sd;
+ 	struct ad7124_channel *channels;
+ 	struct regulator *vref[4];
+-	struct clk *mclk;
+ 	unsigned int adc_control;
+ 	unsigned int num_channels;
+ 	struct mutex cfgs_lock; /* lock for configs access */
+@@ -254,7 +253,9 @@ static void ad7124_set_channel_odr(struct ad7124_state *st, unsigned int channel
+ {
+ 	unsigned int fclk, odr_sel_bits;
+ 
+-	fclk = clk_get_rate(st->mclk);
++	fclk = ad7124_master_clk_freq_hz[FIELD_GET(AD7124_ADC_CONTROL_POWER_MODE,
++						   st->adc_control)];
++
+ 	/*
+ 	 * FS[10:0] = fCLK / (fADC x 32) where:
+ 	 * fADC is the output data rate
+@@ -1111,21 +1112,50 @@ static int ad7124_parse_channel_config(struct iio_dev *indio_dev,
+ static int ad7124_setup(struct ad7124_state *st)
+ {
+ 	struct device *dev = &st->sd.spi->dev;
+-	unsigned int fclk, power_mode;
++	unsigned int power_mode;
++	struct clk *mclk;
+ 	int i, ret;
+ 
+-	fclk = clk_get_rate(st->mclk);
+-	if (!fclk)
+-		return dev_err_probe(dev, -EINVAL, "Failed to get mclk rate\n");
++	/*
++	 * Always use full power mode for max performance. If needed, the driver
++	 * could be adapted to use a dynamic power mode based on the requested
++	 * output data rate.
++	 */
++	power_mode = AD7124_ADC_CONTROL_POWER_MODE_FULL;
+ 
+-	/* The power mode changes the master clock frequency */
+-	power_mode = ad7124_find_closest_match(ad7124_master_clk_freq_hz,
+-					ARRAY_SIZE(ad7124_master_clk_freq_hz),
+-					fclk);
+-	if (fclk != ad7124_master_clk_freq_hz[power_mode]) {
+-		ret = clk_set_rate(st->mclk, fclk);
+-		if (ret)
+-			return dev_err_probe(dev, ret, "Failed to set mclk rate\n");
++	/*
++	 * This "mclk" business is needed for backwards compatibility with old
++	 * devicetrees that specified a fake clock named "mclk" to select the
++	 * power mode.
++	 */
++	mclk = devm_clk_get_optional_enabled(dev, "mclk");
++	if (IS_ERR(mclk))
++		return dev_err_probe(dev, PTR_ERR(mclk), "Failed to get mclk\n");
++
++	if (mclk) {
++		unsigned long mclk_hz;
++
++		mclk_hz = clk_get_rate(mclk);
++		if (!mclk_hz)
++			return dev_err_probe(dev, -EINVAL,
++					     "Failed to get mclk rate\n");
++
++		/*
++		 * This logic is a bit backwards, which is why it is only here
++		 * for backwards compatibility. The driver should be able to set
++		 * the power mode as it sees fit and the f_clk/mclk rate should
++		 * be dynamic accordingly. But here, we are selecting a fixed
++		 * power mode based on the given "mclk" rate.
++		 */
++		power_mode = ad7124_find_closest_match(ad7124_master_clk_freq_hz,
++			ARRAY_SIZE(ad7124_master_clk_freq_hz), mclk_hz);
++
++		if (mclk_hz != ad7124_master_clk_freq_hz[power_mode]) {
++			ret = clk_set_rate(mclk, mclk_hz);
++			if (ret)
++				return dev_err_probe(dev, ret,
++						     "Failed to set mclk rate\n");
++		}
+ 	}
+ 
+ 	/* Set the power mode */
+@@ -1303,10 +1333,6 @@ static int ad7124_probe(struct spi_device *spi)
+ 			return dev_err_probe(dev, ret, "Failed to register disable handler for regulator #%d\n", i);
+ 	}
+ 
+-	st->mclk = devm_clk_get_enabled(&spi->dev, "mclk");
+-	if (IS_ERR(st->mclk))
+-		return dev_err_probe(dev, PTR_ERR(st->mclk), "Failed to get mclk\n");
+-
+ 	ret = ad7124_soft_reset(st);
+ 	if (ret < 0)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch b/queue-6.17/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
new file mode 100644
index 0000000000..4a23f6db70
--- /dev/null
+++ b/queue-6.17/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
@@ -0,0 +1,88 @@
+From 542f23d3ddd4363409dcef6e6b960d467e8dde64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:04:23 +0800
+Subject: iio: adc: imx93_adc: load calibrated values even calibration failed
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 12c9b09e981ab14ebec8e4eefa946cbd26dd306b ]
+
+ADC calibration might fail because of the noise on reference voltage.
+To avoid calibration fail, need to meet the following requirement:
+    ADC reference voltage Noise < 1.8V * 1/2^ENOB
+
+For the case which the ADC reference voltage on board do not meet
+the requirement, still load the calibrated values, so ADC can also
+work but maybe not that accurate.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250812-adc-v2-2-0260833f13b8@nxp.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/imx93_adc.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c
+index 7feaafd2316f2..9f1546c3d39d5 100644
+--- a/drivers/iio/adc/imx93_adc.c
++++ b/drivers/iio/adc/imx93_adc.c
+@@ -38,6 +38,7 @@
+ #define IMX93_ADC_PCDR6		0x118
+ #define IMX93_ADC_PCDR7		0x11c
+ #define IMX93_ADC_CALSTAT	0x39C
++#define IMX93_ADC_CALCFG0	0x3A0
+ 
+ /* ADC bit shift */
+ #define IMX93_ADC_MCR_MODE_MASK			BIT(29)
+@@ -58,6 +59,8 @@
+ #define IMX93_ADC_IMR_ECH_MASK			BIT(0)
+ #define IMX93_ADC_PCDR_CDATA_MASK		GENMASK(11, 0)
+ 
++#define IMX93_ADC_CALCFG0_LDFAIL_MASK		BIT(4)
++
+ /* ADC status */
+ #define IMX93_ADC_MSR_ADCSTATUS_IDLE			0
+ #define IMX93_ADC_MSR_ADCSTATUS_POWER_DOWN		1
+@@ -145,7 +148,7 @@ static void imx93_adc_config_ad_clk(struct imx93_adc *adc)
+ 
+ static int imx93_adc_calibration(struct imx93_adc *adc)
+ {
+-	u32 mcr, msr;
++	u32 mcr, msr, calcfg;
+ 	int ret;
+ 
+ 	/* make sure ADC in power down mode */
+@@ -158,6 +161,11 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 
+ 	imx93_adc_power_up(adc);
+ 
++	/* Enable loading of calibrated values even in fail condition */
++	calcfg = readl(adc->regs + IMX93_ADC_CALCFG0);
++	calcfg |= IMX93_ADC_CALCFG0_LDFAIL_MASK;
++	writel(calcfg, adc->regs + IMX93_ADC_CALCFG0);
++
+ 	/*
+ 	 * TODO: we use the default TSAMP/NRSMPL/AVGEN in MCR,
+ 	 * can add the setting of these bit if need in future.
+@@ -180,9 +188,13 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 	/* check whether calbration is success or not */
+ 	msr = readl(adc->regs + IMX93_ADC_MSR);
+ 	if (msr & IMX93_ADC_MSR_CALFAIL_MASK) {
++		/*
++		 * Only give warning here, this means the noise of the
++		 * reference voltage do not meet the requirement:
++		 *     ADC reference voltage Noise < 1.8V * 1/2^ENOB
++		 * And the resault of ADC is not that accurate.
++		 */
+ 		dev_warn(adc->dev, "ADC calibration failed!\n");
+-		imx93_adc_power_down(adc);
+-		return -EAGAIN;
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-6.17/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..36ec069ba0
--- /dev/null
+++ b/queue-6.17/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From 3046e3cb11fe6543461d6a0c54fe18a0275dc96c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index e3a865c79686e..df100dce77da4 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -14,6 +14,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&st->lock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-6.17/iio-imu-bmi270-match-pnp-id-found-on-newer-gpd-firmw.patch b/queue-6.17/iio-imu-bmi270-match-pnp-id-found-on-newer-gpd-firmw.patch
new file mode 100644
index 0000000000..5f4695898e
--- /dev/null
+++ b/queue-6.17/iio-imu-bmi270-match-pnp-id-found-on-newer-gpd-firmw.patch
@@ -0,0 +1,74 @@
+From 01a8a15ddfbe9b8a3afe75dbc06021b84e277da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:52:36 +0800
+Subject: iio: imu: bmi270: Match PNP ID found on newer GPD firmware
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit dc757dc1572d579c2634c05d0a03c5676227c571 ]
+
+GPD devices originally used BMI160 sensors with the "BMI0160" PNP ID.
+When they switched to BMI260 sensors in newer hardware, they reused
+the existing Windows driver which accepts both "BMI0160" and "BMI0260"
+IDs. Consequently, they kept "BMI0160" in DSDT tables for new BMI260
+devices, causing driver mismatches in Linux.
+
+1. GPD updated BIOS v0.40+[1] for newer devices to report "BMI0260" for
+BMI260 sensors to avoid loading the bmi160 driver on Linux. While this
+isn't Bosch's VID;
+2. Bosch's official Windows driver uses "BMI0260" as a compatible ID
+3. We're seeing real devices shipping with "BMI0260" in DSDT
+
+The DSDT excerpt of GPD G1619-04 with BIOS v0.40:
+
+Scope (_SB.I2CC)
+{
+    Device (BMA2)
+    {
+        Name (_ADR, Zero)  // _ADR: Address
+        Name (_HID, "BMI0260")  // _HID: Hardware ID
+        Name (_CID, "BMI0260")  // _CID: Compatible ID
+        Name (_DDN, "Accelerometer")  // _DDN: DOS Device Name
+        Name (_UID, One)  // _UID: Unique ID
+        Method (_CRS, 0, NotSerialized)  // _CRS: Current Resource Settings
+        {
+            Name (RBUF, ResourceTemplate ()
+            {
+                I2cSerialBusV2 (0x0069, ControllerInitiated, 0x00061A80,
+                    AddressingMode7Bit, "\\_SB.I2CC",
+                    0x00, ResourceConsumer, , Exclusive,
+                    )
+            })
+            Return (RBUF) /* \_SB_.I2CC.BMA2._CRS.RBUF */
+        }
+        # omit some noise
+    }
+}
+
+Link: http://download.softwincn.com/WIN%20Max%202024/Max2-7840-BIOS-V0.41.zip #1
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Acked-by: Alex Lanzano <lanzano.alex@gmail.com>
+Link: https://patch.msgid.link/20250821-bmi270-gpd-acpi-v4-1-5279b471d749@uniontech.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bmi270/bmi270_i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/imu/bmi270/bmi270_i2c.c b/drivers/iio/imu/bmi270/bmi270_i2c.c
+index c77839b03a969..b909a421ad017 100644
+--- a/drivers/iio/imu/bmi270/bmi270_i2c.c
++++ b/drivers/iio/imu/bmi270/bmi270_i2c.c
+@@ -41,6 +41,8 @@ static const struct i2c_device_id bmi270_i2c_id[] = {
+ static const struct acpi_device_id bmi270_acpi_match[] = {
+ 	/* GPD Win Mini, Aya Neo AIR Pro, OXP Mini Pro, etc. */
+ 	{ "BMI0160",  (kernel_ulong_t)&bmi260_chip_info },
++	/* GPD Win Max 2 2023(sincice BIOS v0.40), etc. */
++	{ "BMI0260",  (kernel_ulong_t)&bmi260_chip_info },
+ 	{ }
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/iio-light-isl29125-use-iio_push_to_buffers_with_ts-t.patch b/queue-6.17/iio-light-isl29125-use-iio_push_to_buffers_with_ts-t.patch
new file mode 100644
index 0000000000..cdeca9a765
--- /dev/null
+++ b/queue-6.17/iio-light-isl29125-use-iio_push_to_buffers_with_ts-t.patch
@@ -0,0 +1,66 @@
+From 72afc12515b357d26a5ce4f0149379ef797e3e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 17:44:29 +0100
+Subject: iio: light: isl29125: Use iio_push_to_buffers_with_ts() to allow
+ source size runtime check
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit f0ffec3b4fa7e430f92302ee233c79aeb021fe14 ]
+
+Also move the structure used as the source to the stack as it is only 16
+bytes and not the target of an DMA or similar.
+
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://patch.msgid.link/20250802164436.515988-10-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/isl29125.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iio/light/isl29125.c b/drivers/iio/light/isl29125.c
+index 6bc23b164cc55..3acb8a4f1d120 100644
+--- a/drivers/iio/light/isl29125.c
++++ b/drivers/iio/light/isl29125.c
+@@ -51,11 +51,6 @@
+ struct isl29125_data {
+ 	struct i2c_client *client;
+ 	u8 conf1;
+-	/* Ensure timestamp is naturally aligned */
+-	struct {
+-		u16 chans[3];
+-		aligned_s64 timestamp;
+-	} scan;
+ };
+ 
+ #define ISL29125_CHANNEL(_color, _si) { \
+@@ -179,6 +174,11 @@ static irqreturn_t isl29125_trigger_handler(int irq, void *p)
+ 	struct iio_dev *indio_dev = pf->indio_dev;
+ 	struct isl29125_data *data = iio_priv(indio_dev);
+ 	int i, j = 0;
++	/* Ensure timestamp is naturally aligned */
++	struct {
++		u16 chans[3];
++		aligned_s64 timestamp;
++	} scan = { };
+ 
+ 	iio_for_each_active_channel(indio_dev, i) {
+ 		int ret = i2c_smbus_read_word_data(data->client,
+@@ -186,10 +186,10 @@ static irqreturn_t isl29125_trigger_handler(int irq, void *p)
+ 		if (ret < 0)
+ 			goto done;
+ 
+-		data->scan.chans[j++] = ret;
++		scan.chans[j++] = ret;
+ 	}
+ 
+-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
++	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+ 		iio_get_time_ns(indio_dev));
+ 
+ done:
+-- 
+2.51.0
+
diff --git a/queue-6.17/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch b/queue-6.17/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
new file mode 100644
index 0000000000..85ec45022c
--- /dev/null
+++ b/queue-6.17/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
@@ -0,0 +1,156 @@
+From 81c6b7d6b415ceb530af07e686d53411509e0171 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 13:55:23 +0800
+Subject: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA
+ xattr
+
+From: Coiby Xu <coxu@redhat.com>
+
+[ Upstream commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd ]
+
+Currently when both IMA and EVM are in fix mode, the IMA signature will
+be reset to IMA hash if a program first stores IMA signature in
+security.ima and then writes/removes some other security xattr for the
+file.
+
+For example, on Fedora, after booting the kernel with "ima_appraise=fix
+evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,
+installing/reinstalling a package will not make good reference IMA
+signature generated. Instead IMA hash is generated,
+
+    # getfattr -m - -d -e hex /usr/bin/bash
+    # file: usr/bin/bash
+    security.ima=0x0404...
+
+This happens because when setting security.selinux, the IMA_DIGSIG flag
+that had been set early was cleared. As a result, IMA hash is generated
+when the file is closed.
+
+Similarly, IMA signature can be cleared on file close after removing
+security xattr like security.evm or setting/removing ACL.
+
+Prevent replacing the IMA file signature with a file hash, by preventing
+the IMA_DIGSIG flag from being reset.
+
+Here's a minimal C reproducer which sets security.selinux as the last
+step which can also replaced by removing security.evm or setting ACL,
+
+    #include <stdio.h>
+    #include <sys/xattr.h>
+    #include <fcntl.h>
+    #include <unistd.h>
+    #include <string.h>
+    #include <stdlib.h>
+
+    int main() {
+        const char* file_path = "/usr/sbin/test_binary";
+        const char* hex_string = "030204d33204490066306402304";
+        int length = strlen(hex_string);
+        char* ima_attr_value;
+        int fd;
+
+        fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
+        if (fd == -1) {
+            perror("Error opening file");
+            return 1;
+        }
+
+        ima_attr_value = (char*)malloc(length / 2 );
+        for (int i = 0, j = 0; i < length; i += 2, j++) {
+            sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
+        }
+
+        if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        const char* selinux_value= "system_u:object_r:bin_t:s0";
+        if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        close(fd);
+
+        return 0;
+    }
+
+Signed-off-by: Coiby Xu <coxu@redhat.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_appraise.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index f435eff4667f8..5149ff4fd50d2 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -694,6 +694,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
+ 	return 0;
+ }
+ 
++/*
++ * ima_reset_appraise_flags - reset ima_iint_cache flags
++ *
++ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values
++ *          0: clear IMA_DIGSIG
++ *          1: set IMA_DIGSIG
++ *         -1: don't change IMA_DIGSIG
++ *
++ */
+ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ {
+ 	struct ima_iint_cache *iint;
+@@ -706,9 +715,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ 		return;
+ 	iint->measured_pcrs = 0;
+ 	set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
+-	if (digsig)
++	if (digsig == 1)
+ 		set_bit(IMA_DIGSIG, &iint->atomic_flags);
+-	else
++	else if (digsig == 0)
+ 		clear_bit(IMA_DIGSIG, &iint->atomic_flags);
+ }
+ 
+@@ -794,6 +803,8 @@ static int ima_inode_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ 		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
+ 	} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
+ 		digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
++	} else {
++		digsig = -1;
+ 	}
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+ 		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+@@ -807,7 +818,7 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ 			     const char *acl_name, struct posix_acl *kacl)
+ {
+ 	if (evm_revalidate_status(acl_name))
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		ima_reset_appraise_flags(d_backing_inode(dentry), -1);
+ 
+ 	return 0;
+ }
+@@ -815,11 +826,13 @@ static int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ static int ima_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,
+ 				 const char *xattr_name)
+ {
+-	int result;
++	int result, digsig = -1;
+ 
+ 	result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		if (!strcmp(xattr_name, XATTR_NAME_IMA))
++			digsig = 0;
++		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+ 		if (result == 1)
+ 			result = 0;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch b/queue-6.17/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
new file mode 100644
index 0000000000..45bfc105b8
--- /dev/null
+++ b/queue-6.17/inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
@@ -0,0 +1,62 @@
+From 30fdbe86a04602eeec4c79074c461240fa8c9e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 10:27:36 +0000
+Subject: inet_diag: annotate data-races in inet_diag_bc_sk()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4fd84a0aaf2ba125b441aa09d415022385e66bf2 ]
+
+inet_diag_bc_sk() runs with an unlocked socket,
+annotate potential races with READ_ONCE().
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250828102738.2065992-4-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_diag.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 2fa53b16fe778..238b2a4a6cf43 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -785,7 +785,7 @@ static void entry_fill_addrs(struct inet_diag_entry *entry,
+ 			     const struct sock *sk)
+ {
+ #if IS_ENABLED(CONFIG_IPV6)
+-	if (sk->sk_family == AF_INET6) {
++	if (entry->family == AF_INET6) {
+ 		entry->saddr = sk->sk_v6_rcv_saddr.s6_addr32;
+ 		entry->daddr = sk->sk_v6_daddr.s6_addr32;
+ 	} else
+@@ -798,18 +798,18 @@ static void entry_fill_addrs(struct inet_diag_entry *entry,
+ 
+ int inet_diag_bc_sk(const struct nlattr *bc, struct sock *sk)
+ {
+-	struct inet_sock *inet = inet_sk(sk);
++	const struct inet_sock *inet = inet_sk(sk);
+ 	struct inet_diag_entry entry;
+ 
+ 	if (!bc)
+ 		return 1;
+ 
+-	entry.family = sk->sk_family;
++	entry.family = READ_ONCE(sk->sk_family);
+ 	entry_fill_addrs(&entry, sk);
+-	entry.sport = inet->inet_num;
+-	entry.dport = ntohs(inet->inet_dport);
+-	entry.ifindex = sk->sk_bound_dev_if;
+-	entry.userlocks = sk_fullsock(sk) ? sk->sk_userlocks : 0;
++	entry.sport = READ_ONCE(inet->inet_num);
++	entry.dport = ntohs(READ_ONCE(inet->inet_dport));
++	entry.ifindex = READ_ONCE(sk->sk_bound_dev_if);
++	entry.userlocks = sk_fullsock(sk) ? READ_ONCE(sk->sk_userlocks) : 0;
+ 	if (sk_fullsock(sk))
+ 		entry.mark = READ_ONCE(sk->sk_mark);
+ 	else if (sk->sk_state == TCP_NEW_SYN_RECV)
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-amd-add-support-to-remap-unmap-iommu-buffers-f.patch b/queue-6.17/iommu-amd-add-support-to-remap-unmap-iommu-buffers-f.patch
new file mode 100644
index 0000000000..96f58b16a2
--- /dev/null
+++ b/queue-6.17/iommu-amd-add-support-to-remap-unmap-iommu-buffers-f.patch
@@ -0,0 +1,279 @@
+From 39dcace5b38524d153846411483eeaaf8993fa72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:01 +0000
+Subject: iommu/amd: Add support to remap/unmap IOMMU buffers for kdump
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit f32fe7cb019861f585b40bff4c3daf237b9af294 ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU completion wait buffers (CWBs), command buffers and event buffer
+registers remain locked and exclusive to the previous kernel. Attempts
+to allocate and use new buffers in the kdump kernel fail, as hardware
+ignores writes to the locked MMIO registers as per AMD IOMMU spec
+Section 2.12.2.1.
+
+This results in repeated "Completion-Wait loop timed out" errors and a
+second kernel panic: "Kernel panic - not syncing: timer doesn't work
+through Interrupt-remapped IO-APIC"
+
+The list of MMIO registers locked and which ignore writes after failed
+SNP shutdown are mentioned in the AMD IOMMU specifications below:
+
+Section 2.12.2.1.
+https://docs.amd.com/v/u/en-US/48882_3.10_PUB
+
+Reuse the pages of the previous kernel for completion wait buffers,
+command buffers, event buffers and memremap them during kdump boot
+and essentially work with an already enabled IOMMU configuration and
+re-using the previous kernel’s data structures.
+
+Reusing of command buffers and event buffers is now done for kdump boot
+irrespective of SNP being enabled during kdump.
+
+Re-use of completion wait buffers is only done when SNP is enabled as
+the exclusion base register is used for the completion wait buffer
+(CWB) address only when SNP is enabled.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/ff04b381a8fe774b175c23c1a336b28bc1396511.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/amd_iommu_types.h |   5 +
+ drivers/iommu/amd/init.c            | 152 +++++++++++++++++++++++++---
+ drivers/iommu/amd/iommu.c           |   2 +-
+ 3 files changed, 146 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
+index 95f63c5f6159f..a698a2e7ce2a6 100644
+--- a/drivers/iommu/amd/amd_iommu_types.h
++++ b/drivers/iommu/amd/amd_iommu_types.h
+@@ -792,6 +792,11 @@ struct amd_iommu {
+ 	u32 flags;
+ 	volatile u64 *cmd_sem;
+ 	atomic64_t cmd_sem_val;
++	/*
++	 * Track physical address to directly use it in build_completion_wait()
++	 * and avoid adding any special checks and handling for kdump.
++	 */
++	u64 cmd_sem_paddr;
+ 
+ #ifdef CONFIG_AMD_IOMMU_DEBUGFS
+ 	/* DebugFS Info */
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index ba9e582a8bbe5..309951e57f301 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -710,6 +710,26 @@ static void __init free_alias_table(struct amd_iommu_pci_seg *pci_seg)
+ 	pci_seg->alias_table = NULL;
+ }
+ 
++static inline void *iommu_memremap(unsigned long paddr, size_t size)
++{
++	phys_addr_t phys;
++
++	if (!paddr)
++		return NULL;
++
++	/*
++	 * Obtain true physical address in kdump kernel when SME is enabled.
++	 * Currently, previous kernel with SME enabled and kdump kernel
++	 * with SME support disabled is not supported.
++	 */
++	phys = __sme_clr(paddr);
++
++	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
++		return (__force void *)ioremap_encrypted(phys, size);
++	else
++		return memremap(phys, size, MEMREMAP_WB);
++}
++
+ /*
+  * Allocates the command buffer. This buffer is per AMD IOMMU. We can
+  * write commands to that buffer later and the IOMMU will execute them
+@@ -942,8 +962,91 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
+ static int __init alloc_cwwb_sem(struct amd_iommu *iommu)
+ {
+ 	iommu->cmd_sem = iommu_alloc_4k_pages(iommu, GFP_KERNEL, 1);
++	if (!iommu->cmd_sem)
++		return -ENOMEM;
++	iommu->cmd_sem_paddr = iommu_virt_to_phys((void *)iommu->cmd_sem);
++	return 0;
++}
++
++static int __init remap_event_buffer(struct amd_iommu *iommu)
++{
++	u64 paddr;
++
++	pr_info_once("Re-using event buffer from the previous kernel\n");
++	paddr = readq(iommu->mmio_base + MMIO_EVT_BUF_OFFSET) & PM_ADDR_MASK;
++	iommu->evt_buf = iommu_memremap(paddr, EVT_BUFFER_SIZE);
++
++	return iommu->evt_buf ? 0 : -ENOMEM;
++}
++
++static int __init remap_command_buffer(struct amd_iommu *iommu)
++{
++	u64 paddr;
+ 
+-	return iommu->cmd_sem ? 0 : -ENOMEM;
++	pr_info_once("Re-using command buffer from the previous kernel\n");
++	paddr = readq(iommu->mmio_base + MMIO_CMD_BUF_OFFSET) & PM_ADDR_MASK;
++	iommu->cmd_buf = iommu_memremap(paddr, CMD_BUFFER_SIZE);
++
++	return iommu->cmd_buf ? 0 : -ENOMEM;
++}
++
++static int __init remap_or_alloc_cwwb_sem(struct amd_iommu *iommu)
++{
++	u64 paddr;
++
++	if (check_feature(FEATURE_SNP)) {
++		/*
++		 * When SNP is enabled, the exclusion base register is used for the
++		 * completion wait buffer (CWB) address. Read and re-use it.
++		 */
++		pr_info_once("Re-using CWB buffers from the previous kernel\n");
++		paddr = readq(iommu->mmio_base + MMIO_EXCL_BASE_OFFSET) & PM_ADDR_MASK;
++		iommu->cmd_sem = iommu_memremap(paddr, PAGE_SIZE);
++		if (!iommu->cmd_sem)
++			return -ENOMEM;
++		iommu->cmd_sem_paddr = paddr;
++	} else {
++		return alloc_cwwb_sem(iommu);
++	}
++
++	return 0;
++}
++
++static int __init alloc_iommu_buffers(struct amd_iommu *iommu)
++{
++	int ret;
++
++	/*
++	 * Reuse/Remap the previous kernel's allocated completion wait
++	 * command and event buffers for kdump boot.
++	 */
++	if (is_kdump_kernel()) {
++		ret = remap_or_alloc_cwwb_sem(iommu);
++		if (ret)
++			return ret;
++
++		ret = remap_command_buffer(iommu);
++		if (ret)
++			return ret;
++
++		ret = remap_event_buffer(iommu);
++		if (ret)
++			return ret;
++	} else {
++		ret = alloc_cwwb_sem(iommu);
++		if (ret)
++			return ret;
++
++		ret = alloc_command_buffer(iommu);
++		if (ret)
++			return ret;
++
++		ret = alloc_event_buffer(iommu);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
+ }
+ 
+ static void __init free_cwwb_sem(struct amd_iommu *iommu)
+@@ -951,6 +1054,38 @@ static void __init free_cwwb_sem(struct amd_iommu *iommu)
+ 	if (iommu->cmd_sem)
+ 		iommu_free_pages((void *)iommu->cmd_sem);
+ }
++static void __init unmap_cwwb_sem(struct amd_iommu *iommu)
++{
++	if (iommu->cmd_sem) {
++		if (check_feature(FEATURE_SNP))
++			memunmap((void *)iommu->cmd_sem);
++		else
++			iommu_free_pages((void *)iommu->cmd_sem);
++	}
++}
++
++static void __init unmap_command_buffer(struct amd_iommu *iommu)
++{
++	memunmap((void *)iommu->cmd_buf);
++}
++
++static void __init unmap_event_buffer(struct amd_iommu *iommu)
++{
++	memunmap(iommu->evt_buf);
++}
++
++static void __init free_iommu_buffers(struct amd_iommu *iommu)
++{
++	if (is_kdump_kernel()) {
++		unmap_cwwb_sem(iommu);
++		unmap_command_buffer(iommu);
++		unmap_event_buffer(iommu);
++	} else {
++		free_cwwb_sem(iommu);
++		free_command_buffer(iommu);
++		free_event_buffer(iommu);
++	}
++}
+ 
+ static void iommu_enable_xt(struct amd_iommu *iommu)
+ {
+@@ -1655,9 +1790,7 @@ static void __init free_sysfs(struct amd_iommu *iommu)
+ static void __init free_iommu_one(struct amd_iommu *iommu)
+ {
+ 	free_sysfs(iommu);
+-	free_cwwb_sem(iommu);
+-	free_command_buffer(iommu);
+-	free_event_buffer(iommu);
++	free_iommu_buffers(iommu);
+ 	amd_iommu_free_ppr_log(iommu);
+ 	free_ga_log(iommu);
+ 	iommu_unmap_mmio_space(iommu);
+@@ -1821,14 +1954,9 @@ static int __init init_iommu_one_late(struct amd_iommu *iommu)
+ {
+ 	int ret;
+ 
+-	if (alloc_cwwb_sem(iommu))
+-		return -ENOMEM;
+-
+-	if (alloc_command_buffer(iommu))
+-		return -ENOMEM;
+-
+-	if (alloc_event_buffer(iommu))
+-		return -ENOMEM;
++	ret = alloc_iommu_buffers(iommu);
++	if (ret)
++		return ret;
+ 
+ 	iommu->int_enabled = false;
+ 
+diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
+index eb348c63a8d09..05a9ab3da1a3e 100644
+--- a/drivers/iommu/amd/iommu.c
++++ b/drivers/iommu/amd/iommu.c
+@@ -1195,7 +1195,7 @@ static void build_completion_wait(struct iommu_cmd *cmd,
+ 				  struct amd_iommu *iommu,
+ 				  u64 data)
+ {
+-	u64 paddr = iommu_virt_to_phys((void *)iommu->cmd_sem);
++	u64 paddr = iommu->cmd_sem_paddr;
+ 
+ 	memset(cmd, 0, sizeof(*cmd));
+ 	cmd->data[0] = lower_32_bits(paddr) | CMD_COMPL_WAIT_STORE_MASK;
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-amd-reuse-device-table-for-kdump.patch b/queue-6.17/iommu-amd-reuse-device-table-for-kdump.patch
new file mode 100644
index 0000000000..59a70e5090
--- /dev/null
+++ b/queue-6.17/iommu-amd-reuse-device-table-for-kdump.patch
@@ -0,0 +1,229 @@
+From b0b4c635b4d75274e988eef9edaaf2de30892bf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:15 +0000
+Subject: iommu/amd: Reuse device table for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 38e5f33ee3596f37ee8d1e694073a17590904004 ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU device table register is locked and exclusive to the previous
+kernel. Attempts to copy old device table from the previous kernel
+fails in kdump kernel as hardware ignores writes to the locked device
+table base address register as per AMD IOMMU spec Section 2.12.2.1.
+
+This causes the IOMMU driver (OS) and the hardware to reference
+different memory locations. As a result, the IOMMU hardware cannot
+process the command which results in repeated "Completion-Wait loop
+timed out" errors and a second kernel panic: "Kernel panic - not
+syncing: timer doesn't work through Interrupt-remapped IO-APIC".
+
+Reuse device table instead of copying device table in case of kdump
+boot and remove all copying device table code.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/3a31036fb2f7323e6b1a1a1921ac777e9f7bdddc.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 104 +++++++++++++--------------------------
+ 1 file changed, 34 insertions(+), 70 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index d0cd40ee0dec6..f2991c11867cb 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -406,6 +406,9 @@ static void iommu_set_device_table(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->mmio_base == NULL);
+ 
++	if (is_kdump_kernel())
++		return;
++
+ 	entry = iommu_virt_to_phys(dev_table);
+ 	entry |= (dev_table_size >> 12) - 1;
+ 	memcpy_toio(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET,
+@@ -646,7 +649,10 @@ static inline int __init alloc_dev_table(struct amd_iommu_pci_seg *pci_seg)
+ 
+ static inline void free_dev_table(struct amd_iommu_pci_seg *pci_seg)
+ {
+-	iommu_free_pages(pci_seg->dev_table);
++	if (is_kdump_kernel())
++		memunmap((void *)pci_seg->dev_table);
++	else
++		iommu_free_pages(pci_seg->dev_table);
+ 	pci_seg->dev_table = NULL;
+ }
+ 
+@@ -1127,15 +1133,12 @@ static void set_dte_bit(struct dev_table_entry *dte, u8 bit)
+ 	dte->data[i] |= (1UL << _bit);
+ }
+ 
+-static bool __copy_device_table(struct amd_iommu *iommu)
++static bool __reuse_device_table(struct amd_iommu *iommu)
+ {
+-	u64 int_ctl, int_tab_len, entry = 0;
+ 	struct amd_iommu_pci_seg *pci_seg = iommu->pci_seg;
+-	struct dev_table_entry *old_devtb = NULL;
+-	u32 lo, hi, devid, old_devtb_size;
++	u32 lo, hi, old_devtb_size;
+ 	phys_addr_t old_devtb_phys;
+-	u16 dom_id, dte_v, irq_v;
+-	u64 tmp;
++	u64 entry;
+ 
+ 	/* Each IOMMU use separate device table with the same size */
+ 	lo = readl(iommu->mmio_base + MMIO_DEV_TABLE_OFFSET);
+@@ -1160,66 +1163,20 @@ static bool __copy_device_table(struct amd_iommu *iommu)
+ 		pr_err("The address of old device table is above 4G, not trustworthy!\n");
+ 		return false;
+ 	}
+-	old_devtb = (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT) && is_kdump_kernel())
+-		    ? (__force void *)ioremap_encrypted(old_devtb_phys,
+-							pci_seg->dev_table_size)
+-		    : memremap(old_devtb_phys, pci_seg->dev_table_size, MEMREMAP_WB);
+-
+-	if (!old_devtb)
+-		return false;
+ 
+-	pci_seg->old_dev_tbl_cpy = iommu_alloc_pages_sz(
+-		GFP_KERNEL | GFP_DMA32, pci_seg->dev_table_size);
++	/*
++	 * Re-use the previous kernel's device table for kdump.
++	 */
++	pci_seg->old_dev_tbl_cpy = iommu_memremap(old_devtb_phys, pci_seg->dev_table_size);
+ 	if (pci_seg->old_dev_tbl_cpy == NULL) {
+-		pr_err("Failed to allocate memory for copying old device table!\n");
+-		memunmap(old_devtb);
++		pr_err("Failed to remap memory for reusing old device table!\n");
+ 		return false;
+ 	}
+ 
+-	for (devid = 0; devid <= pci_seg->last_bdf; ++devid) {
+-		pci_seg->old_dev_tbl_cpy[devid] = old_devtb[devid];
+-		dom_id = old_devtb[devid].data[1] & DEV_DOMID_MASK;
+-		dte_v = old_devtb[devid].data[0] & DTE_FLAG_V;
+-
+-		if (dte_v && dom_id) {
+-			pci_seg->old_dev_tbl_cpy[devid].data[0] = old_devtb[devid].data[0];
+-			pci_seg->old_dev_tbl_cpy[devid].data[1] = old_devtb[devid].data[1];
+-			/* Reserve the Domain IDs used by previous kernel */
+-			if (ida_alloc_range(&pdom_ids, dom_id, dom_id, GFP_ATOMIC) != dom_id) {
+-				pr_err("Failed to reserve domain ID 0x%x\n", dom_id);
+-				memunmap(old_devtb);
+-				return false;
+-			}
+-			/* If gcr3 table existed, mask it out */
+-			if (old_devtb[devid].data[0] & DTE_FLAG_GV) {
+-				tmp = (DTE_GCR3_30_15 | DTE_GCR3_51_31);
+-				pci_seg->old_dev_tbl_cpy[devid].data[1] &= ~tmp;
+-				tmp = (DTE_GCR3_14_12 | DTE_FLAG_GV);
+-				pci_seg->old_dev_tbl_cpy[devid].data[0] &= ~tmp;
+-			}
+-		}
+-
+-		irq_v = old_devtb[devid].data[2] & DTE_IRQ_REMAP_ENABLE;
+-		int_ctl = old_devtb[devid].data[2] & DTE_IRQ_REMAP_INTCTL_MASK;
+-		int_tab_len = old_devtb[devid].data[2] & DTE_INTTABLEN_MASK;
+-		if (irq_v && (int_ctl || int_tab_len)) {
+-			if ((int_ctl != DTE_IRQ_REMAP_INTCTL) ||
+-			    (int_tab_len != DTE_INTTABLEN_512 &&
+-			     int_tab_len != DTE_INTTABLEN_2K)) {
+-				pr_err("Wrong old irq remapping flag: %#x\n", devid);
+-				memunmap(old_devtb);
+-				return false;
+-			}
+-
+-			pci_seg->old_dev_tbl_cpy[devid].data[2] = old_devtb[devid].data[2];
+-		}
+-	}
+-	memunmap(old_devtb);
+-
+ 	return true;
+ }
+ 
+-static bool copy_device_table(void)
++static bool reuse_device_table(void)
+ {
+ 	struct amd_iommu *iommu;
+ 	struct amd_iommu_pci_seg *pci_seg;
+@@ -1227,17 +1184,17 @@ static bool copy_device_table(void)
+ 	if (!amd_iommu_pre_enabled)
+ 		return false;
+ 
+-	pr_warn("Translation is already enabled - trying to copy translation structures\n");
++	pr_warn("Translation is already enabled - trying to reuse translation structures\n");
+ 
+ 	/*
+ 	 * All IOMMUs within PCI segment shares common device table.
+-	 * Hence copy device table only once per PCI segment.
++	 * Hence reuse device table only once per PCI segment.
+ 	 */
+ 	for_each_pci_segment(pci_seg) {
+ 		for_each_iommu(iommu) {
+ 			if (pci_seg->id != iommu->pci_seg->id)
+ 				continue;
+-			if (!__copy_device_table(iommu))
++			if (!__reuse_device_table(iommu))
+ 				return false;
+ 			break;
+ 		}
+@@ -2916,8 +2873,8 @@ static void early_enable_iommu(struct amd_iommu *iommu)
+  * This function finally enables all IOMMUs found in the system after
+  * they have been initialized.
+  *
+- * Or if in kdump kernel and IOMMUs are all pre-enabled, try to copy
+- * the old content of device table entries. Not this case or copy failed,
++ * Or if in kdump kernel and IOMMUs are all pre-enabled, try to reuse
++ * the old content of device table entries. Not this case or reuse failed,
+  * just continue as normal kernel does.
+  */
+ static void early_enable_iommus(void)
+@@ -2925,18 +2882,25 @@ static void early_enable_iommus(void)
+ 	struct amd_iommu *iommu;
+ 	struct amd_iommu_pci_seg *pci_seg;
+ 
+-	if (!copy_device_table()) {
++	if (!reuse_device_table()) {
+ 		/*
+-		 * If come here because of failure in copying device table from old
++		 * If come here because of failure in reusing device table from old
+ 		 * kernel with all IOMMUs enabled, print error message and try to
+ 		 * free allocated old_dev_tbl_cpy.
+ 		 */
+-		if (amd_iommu_pre_enabled)
+-			pr_err("Failed to copy DEV table from previous kernel.\n");
++		if (amd_iommu_pre_enabled) {
++			pr_err("Failed to reuse DEV table from previous kernel.\n");
++			/*
++			 * Bail out early if unable to remap/reuse DEV table from
++			 * previous kernel if SNP enabled as IOMMU commands will
++			 * time out without DEV table and cause kdump boot panic.
++			 */
++			BUG_ON(check_feature(FEATURE_SNP));
++		}
+ 
+ 		for_each_pci_segment(pci_seg) {
+ 			if (pci_seg->old_dev_tbl_cpy != NULL) {
+-				iommu_free_pages(pci_seg->old_dev_tbl_cpy);
++				memunmap((void *)pci_seg->old_dev_tbl_cpy);
+ 				pci_seg->old_dev_tbl_cpy = NULL;
+ 			}
+ 		}
+@@ -2946,7 +2910,7 @@ static void early_enable_iommus(void)
+ 			early_enable_iommu(iommu);
+ 		}
+ 	} else {
+-		pr_info("Copied DEV table from previous kernel.\n");
++		pr_info("Reused DEV table from previous kernel.\n");
+ 
+ 		for_each_pci_segment(pci_seg) {
+ 			iommu_free_pages(pci_seg->dev_table);
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-6.17/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..cfffcf5492
--- /dev/null
+++ b/queue-6.17/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From b9663404c939f49a2359460237c9b1b3c43c0b2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 309951e57f301..d0cd40ee0dec6 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -815,11 +815,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -870,10 +875,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch b/queue-6.17/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
new file mode 100644
index 0000000000..3e8dc09518
--- /dev/null
+++ b/queue-6.17/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
@@ -0,0 +1,49 @@
+From b6fdaa06d2635a10eabe6bc01dfb792d2eeb029e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 12:57:18 +0200
+Subject: iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit ecf6508923f87e4597228f70cc838af3d37f6662 ]
+
+These registers exist and at least on the t602x variant the IRQ only
+clears when theses are cleared.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Link: https://lore.kernel.org/r/20250826-dart-t8110-stream-error-v1-1-e33395112014@jannau.net
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/apple-dart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c
+index 190f28d766151..8b1272b7bb44a 100644
+--- a/drivers/iommu/apple-dart.c
++++ b/drivers/iommu/apple-dart.c
+@@ -122,6 +122,8 @@
+ #define DART_T8110_ERROR_ADDR_LO 0x170
+ #define DART_T8110_ERROR_ADDR_HI 0x174
+ 
++#define DART_T8110_ERROR_STREAMS 0x1c0
++
+ #define DART_T8110_PROTECT 0x200
+ #define DART_T8110_UNPROTECT 0x204
+ #define DART_T8110_PROTECT_LOCK 0x208
+@@ -1077,6 +1079,9 @@ static irqreturn_t apple_dart_t8110_irq(int irq, void *dev)
+ 		error, stream_idx, error_code, fault_name, addr);
+ 
+ 	writel(error, dart->regs + DART_T8110_ERROR);
++	for (int i = 0; i < BITS_TO_U32(dart->num_streams); i++)
++		writel(U32_MAX, dart->regs + DART_T8110_ERROR_STREAMS + 4 * i);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-vt-d-remove-lpig-from-page-group-response-desc.patch b/queue-6.17/iommu-vt-d-remove-lpig-from-page-group-response-desc.patch
new file mode 100644
index 0000000000..f277a75463
--- /dev/null
+++ b/queue-6.17/iommu-vt-d-remove-lpig-from-page-group-response-desc.patch
@@ -0,0 +1,76 @@
+From 4a3be98c030797eceb80dfbb14611d5693c0cb5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:02:01 +0800
+Subject: iommu/vt-d: Remove LPIG from page group response descriptor
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 4402e8f39d0bfff5c0a5edb5e1afe27a56545e11 ]
+
+Bit 66 in the page group response descriptor used to be the LPIG (Last
+Page in Group), but it was marked as Reserved since Specification 4.0.
+Remove programming on this bit to make it consistent with the latest
+specification.
+
+Existing hardware all treats bit 66 of the page group response descriptor
+as "ignored", therefore this change doesn't break any existing hardware.
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20250901053943.1708490-1-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.h | 1 -
+ drivers/iommu/intel/prq.c   | 7 ++-----
+ 2 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index 2c261c069001c..21b2c3f85ddc5 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -462,7 +462,6 @@ enum {
+ #define QI_PGRP_PASID(pasid)	(((u64)(pasid)) << 32)
+ 
+ /* Page group response descriptor QW1 */
+-#define QI_PGRP_LPIG(x)		(((u64)(x)) << 2)
+ #define QI_PGRP_IDX(idx)	(((u64)(idx)) << 3)
+ 
+ 
+diff --git a/drivers/iommu/intel/prq.c b/drivers/iommu/intel/prq.c
+index 52570e42a14c0..ff63c228e6e19 100644
+--- a/drivers/iommu/intel/prq.c
++++ b/drivers/iommu/intel/prq.c
+@@ -151,8 +151,7 @@ static void handle_bad_prq_event(struct intel_iommu *iommu,
+ 			QI_PGRP_PASID_P(req->pasid_present) |
+ 			QI_PGRP_RESP_CODE(result) |
+ 			QI_PGRP_RESP_TYPE;
+-	desc.qw1 = QI_PGRP_IDX(req->prg_index) |
+-			QI_PGRP_LPIG(req->lpig);
++	desc.qw1 = QI_PGRP_IDX(req->prg_index);
+ 
+ 	qi_submit_sync(iommu, &desc, 1, 0);
+ }
+@@ -379,19 +378,17 @@ void intel_iommu_page_response(struct device *dev, struct iopf_fault *evt,
+ 	struct iommu_fault_page_request *prm;
+ 	struct qi_desc desc;
+ 	bool pasid_present;
+-	bool last_page;
+ 	u16 sid;
+ 
+ 	prm = &evt->fault.prm;
+ 	sid = PCI_DEVID(bus, devfn);
+ 	pasid_present = prm->flags & IOMMU_FAULT_PAGE_REQUEST_PASID_VALID;
+-	last_page = prm->flags & IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE;
+ 
+ 	desc.qw0 = QI_PGRP_PASID(prm->pasid) | QI_PGRP_DID(sid) |
+ 			QI_PGRP_PASID_P(pasid_present) |
+ 			QI_PGRP_RESP_CODE(msg->code) |
+ 			QI_PGRP_RESP_TYPE;
+-	desc.qw1 = QI_PGRP_IDX(prm->grpid) | QI_PGRP_LPIG(last_page);
++	desc.qw1 = QI_PGRP_IDX(prm->grpid);
+ 	desc.qw2 = 0;
+ 	desc.qw3 = 0;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch b/queue-6.17/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
new file mode 100644
index 0000000000..ffb5721d09
--- /dev/null
+++ b/queue-6.17/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
@@ -0,0 +1,131 @@
+From ce96eab1822d394f5bf5f2740848209d134bbded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:58 +0800
+Subject: iommu/vt-d: Replace snprintf with scnprintf in
+ dmar_latency_snapshot()
+
+From: Seyediman Seyedarab <ImanDevel@gmail.com>
+
+[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
+
+snprintf() returns the number of bytes that would have been written, not
+the number actually written. Using this for offset tracking can cause
+buffer overruns if truncation occurs.
+
+Replace snprintf() with scnprintf() to ensure the offset stays within
+bounds.
+
+Since scnprintf() never returns a negative value, and zero is not possible
+in this context because 'bytes' starts at 0 and 'size - bytes' is
+DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
+string literals used, the return value is always positive. An integer
+overflow is also completely out of reach here due to the small and fixed
+buffer size. The error check in latency_show_one() is therefore
+unnecessary. Remove it and make dmar_latency_snapshot() return void.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 10 ++--------
+ drivers/iommu/intel/perf.c    | 10 ++++------
+ drivers/iommu/intel/perf.h    |  5 ++---
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index 5aa7f46a420b5..38790ff50977c 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -661,17 +661,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
+ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
+ 			     struct dmar_drhd_unit *drhd)
+ {
+-	int ret;
+-
+ 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
+ 		   iommu->name, drhd->reg_base_addr);
+ 
+-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+-	if (ret < 0)
+-		seq_puts(m, "Failed to get latency snapshot");
+-	else
+-		seq_puts(m, debug_buf);
+-	seq_puts(m, "\n");
++	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
++	seq_printf(m, "%s\n", debug_buf);
+ }
+ 
+ static int latency_show(struct seq_file *m, void *v)
+diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
+index adc4de6bbd88e..dceeadc3ee7cd 100644
+--- a/drivers/iommu/intel/perf.c
++++ b/drivers/iommu/intel/perf.c
+@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
+ 	"     svm_prq"
+ };
+ 
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+ 	struct latency_statistic *lstat = iommu->perf_statistic;
+ 	unsigned long flags;
+@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 	memset(str, 0, size);
+ 
+ 	for (i = 0; i < COUNTS_NUM; i++)
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "%s", latency_counter_names[i]);
+ 
+ 	spin_lock_irqsave(&latency_lock, flags);
+@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 		if (!dmar_latency_enabled(iommu, i))
+ 			continue;
+ 
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "\n%s", latency_type_names[i]);
+ 
+ 		for (j = 0; j < COUNTS_NUM; j++) {
+@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 				break;
+ 			}
+ 
+-			bytes += snprintf(str + bytes, size - bytes,
++			bytes += scnprintf(str + bytes, size - bytes,
+ 					  "%12lld", val);
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&latency_lock, flags);
+-
+-	return bytes;
+ }
+diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
+index df9a36942d643..1d4baad7e852e 100644
+--- a/drivers/iommu/intel/perf.h
++++ b/drivers/iommu/intel/perf.h
+@@ -40,7 +40,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
+ bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
+ void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
+ 			 u64 latency);
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+ #else
+ static inline int
+ dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
+@@ -64,9 +64,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
+ {
+ }
+ 
+-static inline int
++static inline void
+ dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+-	return 0;
+ }
+ #endif /* CONFIG_DMAR_PERF */
+-- 
+2.51.0
+
diff --git a/queue-6.17/ionic-use-int-type-for-err-in-ionic_get_module_eepro.patch b/queue-6.17/ionic-use-int-type-for-err-in-ionic_get_module_eepro.patch
new file mode 100644
index 0000000000..2a19a3fdc8
--- /dev/null
+++ b/queue-6.17/ionic-use-int-type-for-err-in-ionic_get_module_eepro.patch
@@ -0,0 +1,45 @@
+From b7364d2da4e4c86e41c915edc61ca7d9c85f95ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 07:14:24 -0700
+Subject: ionic: use int type for err in ionic_get_module_eeprom_by_page
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit d586676a2714176bed06cf70467c4e08ac2d4681 ]
+
+The variable 'err' is declared as u32, but it is used to store
+negative error codes such as -EINVAL.
+
+Changing the type of 'err' to int ensures proper representation of
+negative error codes and aligns with standard kernel error handling
+conventions.
+
+Also, there is no need to initialize 'err' since it is always set
+before being used.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Shannon Nelson <sln@onemain.com>
+Reviewed-by: Brett Creeley <brett.creeley@amd.com>
+Link: https://patch.msgid.link/20250912141426.3922545-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+index 92f30ff2d6316..2d9efadb5d2ae 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+@@ -978,7 +978,7 @@ static int ionic_get_module_eeprom_by_page(struct net_device *netdev,
+ {
+ 	struct ionic_lif *lif = netdev_priv(netdev);
+ 	struct ionic_dev *idev = &lif->ionic->idev;
+-	u32 err = -EINVAL;
++	int err;
+ 	u8 *src;
+ 
+ 	if (!page_data->length)
+-- 
+2.51.0
+
diff --git a/queue-6.17/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-6.17/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..6cebc1dc74
--- /dev/null
+++ b/queue-6.17/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From d8fba19166a00588859eef4fa6fcef2f974caadf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index f17a5dd4789fb..40e9c336f6c55 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -7238,7 +7238,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		.procname	= "ioam6_enabled",
+-- 
+2.51.0
+
diff --git a/queue-6.17/ipv6-np-rxpmtu-race-annotation.patch b/queue-6.17/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..dc2730d215
--- /dev/null
+++ b/queue-6.17/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From 768e5d9454a0e4dbd63d7fa6282e8c3a98e50b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 4c3f8245c40f1..eceef8af1355f 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -445,7 +445,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 6a68f77da44b5..7f53fcc82a9ec 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -479,7 +479,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-6.17/ixgbe-reduce-number-of-reads-when-getting-orom-data.patch b/queue-6.17/ixgbe-reduce-number-of-reads-when-getting-orom-data.patch
new file mode 100644
index 0000000000..3b8d96eed5
--- /dev/null
+++ b/queue-6.17/ixgbe-reduce-number-of-reads-when-getting-orom-data.patch
@@ -0,0 +1,147 @@
+From b52de400acf32d50ff2dac58d7ba93c0967af093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 11:41:56 +0200
+Subject: ixgbe: reduce number of reads when getting OROM data
+
+From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+
+[ Upstream commit 08a1af326a80b88324acd73877db81ae927b1219 ]
+
+Currently, during locating the CIVD section, the ixgbe driver loops
+over the OROM area and at each iteration reads only OROM-datastruct-size
+amount of data. This results in many small reads and is inefficient.
+
+Optimize this by reading the entire OROM bank into memory once before
+entering the loop. This significantly reduces the probing time.
+
+Without this patch probing time may exceed over 25s, whereas with this
+patch applied average time of probe is not greater than 5s.
+
+without the patch:
+[14:12:22] ixgbe: Copyright (c) 1999-2016 Intel Corporation.
+[14:12:25] ixgbe 0000:21:00.0: Multiqueue Enabled: Rx Queue count = 63, Tx Queue count = 63 XDP Queue count = 0
+[14:12:25] ixgbe 0000:21:00.0: 63.012 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x4 link)
+[14:12:26] ixgbe 0000:21:00.0: MAC: 7, PHY: 27, PBA No: N55484-001
+[14:12:26] ixgbe 0000:21:00.0: 20:3a:43:09:3a:12
+[14:12:26] ixgbe 0000:21:00.0: Intel(R) 10 Gigabit Network Connection
+[14:12:50] ixgbe 0000:21:00.0 ens2f0np0: renamed from eth0
+
+with the patch:
+[14:18:18] ixgbe: Copyright (c) 1999-2016 Intel Corporation.
+[14:18:19] ixgbe 0000:21:00.0: Multiqueue Enabled: Rx Queue count = 63, Tx Queue count = 63 XDP Queue count = 0
+[14:18:19] ixgbe 0000:21:00.0: 63.012 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x4 link)
+[14:18:19] ixgbe 0000:21:00.0: MAC: 7, PHY: 27, PBA No: N55484-001
+[14:18:19] ixgbe 0000:21:00.0: 20:3a:43:09:3a:12
+[14:18:19] ixgbe 0000:21:00.0: Intel(R) 10 Gigabit Network Connection
+[14:18:22] ixgbe 0000:21:00.0 ens2f0np0: renamed from eth0
+
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
+Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 59 +++++++++++++------
+ 1 file changed, 40 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
+index bfeef5b0b99d8..e5f0399657097 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
+@@ -3008,50 +3008,71 @@ static int ixgbe_get_nvm_srev(struct ixgbe_hw *hw,
+  * Searches through the Option ROM flash contents to locate the CIVD data for
+  * the image.
+  *
+- * Return: the exit code of the operation.
++ * Return: -ENOMEM when cannot allocate memory, -EDOM for checksum violation,
++ *	   -ENODATA when cannot find proper data, -EIO for faulty read or
++ *	   0 on success.
++ *
++ *	   On success @civd stores collected data.
+  */
+ static int
+ ixgbe_get_orom_civd_data(struct ixgbe_hw *hw, enum ixgbe_bank_select bank,
+ 			 struct ixgbe_orom_civd_info *civd)
+ {
+-	struct ixgbe_orom_civd_info tmp;
++	u32 orom_size = hw->flash.banks.orom_size;
++	u8 *orom_data;
+ 	u32 offset;
+ 	int err;
+ 
++	orom_data = kzalloc(orom_size, GFP_KERNEL);
++	if (!orom_data)
++		return -ENOMEM;
++
++	err = ixgbe_read_flash_module(hw, bank,
++				      IXGBE_E610_SR_1ST_OROM_BANK_PTR, 0,
++				      orom_data, orom_size);
++	if (err) {
++		err = -EIO;
++		goto cleanup;
++	}
++
+ 	/* The CIVD section is located in the Option ROM aligned to 512 bytes.
+ 	 * The first 4 bytes must contain the ASCII characters "$CIV".
+ 	 * A simple modulo 256 sum of all of the bytes of the structure must
+ 	 * equal 0.
+ 	 */
+-	for (offset = 0; (offset + SZ_512) <= hw->flash.banks.orom_size;
+-	     offset += SZ_512) {
++	for (offset = 0; offset + SZ_512 <= orom_size; offset += SZ_512) {
++		struct ixgbe_orom_civd_info *tmp;
+ 		u8 sum = 0;
+ 		u32 i;
+ 
+-		err = ixgbe_read_flash_module(hw, bank,
+-					      IXGBE_E610_SR_1ST_OROM_BANK_PTR,
+-					      offset,
+-					      (u8 *)&tmp, sizeof(tmp));
+-		if (err)
+-			return err;
++		BUILD_BUG_ON(sizeof(*tmp) > SZ_512);
++
++		tmp = (struct ixgbe_orom_civd_info *)&orom_data[offset];
+ 
+ 		/* Skip forward until we find a matching signature */
+-		if (memcmp(IXGBE_OROM_CIV_SIGNATURE, tmp.signature,
+-			   sizeof(tmp.signature)))
++		if (memcmp(IXGBE_OROM_CIV_SIGNATURE, tmp->signature,
++			   sizeof(tmp->signature)))
+ 			continue;
+ 
+ 		/* Verify that the simple checksum is zero */
+-		for (i = 0; i < sizeof(tmp); i++)
+-			sum += ((u8 *)&tmp)[i];
++		for (i = 0; i < sizeof(*tmp); i++)
++			sum += ((u8 *)tmp)[i];
++
++		if (sum) {
++			err = -EDOM;
++			goto cleanup;
++		}
+ 
+-		if (sum)
+-			return -EDOM;
++		*civd = *tmp;
++		err = 0;
+ 
+-		*civd = tmp;
+-		return 0;
++		goto cleanup;
+ 	}
+ 
+-	return -ENODATA;
++	err = -ENODATA;
++cleanup:
++	kfree(orom_data);
++	return err;
+ }
+ 
+ /**
+-- 
+2.51.0
+
diff --git a/queue-6.17/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-6.17/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..3dc32fb43f
--- /dev/null
+++ b/queue-6.17/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From b5b8bee26abcf6dce991c3218895e52633c47463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index be17e3c43582f..7840a03e5bcb7 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-6.17/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-6.17/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..1a642fcd74
--- /dev/null
+++ b/queue-6.17/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From 452b89d695063f010a9c31b59ddf2f43b828df87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index fcedeb514e14a..21f3d029da7dd 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-6.17/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch b/queue-6.17/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
new file mode 100644
index 0000000000..1db8b5c429
--- /dev/null
+++ b/queue-6.17/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
@@ -0,0 +1,42 @@
+From ece8d3b84b4f971c364616612ab1500f1ef5a639 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:12:05 +0900
+Subject: ksmbd: use sock_create_kern interface to create kernel socket
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
+
+we should use sock_create_kern() if the socket resides in kernel space.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_tcp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
+index 1009cb324fd51..43401d09c9db4 100644
+--- a/fs/smb/server/transport_tcp.c
++++ b/fs/smb/server/transport_tcp.c
+@@ -473,12 +473,13 @@ static int create_socket(struct interface *iface)
+ 	struct socket *ksmbd_socket;
+ 	bool ipv4 = false;
+ 
+-	ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
++	ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM,
++			IPPROTO_TCP, &ksmbd_socket);
+ 	if (ret) {
+ 		if (ret != -EAFNOSUPPORT)
+ 			pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret);
+-		ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
+-				  &ksmbd_socket);
++		ret = sock_create_kern(current->nsproxy->net_ns, PF_INET,
++				SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+ 		if (ret) {
+ 			pr_err("Can't create socket for ipv4: %d\n", ret);
+ 			goto out_clear;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-adv7180-add-missing-lock-in-suspend-callback.patch b/queue-6.17/media-adv7180-add-missing-lock-in-suspend-callback.patch
new file mode 100644
index 0000000000..167bbfc495
--- /dev/null
+++ b/queue-6.17/media-adv7180-add-missing-lock-in-suspend-callback.patch
@@ -0,0 +1,57 @@
+From 4bd414241a0b244de626d1f468954a6ba503882d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:45 +0200
+Subject: media: adv7180: Add missing lock in suspend callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
+
+The adv7180_set_power() utilizes adv7180_write() which in turn requires
+the state mutex to be held, take it before calling adv7180_set_power()
+to avoid tripping a lockdep_assert_held().
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 5d90b8ab9b6df..84600fa75ae8a 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -813,6 +813,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		if (state->field != format->format.field) {
++			guard(mutex)(&state->mutex);
++
+ 			state->field = format->format.field;
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+@@ -1549,6 +1551,8 @@ static int adv7180_suspend(struct device *dev)
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	guard(mutex)(&state->mutex);
++
+ 	return adv7180_set_power(state, false);
+ }
+ 
+@@ -1562,6 +1566,8 @@ static int adv7180_resume(struct device *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	guard(mutex)(&state->mutex);
++
+ 	ret = adv7180_set_power(state, state->powered);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-adv7180-do-not-write-format-to-device-in-set_f.patch b/queue-6.17/media-adv7180-do-not-write-format-to-device-in-set_f.patch
new file mode 100644
index 0000000000..07bf3b3d1f
--- /dev/null
+++ b/queue-6.17/media-adv7180-do-not-write-format-to-device-in-set_f.patch
@@ -0,0 +1,50 @@
+From 09da5320ef08190fda6e33a0f817a5b5c57a8821 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:52 +0200
+Subject: media: adv7180: Do not write format to device in set_fmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
+
+The .set_fmt callback should not write the new format directly do the
+device, it should only store it and have it applied by .s_stream.
+
+The .s_stream callback already calls adv7180_set_field_mode() so it's
+safe to remove programming of the device and just store the format and
+have .s_stream apply it.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 84600fa75ae8a..8100fe6b0f1d4 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -812,14 +812,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 	ret = adv7180_mbus_fmt(sd,  &format->format);
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+-		if (state->field != format->format.field) {
+-			guard(mutex)(&state->mutex);
+-
+-			state->field = format->format.field;
+-			adv7180_set_power(state, false);
+-			adv7180_set_field_mode(state);
+-			adv7180_set_power(state, true);
+-		}
++		state->field = format->format.field;
+ 	} else {
+ 		framefmt = v4l2_subdev_state_get_format(sd_state, 0);
+ 		*framefmt = format->format;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-adv7180-only-validate-format-in-querystd.patch b/queue-6.17/media-adv7180-only-validate-format-in-querystd.patch
new file mode 100644
index 0000000000..5fdd4aec9e
--- /dev/null
+++ b/queue-6.17/media-adv7180-only-validate-format-in-querystd.patch
@@ -0,0 +1,85 @@
+From 9f767d0c20ed99c18f410c1a5ae6a74304d103b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:54 +0200
+Subject: media: adv7180: Only validate format in querystd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
+
+The .querystd callback should not program the device with the detected
+standard, it should only report the standard to user-space. User-space
+may then use .s_std to set the standard, if it wants to use it.
+
+All that is required of .querystd is to setup the auto detection of
+standards and report its findings.
+
+While at it add some documentation on why this can't happen while
+streaming and improve the error handling using a scoped guard.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 8100fe6b0f1d4..5accf3020e076 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -357,32 +357,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
+ static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int err = mutex_lock_interruptible(&state->mutex);
+-	if (err)
+-		return err;
+-
+-	if (state->streaming) {
+-		err = -EBUSY;
+-		goto unlock;
+-	}
++	int ret;
+ 
+-	err = adv7180_set_video_standard(state,
+-			ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+-	if (err)
+-		goto unlock;
++	guard(mutex)(&state->mutex);
+ 
+-	msleep(100);
+-	__adv7180_status(state, NULL, std);
++	/*
++	 * We can't sample the standard if the device is streaming as that would
++	 * interfere with the capture session as the VID_SEL reg is touched.
++	 */
++	if (state->streaming)
++		return -EBUSY;
+ 
+-	err = v4l2_std_to_adv7180(state->curr_norm);
+-	if (err < 0)
+-		goto unlock;
++	/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
++	ret = adv7180_set_video_standard(state,
++					 ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
++	if (ret)
++		return ret;
+ 
+-	err = adv7180_set_video_standard(state, err);
++	/* Allow some time for the autodetection to run. */
++	msleep(100);
+ 
+-unlock:
+-	mutex_unlock(&state->mutex);
+-	return err;
++	return __adv7180_status(state, NULL, std);
+ }
+ 
+ static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch b/queue-6.17/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
new file mode 100644
index 0000000000..ab6a399347
--- /dev/null
+++ b/queue-6.17/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
@@ -0,0 +1,91 @@
+From eeb64eb4721306d8ba9bc6bbe0a16309a8d7012d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:56 +0300
+Subject: media: amphion: Delete v4l2_fh synchronously in .release()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
+
+The v4l2_fh initialized and added in vpu_v4l2_open() is delete and
+cleaned up when the last reference to the vpu_inst is released. This may
+happen later than at vpu_v4l2_close() time.
+
+Not deleting and cleaning up the v4l2_fh when closing the file handle to
+the video device is not ideal, as the v4l2_fh will still be present in
+the video device's fh_list, and will store a copy of events queued to
+the video device. There may also be other side effects of keeping alive
+an object that represents an open file handle after the file handle is
+closed.
+
+The v4l2_fh instance is embedded in the vpu_inst structure, and is
+accessed in two different ways:
+
+- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2
+  events to the file handle ; and
+
+- through the driver to access the v4l2_fh.m2m_ctx pointer.
+
+The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and
+v4l2_fh_exit(). It is set to NULL by the driver when closing the file
+handle, in vpu_v4l2_close().
+
+The vpu_notify_eos() and vpu_notify_source_change() functions are called
+in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change()
+respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is
+therefore a guarantee that no new event will be queued to the v4l2_fh
+after vpu_v4l2_close() destroys the m2m_ctx.
+
+The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(),
+which is guaranteed to be called for all queued buffers when
+vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called
+later.
+
+It is therefore safe to assume that the driver will not touch the
+v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close()
+destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh
+synchronously in vpu_v4l2_close().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index 74668fa362e24..1c3740baf6942 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -718,8 +718,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)
+ 
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ 	mutex_destroy(&inst->lock);
+-	v4l2_fh_del(&inst->fh);
+-	v4l2_fh_exit(&inst->fh);
+ 
+ 	call_void_vop(inst, cleanup);
+ 
+@@ -788,6 +786,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
+ 
+ 	return 0;
+ error:
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
+ 	vpu_inst_put(inst);
+ 	return ret;
+ }
+@@ -807,6 +807,9 @@ int vpu_v4l2_close(struct file *file)
+ 	call_void_vop(inst, release);
+ 	vpu_inst_unlock(inst);
+ 
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
++
+ 	vpu_inst_unregister(inst);
+ 	vpu_inst_put(inst);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-fix-uninitialized-symbol-warnings.patch b/queue-6.17/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..ea9162c20a
--- /dev/null
+++ b/queue-6.17/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 9bb84773adbfaf906244c8234d97aea7bd11c487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index c84e1e0e6109a..5588cdd7ec20d 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 3cf54d776d36c..b44c97e4e5ec6 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch b/queue-6.17/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
new file mode 100644
index 0000000000..7d378c17cc
--- /dev/null
+++ b/queue-6.17/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
@@ -0,0 +1,42 @@
+From bf03e47ce55eee9e0d082aa80be46187850c4cac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 15:23:56 +0200
+Subject: media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for
+ VIDEO_CAMERA_SENSOR
+
+From: Mehdi Djait <mehdi.djait@linux.intel.com>
+
+[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
+
+Both ACPI and DT-based systems are required to obtain the external
+camera sensor clock using the new devm_v4l2_sensor_clk_get() helper
+function.
+
+Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is
+enabled.
+
+Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 6237fe804a5c8..1f5a3082ead9c 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -27,7 +27,7 @@ config VIDEO_IR_I2C
+ 
+ menuconfig VIDEO_CAMERA_SENSOR
+ 	bool "Camera sensor devices"
+-	depends on MEDIA_CAMERA_SUPPORT && I2C
++	depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK
+ 	select MEDIA_CONTROLLER
+ 	select V4L2_FWNODE
+ 	select VIDEO_V4L2_SUBDEV_API
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch b/queue-6.17/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
new file mode 100644
index 0000000000..eb63e30755
--- /dev/null
+++ b/queue-6.17/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
@@ -0,0 +1,59 @@
+From 81c8c9785d0d642b78064950439615c5c71d90d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 16:22:06 +0300
+Subject: media: i2c: og01a1b: Specify monochrome media bus format instead of
+ Bayer
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
+
+The OmniVision OG01A1B image sensor is a monochrome sensor, it supports
+8-bit and 10-bit RAW output formats only.
+
+That said the planar greyscale Y8/Y10 media formats are more appropriate
+for the sensor instead of the originally and arbitrary selected SGRBG one,
+since there is no red, green or blue color components.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/og01a1b.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
+index 78d5d406e4b72..b7d0b677975d5 100644
+--- a/drivers/media/i2c/og01a1b.c
++++ b/drivers/media/i2c/og01a1b.c
+@@ -682,7 +682,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode,
+ {
+ 	fmt->width = mode->width;
+ 	fmt->height = mode->height;
+-	fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->code = MEDIA_BUS_FMT_Y10_1X10;
+ 	fmt->field = V4L2_FIELD_NONE;
+ }
+ 
+@@ -828,7 +828,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = MEDIA_BUS_FMT_Y10_1X10;
+ 
+ 	return 0;
+ }
+@@ -840,7 +840,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,
+ 	if (fse->index >= ARRAY_SIZE(supported_modes))
+ 		return -EINVAL;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = supported_modes[fse->index].width;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-imon-make-send_packet-more-robust.patch b/queue-6.17/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..9f921ffbfb
--- /dev/null
+++ b/queue-6.17/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 6e6d46cd76d8627333be9081028cb4cefa217f75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index cf3e6e43c0c7e..8668d53c0d426 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-imx-mipi-csis-only-set-clock-rate-when-specifi.patch b/queue-6.17/media-imx-mipi-csis-only-set-clock-rate-when-specifi.patch
new file mode 100644
index 0000000000..6ebd60f677
--- /dev/null
+++ b/queue-6.17/media-imx-mipi-csis-only-set-clock-rate-when-specifi.patch
@@ -0,0 +1,87 @@
+From 22b534430a99fc967254dfd7c7b607352dd1e355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 03:27:29 +0300
+Subject: media: imx-mipi-csis: Only set clock rate when specified in DT
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+[ Upstream commit 65673c6e33cf46f220cc5774166b373b3c087739 ]
+
+The imx-mipi-csis driver sets the rate of the wrap clock to the value
+specified in the device tree's "clock-frequency" property, and defaults
+to 166 MHz otherwise. This is a historical mistake, as clock rate
+selection should have been left to the assigned-clock-rates property.
+
+Honouring the clock-frequency property can't be removed without breaking
+backwards compatibility, and the corresponding code isn't very
+intrusive. The 166 MHz default, on the other hand, prevents
+configuration of the clock rate through assigned-clock-rates, as the
+driver immediately overwrites the rate. This behaviour is confusing and
+has cost debugging time.
+
+There is little value in a 166 MHz default. All mainline device tree
+sources that enable the CSIS specify a clock-frequency explicitly, and
+the default wrap clock configuration on supported platforms is at least
+as high as 166 MHz. Drop the default, and only set the clock rate
+manually when the clock-frequency property is specified.
+
+Link: https://lore.kernel.org/r/20250822002734.23516-10-laurent.pinchart@ideasonboard.com
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/nxp/imx-mipi-csis.c | 23 +++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c
+index 2beb5f43c2c01..cea017a2b14ec 100644
+--- a/drivers/media/platform/nxp/imx-mipi-csis.c
++++ b/drivers/media/platform/nxp/imx-mipi-csis.c
+@@ -228,8 +228,6 @@
+ #define MIPI_CSIS_PKTDATA_EVEN			0x3000
+ #define MIPI_CSIS_PKTDATA_SIZE			SZ_4K
+ 
+-#define DEFAULT_SCLK_CSIS_FREQ			166000000UL
+-
+ struct mipi_csis_event {
+ 	bool debug;
+ 	u32 mask;
+@@ -704,12 +702,17 @@ static int mipi_csis_clk_get(struct mipi_csis_device *csis)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	/* Set clock rate */
+-	ret = clk_set_rate(csis->clks[MIPI_CSIS_CLK_WRAP].clk,
+-			   csis->clk_frequency);
+-	if (ret < 0)
+-		dev_err(csis->dev, "set rate=%d failed: %d\n",
+-			csis->clk_frequency, ret);
++	if (csis->clk_frequency) {
++		/*
++		 * Set the clock rate. This is deprecated, for backward
++		 * compatibility with old device trees.
++		 */
++		ret = clk_set_rate(csis->clks[MIPI_CSIS_CLK_WRAP].clk,
++				   csis->clk_frequency);
++		if (ret < 0)
++			dev_err(csis->dev, "set rate=%d failed: %d\n",
++				csis->clk_frequency, ret);
++	}
+ 
+ 	return ret;
+ }
+@@ -1413,9 +1416,7 @@ static int mipi_csis_parse_dt(struct mipi_csis_device *csis)
+ {
+ 	struct device_node *node = csis->dev->of_node;
+ 
+-	if (of_property_read_u32(node, "clock-frequency",
+-				 &csis->clk_frequency))
+-		csis->clk_frequency = DEFAULT_SCLK_CSIS_FREQ;
++	of_property_read_u32(node, "clock-frequency", &csis->clk_frequency);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-ipu6-isys-set-embedded-data-type-correctly-for.patch b/queue-6.17/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
new file mode 100644
index 0000000000..12ef2b1bdd
--- /dev/null
+++ b/queue-6.17/media-ipu6-isys-set-embedded-data-type-correctly-for.patch
@@ -0,0 +1,40 @@
+From 1ef0c97efff1f7e6cafd18e01bf4a1900d147ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 May 2025 11:06:16 +0300
+Subject: media: ipu6: isys: Set embedded data type correctly for metadata
+ formats
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit f5a2826cd50c6fd1af803812d1d910a64ae8e0a1 ]
+
+The IPU6 ISYS driver supported metadata formats but was missing correct
+embedded data type in the receiver configuration. Add it now.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c b/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
+index 0a06de5c739c7..463a0adf9e131 100644
+--- a/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
++++ b/drivers/media/pci/intel/ipu6/ipu6-isys-subdev.c
+@@ -81,6 +81,12 @@ unsigned int ipu6_isys_mbus_code_to_mipi(u32 code)
+ 	case MEDIA_BUS_FMT_SGRBG8_1X8:
+ 	case MEDIA_BUS_FMT_SRGGB8_1X8:
+ 		return MIPI_CSI2_DT_RAW8;
++	case MEDIA_BUS_FMT_META_8:
++	case MEDIA_BUS_FMT_META_10:
++	case MEDIA_BUS_FMT_META_12:
++	case MEDIA_BUS_FMT_META_16:
++	case MEDIA_BUS_FMT_META_24:
++		return MIPI_CSI2_DT_EMBEDDED_8B;
+ 	default:
+ 		/* return unavailable MIPI data type - 0x3f */
+ 		WARN_ON(1);
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-nxp-imx8-isi-fix-streaming-cleanup-on-release.patch b/queue-6.17/media-nxp-imx8-isi-fix-streaming-cleanup-on-release.patch
new file mode 100644
index 0000000000..158342b3e5
--- /dev/null
+++ b/queue-6.17/media-nxp-imx8-isi-fix-streaming-cleanup-on-release.patch
@@ -0,0 +1,286 @@
+From 637e14b616799db6105b87c62d81094ac7695578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 00:24:50 +0300
+Subject: media: nxp: imx8-isi: Fix streaming cleanup on release
+
+From: Richard Leitner <richard.leitner@linux.dev>
+
+[ Upstream commit 47773031a148ad7973b809cc7723cba77eda2b42 ]
+
+The current implementation unconditionally calls
+mxc_isi_video_cleanup_streaming() in mxc_isi_video_release(). This can
+lead to situations where any release call (like from a simple
+"v4l2-ctl -l") may release a currently streaming queue when called on
+such a device.
+
+This is reproducible on an i.MX8MP board by streaming from an ISI
+capture device using gstreamer:
+
+	gst-launch-1.0 -v v4l2src device=/dev/videoX ! \
+	    video/x-raw,format=GRAY8,width=1280,height=800,framerate=1/120 ! \
+	    fakesink
+
+While this stream is running, querying the caps of the same device
+provokes the error state:
+
+	v4l2-ctl -l -d /dev/videoX
+
+This results in the following trace:
+
+[  155.452152] ------------[ cut here ]------------
+[  155.452163] WARNING: CPU: 0 PID: 1708 at drivers/media/platform/nxp/imx8-isi/imx8-isi-pipe.c:713 mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]
+[  157.004248] Modules linked in: cfg80211 rpmsg_ctrl rpmsg_char rpmsg_tty virtio_rpmsg_bus rpmsg_ns rpmsg_core rfkill nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables mcp251x6
+[  157.053499] CPU: 0 UID: 0 PID: 1708 Comm: python3 Not tainted 6.15.4-00114-g1f61ca5cad76 #1 PREEMPT
+[  157.064369] Hardware name: imx8mp_board_01 (DT)
+[  157.068205] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[  157.075169] pc : mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi]
+[  157.081195] lr : mxc_isi_pipe_irq_handler+0x38/0x1b0 [imx8_isi]
+[  157.087126] sp : ffff800080003ee0
+[  157.090438] x29: ffff800080003ee0 x28: ffff0000c3688000 x27: 0000000000000000
+[  157.097580] x26: 0000000000000000 x25: ffff0000c1e7ac00 x24: ffff800081b5ad50
+[  157.104723] x23: 00000000000000d1 x22: 0000000000000000 x21: ffff0000c25e4000
+[  157.111866] x20: 0000000060000200 x19: ffff80007a0608d0 x18: 0000000000000000
+[  157.119008] x17: ffff80006a4e3000 x16: ffff800080000000 x15: 0000000000000000
+[  157.126146] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
+[  157.133287] x11: 0000000000000040 x10: ffff0000c01445f0 x9 : ffff80007a053a38
+[  157.140425] x8 : ffff0000c04004b8 x7 : 0000000000000000 x6 : 0000000000000000
+[  157.147567] x5 : ffff0000c0400490 x4 : ffff80006a4e3000 x3 : ffff0000c25e4000
+[  157.154706] x2 : 0000000000000000 x1 : ffff8000825c0014 x0 : 0000000060000200
+[  157.161850] Call trace:
+[  157.164296]  mxc_isi_pipe_irq_handler+0x19c/0x1b0 [imx8_isi] (P)
+[  157.170319]  __handle_irq_event_percpu+0x58/0x218
+[  157.175029]  handle_irq_event+0x54/0xb8
+[  157.178867]  handle_fasteoi_irq+0xac/0x248
+[  157.182968]  handle_irq_desc+0x48/0x68
+[  157.186723]  generic_handle_domain_irq+0x24/0x38
+[  157.191346]  gic_handle_irq+0x54/0x120
+[  157.195098]  call_on_irq_stack+0x24/0x30
+[  157.199027]  do_interrupt_handler+0x88/0x98
+[  157.203212]  el0_interrupt+0x44/0xc0
+[  157.206792]  __el0_irq_handler_common+0x18/0x28
+[  157.211328]  el0t_64_irq_handler+0x10/0x20
+[  157.215429]  el0t_64_irq+0x198/0x1a0
+[  157.219009] ---[ end trace 0000000000000000 ]---
+
+Address this issue by moving the streaming preparation and cleanup to
+the vb2 .prepare_streaming() and .unprepare_streaming() operations. This
+also simplifies the driver by allowing direct usage of the
+vb2_ioctl_streamon() and vb2_ioctl_streamoff() helpers, and removal of
+the manual cleanup from mxc_isi_video_release().
+
+Link: https://lore.kernel.org/r/20250813212451.22140-2-laurent.pinchart@ideasonboard.com
+Signed-off-by: Richard Leitner <richard.leitner@linux.dev>
+Co-developed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Richard Leitner <richard.leitner@linux.dev> # i.MX8MP
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/nxp/imx8-isi/imx8-isi-video.c    | 156 +++++++-----------
+ 1 file changed, 58 insertions(+), 98 deletions(-)
+
+diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+index 8654150728a86..042b554d2775a 100644
+--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
++++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+@@ -937,6 +937,49 @@ static void mxc_isi_video_init_channel(struct mxc_isi_video *video)
+ 	mxc_isi_channel_set_output_format(pipe, video->fmtinfo, &video->pix);
+ }
+ 
++static int mxc_isi_vb2_prepare_streaming(struct vb2_queue *q)
++{
++	struct mxc_isi_video *video = vb2_get_drv_priv(q);
++	struct media_device *mdev = &video->pipe->isi->media_dev;
++	struct media_pipeline *pipe;
++	int ret;
++
++	/* Get a pipeline for the video node and start it. */
++	scoped_guard(mutex, &mdev->graph_mutex) {
++		ret = mxc_isi_pipe_acquire(video->pipe,
++					   &mxc_isi_video_frame_write_done);
++		if (ret)
++			return ret;
++
++		pipe = media_entity_pipeline(&video->vdev.entity)
++		     ? : &video->pipe->pipe;
++
++		ret = __video_device_pipeline_start(&video->vdev, pipe);
++		if (ret)
++			goto err_release;
++	}
++
++	/* Verify that the video format matches the output of the subdev. */
++	ret = mxc_isi_video_validate_format(video);
++	if (ret)
++		goto err_stop;
++
++	/* Allocate buffers for discard operation. */
++	ret = mxc_isi_video_alloc_discard_buffers(video);
++	if (ret)
++		goto err_stop;
++
++	video->is_streaming = true;
++
++	return 0;
++
++err_stop:
++	video_device_pipeline_stop(&video->vdev);
++err_release:
++	mxc_isi_pipe_release(video->pipe);
++	return ret;
++}
++
+ static int mxc_isi_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
+ {
+ 	struct mxc_isi_video *video = vb2_get_drv_priv(q);
+@@ -985,13 +1028,26 @@ static void mxc_isi_vb2_stop_streaming(struct vb2_queue *q)
+ 	mxc_isi_video_return_buffers(video, VB2_BUF_STATE_ERROR);
+ }
+ 
++static void mxc_isi_vb2_unprepare_streaming(struct vb2_queue *q)
++{
++	struct mxc_isi_video *video = vb2_get_drv_priv(q);
++
++	mxc_isi_video_free_discard_buffers(video);
++	video_device_pipeline_stop(&video->vdev);
++	mxc_isi_pipe_release(video->pipe);
++
++	video->is_streaming = false;
++}
++
+ static const struct vb2_ops mxc_isi_vb2_qops = {
+ 	.queue_setup		= mxc_isi_vb2_queue_setup,
+ 	.buf_init		= mxc_isi_vb2_buffer_init,
+ 	.buf_prepare		= mxc_isi_vb2_buffer_prepare,
+ 	.buf_queue		= mxc_isi_vb2_buffer_queue,
++	.prepare_streaming	= mxc_isi_vb2_prepare_streaming,
+ 	.start_streaming	= mxc_isi_vb2_start_streaming,
+ 	.stop_streaming		= mxc_isi_vb2_stop_streaming,
++	.unprepare_streaming	= mxc_isi_vb2_unprepare_streaming,
+ };
+ 
+ /* -----------------------------------------------------------------------------
+@@ -1145,97 +1201,6 @@ static int mxc_isi_video_s_fmt(struct file *file, void *priv,
+ 	return 0;
+ }
+ 
+-static int mxc_isi_video_streamon(struct file *file, void *priv,
+-				  enum v4l2_buf_type type)
+-{
+-	struct mxc_isi_video *video = video_drvdata(file);
+-	struct media_device *mdev = &video->pipe->isi->media_dev;
+-	struct media_pipeline *pipe;
+-	int ret;
+-
+-	if (vb2_queue_is_busy(&video->vb2_q, file))
+-		return -EBUSY;
+-
+-	/*
+-	 * Get a pipeline for the video node and start it. This must be done
+-	 * here and not in the queue .start_streaming() handler, so that
+-	 * pipeline start errors can be reported from VIDIOC_STREAMON and not
+-	 * delayed until subsequent VIDIOC_QBUF calls.
+-	 */
+-	mutex_lock(&mdev->graph_mutex);
+-
+-	ret = mxc_isi_pipe_acquire(video->pipe, &mxc_isi_video_frame_write_done);
+-	if (ret) {
+-		mutex_unlock(&mdev->graph_mutex);
+-		return ret;
+-	}
+-
+-	pipe = media_entity_pipeline(&video->vdev.entity) ? : &video->pipe->pipe;
+-
+-	ret = __video_device_pipeline_start(&video->vdev, pipe);
+-	if (ret) {
+-		mutex_unlock(&mdev->graph_mutex);
+-		goto err_release;
+-	}
+-
+-	mutex_unlock(&mdev->graph_mutex);
+-
+-	/* Verify that the video format matches the output of the subdev. */
+-	ret = mxc_isi_video_validate_format(video);
+-	if (ret)
+-		goto err_stop;
+-
+-	/* Allocate buffers for discard operation. */
+-	ret = mxc_isi_video_alloc_discard_buffers(video);
+-	if (ret)
+-		goto err_stop;
+-
+-	ret = vb2_streamon(&video->vb2_q, type);
+-	if (ret)
+-		goto err_free;
+-
+-	video->is_streaming = true;
+-
+-	return 0;
+-
+-err_free:
+-	mxc_isi_video_free_discard_buffers(video);
+-err_stop:
+-	video_device_pipeline_stop(&video->vdev);
+-err_release:
+-	mxc_isi_pipe_release(video->pipe);
+-	return ret;
+-}
+-
+-static void mxc_isi_video_cleanup_streaming(struct mxc_isi_video *video)
+-{
+-	lockdep_assert_held(&video->lock);
+-
+-	if (!video->is_streaming)
+-		return;
+-
+-	mxc_isi_video_free_discard_buffers(video);
+-	video_device_pipeline_stop(&video->vdev);
+-	mxc_isi_pipe_release(video->pipe);
+-
+-	video->is_streaming = false;
+-}
+-
+-static int mxc_isi_video_streamoff(struct file *file, void *priv,
+-				   enum v4l2_buf_type type)
+-{
+-	struct mxc_isi_video *video = video_drvdata(file);
+-	int ret;
+-
+-	ret = vb2_ioctl_streamoff(file, priv, type);
+-	if (ret)
+-		return ret;
+-
+-	mxc_isi_video_cleanup_streaming(video);
+-
+-	return 0;
+-}
+-
+ static int mxc_isi_video_enum_framesizes(struct file *file, void *priv,
+ 					 struct v4l2_frmsizeenum *fsize)
+ {
+@@ -1291,9 +1256,8 @@ static const struct v4l2_ioctl_ops mxc_isi_video_ioctl_ops = {
+ 	.vidioc_expbuf			= vb2_ioctl_expbuf,
+ 	.vidioc_prepare_buf		= vb2_ioctl_prepare_buf,
+ 	.vidioc_create_bufs		= vb2_ioctl_create_bufs,
+-
+-	.vidioc_streamon		= mxc_isi_video_streamon,
+-	.vidioc_streamoff		= mxc_isi_video_streamoff,
++	.vidioc_streamon		= vb2_ioctl_streamon,
++	.vidioc_streamoff		= vb2_ioctl_streamoff,
+ 
+ 	.vidioc_enum_framesizes		= mxc_isi_video_enum_framesizes,
+ 
+@@ -1332,10 +1296,6 @@ static int mxc_isi_video_release(struct file *file)
+ 	if (ret)
+ 		dev_err(video->pipe->isi->dev, "%s fail\n", __func__);
+ 
+-	mutex_lock(&video->lock);
+-	mxc_isi_video_cleanup_streaming(video);
+-	mutex_unlock(&video->lock);
+-
+ 	pm_runtime_put(video->pipe->isi->dev);
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-ov08x40-fix-the-horizontal-flip-control.patch b/queue-6.17/media-ov08x40-fix-the-horizontal-flip-control.patch
new file mode 100644
index 0000000000..4138835506
--- /dev/null
+++ b/queue-6.17/media-ov08x40-fix-the-horizontal-flip-control.patch
@@ -0,0 +1,39 @@
+From 548cb6371798e72ead872ef60deeb06bf79bf0f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:33:25 +0800
+Subject: media: ov08x40: Fix the horizontal flip control
+
+From: Hao Yao <hao.yao@intel.com>
+
+[ Upstream commit c7df6f339af94689fdc433887f9fbb480bf8a4ed ]
+
+The datasheet of ov08x40 doesn't match the hardware behavior.
+0x3821[2] == 1 is the original state and 0 the horizontal flip enabled.
+
+Signed-off-by: Hao Yao <hao.yao@intel.com>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Tested-by: Hans de Goede <hansg@kernel.org> # ThinkPad X1 Carbon Gen 12 & Gen 13
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov08x40.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov08x40.c b/drivers/media/i2c/ov08x40.c
+index e0094305ca2ab..90887fc54fb0e 100644
+--- a/drivers/media/i2c/ov08x40.c
++++ b/drivers/media/i2c/ov08x40.c
+@@ -1648,7 +1648,7 @@ static int ov08x40_set_ctrl_hflip(struct ov08x40 *ov08x, u32 ctrl_val)
+ 
+ 	return ov08x40_write_reg(ov08x, OV08X40_REG_MIRROR,
+ 				 OV08X40_REG_VALUE_08BIT,
+-				 ctrl_val ? val | BIT(2) : val & ~BIT(2));
++				 ctrl_val ? val & ~BIT(2) : val | BIT(2));
+ }
+ 
+ static int ov08x40_set_ctrl_vflip(struct ov08x40 *ov08x, u32 ctrl_val)
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-6.17/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..ea66c66fb2
--- /dev/null
+++ b/queue-6.17/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From a8127e72a72c7745224caab81436913b0778ef1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index a6ffa99e16bc6..83818048f7fe4 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -322,6 +322,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -331,7 +332,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index cfa28d0355863..1ac8d691df5cd 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -39,16 +39,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -56,7 +56,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -94,7 +94,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -126,7 +126,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -359,7 +359,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -831,7 +831,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -915,7 +915,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index 4d63daa01eed2..078d9cd77c710 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch b/queue-6.17/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
new file mode 100644
index 0000000000..8579ac6dd5
--- /dev/null
+++ b/queue-6.17/media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
@@ -0,0 +1,40 @@
+From 3a9a384cdce633c4f7ac89fe1f90426217bb5c06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:29 +0200
+Subject: media: pci: mgb4: Fix timings comparison in VIDIOC_S_DV_TIMINGS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Tůma <martin.tuma@digiteqautomotive.com>
+
+[ Upstream commit 0750649b528ff18d1d68aecb45b34ec22d5ab778 ]
+
+Compare the whole v4l2_bt_timings struct, not just the width/height when
+setting new timings. Timings with the same resolution and different
+pixelclock can now be properly set.
+
+Signed-off-by: Martin Tůma <martin.tuma@digiteqautomotive.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/mgb4/mgb4_vin.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/mgb4/mgb4_vin.c b/drivers/media/pci/mgb4/mgb4_vin.c
+index 989e93f67f75b..42c327bc50e10 100644
+--- a/drivers/media/pci/mgb4/mgb4_vin.c
++++ b/drivers/media/pci/mgb4/mgb4_vin.c
+@@ -610,8 +610,7 @@ static int vidioc_s_dv_timings(struct file *file, void *fh,
+ 	    timings->bt.height < video_timings_cap.bt.min_height ||
+ 	    timings->bt.height > video_timings_cap.bt.max_height)
+ 		return -EINVAL;
+-	if (timings->bt.width == vindev->timings.bt.width &&
+-	    timings->bt.height == vindev->timings.bt.height)
++	if (v4l2_match_dv_timings(timings, &vindev->timings, 0, false))
+ 		return 0;
+ 	if (vb2_is_busy(&vindev->queue))
+ 		return -EBUSY;
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-qcom-camss-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch b/queue-6.17/media-qcom-camss-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch
new file mode 100644
index 0000000000..5fabf93f8e
--- /dev/null
+++ b/queue-6.17/media-qcom-camss-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch
@@ -0,0 +1,152 @@
+From ccac0fcd40d5b5b3797f07a810e677e3906bd6e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 10:32:19 +0200
+Subject: media: qcom: camss: csiphy-3ph: Add CSIPHY 2ph DPHY v2.0.1 init
+ sequence
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit ce63fbdf849f52584d9b5d9a4cc23cbc88746c30 ]
+
+This is the CSI PHY version found in QCS2290/QCM2290 SoCs.
+The table is extracted from downstream camera driver.
+
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../qcom/camss/camss-csiphy-3ph-1-0.c         | 89 +++++++++++++++++++
+ drivers/media/platform/qcom/camss/camss.h     |  1 +
+ 2 files changed, 90 insertions(+)
+
+diff --git a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+index 88c0ba495c327..a128a42f1303d 100644
+--- a/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
++++ b/drivers/media/platform/qcom/camss/camss-csiphy-3ph-1-0.c
+@@ -319,6 +319,90 @@ csiphy_lane_regs lane_regs_sm8250[] = {
+ 	{0x0884, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
+ };
+ 
++/* 14nm 2PH v 2.0.1 2p5Gbps 4 lane DPHY mode */
++static const struct
++csiphy_lane_regs lane_regs_qcm2290[] = {
++	{0x0030, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x002c, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0034, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0028, 0x04, 0x00, CSIPHY_DNP_PARAMS},
++	{0x003c, 0xb8, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x001c, 0x0a, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0000, 0xd7, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0004, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0020, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0008, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
++	{0x000c, 0xff, 0x00, CSIPHY_DNP_PARAMS},
++	{0x0010, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0038, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0060, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0064, 0x3f, 0x00, CSIPHY_DEFAULT_PARAMS},
++
++	{0x0730, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x072c, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0734, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0728, 0x04, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x073c, 0xb8, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x071c, 0x0a, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0700, 0xc0, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0704, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0720, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0708, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
++	{0x070c, 0xff, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0710, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0738, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0760, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0764, 0x3f, 0x00, CSIPHY_DEFAULT_PARAMS},
++
++	{0x0230, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x022c, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0234, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0228, 0x04, 0x00, CSIPHY_DNP_PARAMS},
++	{0x023c, 0xb8, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x021c, 0x0a, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0200, 0xd7, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0204, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0220, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0208, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
++	{0x020c, 0xff, 0x00, CSIPHY_DNP_PARAMS},
++	{0x0210, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0238, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0260, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0264, 0x3f, 0x00, CSIPHY_DEFAULT_PARAMS},
++
++	{0x0430, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x042c, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0434, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0428, 0x04, 0x00, CSIPHY_DNP_PARAMS},
++	{0x043c, 0xb8, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x041c, 0x0a, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0400, 0xd7, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0404, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0420, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0408, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
++	{0x040C, 0xff, 0x00, CSIPHY_DNP_PARAMS},
++	{0x0410, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0438, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0460, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0464, 0x3f, 0x00, CSIPHY_DEFAULT_PARAMS},
++
++	{0x0630, 0x02, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x062c, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0634, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0628, 0x04, 0x00, CSIPHY_DNP_PARAMS},
++	{0x063c, 0xb8, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x061c, 0x0a, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0600, 0xd7, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0604, 0x08, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0620, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0608, 0x04, 0x00, CSIPHY_SETTLE_CNT_LOWER_BYTE},
++	{0x060C, 0xff, 0x00, CSIPHY_DNP_PARAMS},
++	{0x0610, 0x50, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0638, 0x01, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0660, 0x00, 0x00, CSIPHY_DEFAULT_PARAMS},
++	{0x0664, 0x3f, 0x00, CSIPHY_DEFAULT_PARAMS},
++};
++
+ /* GEN2 2.1.2 2PH DPHY mode */
+ static const struct
+ csiphy_lane_regs lane_regs_sm8550[] = {
+@@ -744,6 +828,7 @@ static bool csiphy_is_gen2(u32 version)
+ 	bool ret = false;
+ 
+ 	switch (version) {
++	case CAMSS_2290:
+ 	case CAMSS_7280:
+ 	case CAMSS_8250:
+ 	case CAMSS_8280XP:
+@@ -829,6 +914,10 @@ static int csiphy_init(struct csiphy_device *csiphy)
+ 		regs->lane_regs = &lane_regs_sdm845[0];
+ 		regs->lane_array_size = ARRAY_SIZE(lane_regs_sdm845);
+ 		break;
++	case CAMSS_2290:
++		regs->lane_regs = &lane_regs_qcm2290[0];
++		regs->lane_array_size = ARRAY_SIZE(lane_regs_qcm2290);
++		break;
+ 	case CAMSS_7280:
+ 	case CAMSS_8250:
+ 		regs->lane_regs = &lane_regs_sm8250[0];
+diff --git a/drivers/media/platform/qcom/camss/camss.h b/drivers/media/platform/qcom/camss/camss.h
+index 63c0afee154a0..377707d91ff2f 100644
+--- a/drivers/media/platform/qcom/camss/camss.h
++++ b/drivers/media/platform/qcom/camss/camss.h
+@@ -78,6 +78,7 @@ enum pm_domain {
+ 
+ enum camss_version {
+ 	CAMSS_660,
++	CAMSS_2290,
+ 	CAMSS_7280,
+ 	CAMSS_8x16,
+ 	CAMSS_8x53,
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-6.17/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..43351a2fe5
--- /dev/null
+++ b/queue-6.17/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From eae0f47857fb2ed3403a82dc7dd88703e07e5a9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index d89a4cfe3c895..a49173f54a4d0 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-6.17/media-verisilicon-explicitly-disable-selection-api-i.patch b/queue-6.17/media-verisilicon-explicitly-disable-selection-api-i.patch
new file mode 100644
index 0000000000..216cc5e5a6
--- /dev/null
+++ b/queue-6.17/media-verisilicon-explicitly-disable-selection-api-i.patch
@@ -0,0 +1,64 @@
+From 1e6c2cc584c0107e4905841ab06934732b2f2e03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:49:18 +0200
+Subject: media: verisilicon: Explicitly disable selection api ioctls for
+ decoders
+
+From: Paul Kocialkowski <paulk@sys-base.io>
+
+[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
+
+Call the dedicated v4l2_disable_ioctl helper instead of manually
+checking whether the current context is an encoder for the selection
+api ioctls.
+
+Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index fa972effd4a2c..9d5e50fedae1f 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -917,6 +917,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+ 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION);
+ 	}
+ 
+ 	video_set_drvdata(vfd, vpu);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index 7c3515cf7d64a..4598f9b4bd21c 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -663,8 +663,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
+ 	struct hantro_ctx *ctx = fh_to_ctx(priv);
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	switch (sel->target) {
+@@ -696,8 +695,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
+ 	struct vb2_queue *vq;
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	/* Change not allowed if the queue is streaming. */
+-- 
+2.51.0
+
diff --git a/queue-6.17/mei-make-a-local-copy-of-client-uuid-in-connect.patch b/queue-6.17/mei-make-a-local-copy-of-client-uuid-in-connect.patch
new file mode 100644
index 0000000000..dd80e81ed5
--- /dev/null
+++ b/queue-6.17/mei-make-a-local-copy-of-client-uuid-in-connect.patch
@@ -0,0 +1,87 @@
+From ab7c319de1ecc1af628c4aba328a761b97228510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 16:04:32 +0300
+Subject: mei: make a local copy of client uuid in connect
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+[ Upstream commit bb29fc32ae56393269d8fe775159fd59e45682d1 ]
+
+Connect ioctl has the same memory for in and out parameters.
+Copy in parameter (client uuid) to the local stack to avoid it be
+overwritten by out parameters fill.
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20250918130435.3327400-3-alexander.usyskin@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mei/main.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 8a149a15b8610..77e7b641b8e97 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -641,7 +641,7 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
+ 	struct mei_cl *cl = file->private_data;
+ 	struct mei_connect_client_data conn;
+ 	struct mei_connect_client_data_vtag conn_vtag;
+-	const uuid_le *cl_uuid;
++	uuid_le cl_uuid;
+ 	struct mei_client *props;
+ 	u8 vtag;
+ 	u32 notify_get, notify_req;
+@@ -669,18 +669,18 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
+ 			rets = -EFAULT;
+ 			goto out;
+ 		}
+-		cl_uuid = &conn.in_client_uuid;
++		cl_uuid = conn.in_client_uuid;
+ 		props = &conn.out_client_properties;
+ 		vtag = 0;
+ 
+-		rets = mei_vt_support_check(dev, cl_uuid);
++		rets = mei_vt_support_check(dev, &cl_uuid);
+ 		if (rets == -ENOTTY)
+ 			goto out;
+ 		if (!rets)
+-			rets = mei_ioctl_connect_vtag(file, cl_uuid, props,
++			rets = mei_ioctl_connect_vtag(file, &cl_uuid, props,
+ 						      vtag);
+ 		else
+-			rets = mei_ioctl_connect_client(file, cl_uuid, props);
++			rets = mei_ioctl_connect_client(file, &cl_uuid, props);
+ 		if (rets)
+ 			goto out;
+ 
+@@ -702,14 +702,14 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
+ 			goto out;
+ 		}
+ 
+-		cl_uuid = &conn_vtag.connect.in_client_uuid;
++		cl_uuid = conn_vtag.connect.in_client_uuid;
+ 		props = &conn_vtag.out_client_properties;
+ 		vtag = conn_vtag.connect.vtag;
+ 
+-		rets = mei_vt_support_check(dev, cl_uuid);
++		rets = mei_vt_support_check(dev, &cl_uuid);
+ 		if (rets == -EOPNOTSUPP)
+ 			cl_dbg(dev, cl, "FW Client %pUl does not support vtags\n",
+-				cl_uuid);
++				&cl_uuid);
+ 		if (rets)
+ 			goto out;
+ 
+@@ -719,7 +719,7 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
+ 			goto out;
+ 		}
+ 
+-		rets = mei_ioctl_connect_vtag(file, cl_uuid, props, vtag);
++		rets = mei_ioctl_connect_vtag(file, &cl_uuid, props, vtag);
+ 		if (rets)
+ 			goto out;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch b/queue-6.17/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
new file mode 100644
index 0000000000..cad80e33d9
--- /dev/null
+++ b/queue-6.17/microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
@@ -0,0 +1,44 @@
+From 8aebfbeaf86e201938f4c6a744b1f1f14b717e8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 17:15:49 +0530
+Subject: microchip: lan865x: add ndo_eth_ioctl handler to enable PHY ioctl
+ support
+
+From: Parthiban Veerasooran <parthiban.veerasooran@microchip.com>
+
+[ Upstream commit 34c21e91192aa1ff66f9d6cef8132717840d04e6 ]
+
+Introduce support for standard MII ioctl operations in the LAN865x
+Ethernet driver by implementing the .ndo_eth_ioctl callback. This allows
+PHY-related ioctl commands to be handled via phy_do_ioctl_running() and
+enables support for ethtool and other user-space tools that rely on ioctl
+interface to perform PHY register access using commands like SIOCGMIIREG
+and SIOCSMIIREG.
+
+This feature enables improved diagnostics and PHY configuration
+capabilities from userspace.
+
+Signed-off-by: Parthiban Veerasooran <parthiban.veerasooran@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250828114549.46116-1-parthiban.veerasooran@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/lan865x/lan865x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/microchip/lan865x/lan865x.c b/drivers/net/ethernet/microchip/lan865x/lan865x.c
+index 79b800d2b72c2..b428ad6516c5e 100644
+--- a/drivers/net/ethernet/microchip/lan865x/lan865x.c
++++ b/drivers/net/ethernet/microchip/lan865x/lan865x.c
+@@ -326,6 +326,7 @@ static const struct net_device_ops lan865x_netdev_ops = {
+ 	.ndo_start_xmit		= lan865x_send_packet,
+ 	.ndo_set_rx_mode	= lan865x_set_multicast_list,
+ 	.ndo_set_mac_address	= lan865x_set_mac_address,
++	.ndo_eth_ioctl          = phy_do_ioctl_running,
+ };
+ 
+ static int lan865x_probe(struct spi_device *spi)
+-- 
+2.51.0
+
diff --git a/queue-6.17/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-6.17/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..7527bcb9d0
--- /dev/null
+++ b/queue-6.17/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From 0e1cb0b2e81a84958a6ddf475d90966b9071064e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 0a942bc091436..650400bd5725f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -104,6 +104,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-6.17/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..52d141ae09
--- /dev/null
+++ b/queue-6.17/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From 779bf3ae786ed5d07d490fbb877e4937bc388ea8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 7a7ba66aa5349..0a942bc091436 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/mips-lantiq-danube-add-model-to-easy50712-dts.patch b/queue-6.17/mips-lantiq-danube-add-model-to-easy50712-dts.patch
new file mode 100644
index 0000000000..21756454d5
--- /dev/null
+++ b/queue-6.17/mips-lantiq-danube-add-model-to-easy50712-dts.patch
@@ -0,0 +1,36 @@
+From aacf0ca821420b2725f0f0f4e520e156a99387ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:06:04 +0200
+Subject: mips: lantiq: danube: add model to EASY50712 dts
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
+	from schema $id: http://devicetree.org/schemas/root-node.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index c4d7aa5753b04..ab70028dbefcf 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -4,6 +4,8 @@
+ /include/ "danube.dtsi"
+ 
+ / {
++	model = "Intel EASY50712";
++
+ 	chosen {
+ 		bootargs = "console=ttyLTQ0,115200 init=/etc/preinit";
+ 	};
+-- 
+2.51.0
+
diff --git a/queue-6.17/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch b/queue-6.17/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
new file mode 100644
index 0000000000..5fb4ac8415
--- /dev/null
+++ b/queue-6.17/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
@@ -0,0 +1,36 @@
+From fbd3d354ea7c186dc5c289a10f62f358c1950fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:24 +0200
+Subject: mips: lantiq: danube: rename stp node on EASY50712 reference board
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
+	from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index ab70028dbefcf..c9f7886f57b8c 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -96,7 +96,7 @@
+ 			lantiq,tx-burst-length = <4>;
+ 		};
+ 
+-		stp0: stp@e100bb0 {
++		stp0: gpio@e100bb0 {
+ 			#gpio-cells = <2>;
+ 			compatible = "lantiq,gpio-stp-xway";
+ 			gpio-controller;
+-- 
+2.51.0
+
diff --git a/queue-6.17/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-6.17/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..dd96fa7ab1
--- /dev/null
+++ b/queue-6.17/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From 39501eb3be93eec33fd83610d574be2436adcf8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 6031a0272d874..d9aa80afdf9d6 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -485,7 +485,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-6.17/misc-pci_endpoint_test-skip-irq-tests-if-irq-is-out-.patch b/queue-6.17/misc-pci_endpoint_test-skip-irq-tests-if-irq-is-out-.patch
new file mode 100644
index 0000000000..25144b5f29
--- /dev/null
+++ b/queue-6.17/misc-pci_endpoint_test-skip-irq-tests-if-irq-is-out-.patch
@@ -0,0 +1,58 @@
+From 7be6bd42ee8c996b7c025d2ddb074388f3f7882c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 19:09:14 +0200
+Subject: misc: pci_endpoint_test: Skip IRQ tests if irq is out of range
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit cc8e391067164f45f89b6132a5aaa18c33a0e32b ]
+
+The pci_endpoint_test tests the 32-bit MSI range. However, the device might
+not have all vectors configured. For example, if msi_interrupts is 8 in the
+ep function space or if the MSI Multiple Message Capable value is
+configured as 4 (maximum 16 vectors).
+
+In this case, do not attempt to run the test to avoid timeouts and directly
+return the error value.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250804170916.3212221-2-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pci_endpoint_test.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index f935175d8bf55..506a2847e5d22 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -436,7 +436,11 @@ static int pci_endpoint_test_msi_irq(struct pci_endpoint_test *test,
+ {
+ 	struct pci_dev *pdev = test->pdev;
+ 	u32 val;
+-	int ret;
++	int irq;
++
++	irq = pci_irq_vector(pdev, msi_num - 1);
++	if (irq < 0)
++		return irq;
+ 
+ 	pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_IRQ_TYPE,
+ 				 msix ? PCITEST_IRQ_TYPE_MSIX :
+@@ -450,11 +454,7 @@ static int pci_endpoint_test_msi_irq(struct pci_endpoint_test *test,
+ 	if (!val)
+ 		return -ETIMEDOUT;
+ 
+-	ret = pci_irq_vector(pdev, msi_num - 1);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (ret != test->last_irq)
++	if (irq != test->last_irq)
+ 		return -EIO;
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/move_mount-2-take-sanity-checks-in-beneath-case-into.patch b/queue-6.17/move_mount-2-take-sanity-checks-in-beneath-case-into.patch
new file mode 100644
index 0000000000..d06526d3a2
--- /dev/null
+++ b/queue-6.17/move_mount-2-take-sanity-checks-in-beneath-case-into.patch
@@ -0,0 +1,74 @@
+From 2833af6ebf07daf96ca29251125365da0d124113 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 23:54:39 -0400
+Subject: move_mount(2): take sanity checks in 'beneath' case into
+ do_lock_mount()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit d29da1a8f119130e6fc7d5d71029d402dabe2cb0 ]
+
+We want to mount beneath the given location.  For that operation to
+make sense, location must be the root of some mount that has something
+under it.  Currently we let it proceed if those requirements are not met,
+with rather meaningless results, and have that bogosity caught further
+down the road; let's fail early instead - do_lock_mount() doesn't make
+sense unless those conditions hold, and checking them there makes
+things simpler.
+
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index c8c2376bb2424..fa7c034ac4a69 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2785,12 +2785,19 @@ static int do_lock_mount(struct path *path, struct pinned_mountpoint *pinned, bo
+ 	struct path under = {};
+ 	int err = -ENOENT;
+ 
++	if (unlikely(beneath) && !path_mounted(path))
++		return -EINVAL;
++
+ 	for (;;) {
+ 		struct mount *m = real_mount(mnt);
+ 
+ 		if (beneath) {
+ 			path_put(&under);
+ 			read_seqlock_excl(&mount_lock);
++			if (unlikely(!mnt_has_parent(m))) {
++				read_sequnlock_excl(&mount_lock);
++				return -EINVAL;
++			}
+ 			under.mnt = mntget(&m->mnt_parent->mnt);
+ 			under.dentry = dget(m->mnt_mountpoint);
+ 			read_sequnlock_excl(&mount_lock);
+@@ -3462,8 +3469,6 @@ static bool mount_is_ancestor(const struct mount *p1, const struct mount *p2)
+  * @to:   mount under which to mount
+  * @mp:   mountpoint of @to
+  *
+- * - Make sure that @to->dentry is actually the root of a mount under
+- *   which we can mount another mount.
+  * - Make sure that nothing can be mounted beneath the caller's current
+  *   root or the rootfs of the namespace.
+  * - Make sure that the caller can unmount the topmost mount ensuring
+@@ -3485,12 +3490,6 @@ static int can_move_mount_beneath(const struct path *from,
+ 		     *mnt_to = real_mount(to->mnt),
+ 		     *parent_mnt_to = mnt_to->mnt_parent;
+ 
+-	if (!mnt_has_parent(mnt_to))
+-		return -EINVAL;
+-
+-	if (!path_mounted(to))
+-		return -EINVAL;
+-
+ 	if (IS_MNT_LOCKED(mnt_to))
+ 		return -EINVAL;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch b/queue-6.17/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
new file mode 100644
index 0000000000..a3347e0f6f
--- /dev/null
+++ b/queue-6.17/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
@@ -0,0 +1,82 @@
+From 72c4cac72a6f2f8763772b21aac43776d48cffd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:14:48 +0200
+Subject: net: bridge: Install FDB for bridge MAC on VLAN 0
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
+
+Currently, after the bridge is created, the FDB does not hold an FDB entry
+for the bridge MAC on VLAN 0:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb show | grep 92:19:8c:4e:01:ed
+ 92:19:8c:4e:01:ed dev br vlan 1 master br permanent
+
+Later when the bridge MAC is changed, or in fact when the address is given
+during netdevice creation, the entry appears:
+
+ # ip link add name br up address 00:11:22:33:44:55 type bridge
+ # bridge fdb show | grep 00:11:22:33:44:55
+ 00:11:22:33:44:55 dev br vlan 1 master br permanent
+ 00:11:22:33:44:55 dev br master br permanent
+
+However when the bridge address is set by the user to the current bridge
+address before the first port is enslaved, none of the address handlers
+gets invoked, because the address is not actually changed. The address is
+however marked as NET_ADDR_SET. Then when a port is enslaved, the address
+is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not
+added, and it has not been added previously either:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # ip link set dev br addr 7e:f0:a8:1a:be:c2
+ # ip link add name v up type veth
+ # ip link set dev v master br
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb | grep 7e:f0:a8:1a:be:c2
+ 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
+
+Then when the bridge MAC is used as DMAC, and br_handle_frame_finish()
+looks up an FDB entry with VLAN=0, it doesn't find any, and floods the
+traffic instead of passing it up.
+
+Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always
+on netdevice creation. This also makes the behavior consistent with how
+ports are treated: ports always have an FDB entry for each member VLAN as
+well as VLAN 0.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index c683baa3847f1..74706cb9283a2 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
+ 	int err;
+ 
+ 	if (netif_is_bridge_master(dev)) {
++		struct net_bridge *br = netdev_priv(dev);
++
++		if (event == NETDEV_REGISTER)
++			br_fdb_change_mac_address(br, dev->dev_addr);
++
+ 		err = br_vlan_bridge_event(dev, event, ptr);
+ 		if (err)
+ 			return notifier_from_errno(err);
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-6.17/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..703b3e3136
--- /dev/null
+++ b/queue-6.17/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From 7b2f93ccaf9a7cefa291fa0b1b874be4dcc25145 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1382bddcbaff4..bdeea7cc134df 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3162,23 +3162,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-6.17/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..8dc46a934b
--- /dev/null
+++ b/queue-6.17/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From b348961c23a87b447baf92df6a086e36cb0f7bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index e21348ead7e76..1382bddcbaff4 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3336,8 +3336,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 		}
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-6.17/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..884720a969
--- /dev/null
+++ b/queue-6.17/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From ed9f686a52287429905116d2033c336243810919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-devmem-expose-tcp_recvmsg_locked-errors.patch b/queue-6.17/net-devmem-expose-tcp_recvmsg_locked-errors.patch
new file mode 100644
index 0000000000..74a9a8cef6
--- /dev/null
+++ b/queue-6.17/net-devmem-expose-tcp_recvmsg_locked-errors.patch
@@ -0,0 +1,52 @@
+From 61254bdd81c48652b3f2ef2547de0a77317dee15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 09:24:29 -0700
+Subject: net: devmem: expose tcp_recvmsg_locked errors
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 18282100d7040614b553f1cad737cb689c04e2b9 ]
+
+tcp_recvmsg_dmabuf can export the following errors:
+- EFAULT when linear copy fails
+- ETOOSMALL when cmsg put fails
+- ENODEV if one of the frags is readable
+- ENOMEM on xarray failures
+
+But they are all ignored and replaced by EFAULT in the caller
+(tcp_recvmsg_locked). Expose real error to the userspace to
+add more transparency on what specifically fails.
+
+In non-devmem case (skb_copy_datagram_msg) doing `if (!copied)
+copied=-EFAULT` is ok because skb_copy_datagram_msg can return only EFAULT.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250910162429.4127997-1-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index ba36f558f144c..f421cad69d8c9 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2821,9 +2821,9 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len,
+ 
+ 				err = tcp_recvmsg_dmabuf(sk, skb, offset, msg,
+ 							 used);
+-				if (err <= 0) {
++				if (err < 0) {
+ 					if (!copied)
+-						copied = -EFAULT;
++						copied = err;
+ 
+ 					break;
+ 				}
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-dsa-felix-support-phy-mode-10g-qxgmii.patch b/queue-6.17/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
new file mode 100644
index 0000000000..214eb01de1
--- /dev/null
+++ b/queue-6.17/net-dsa-felix-support-phy-mode-10g-qxgmii.patch
@@ -0,0 +1,98 @@
+From c63d7b04916b3688f8d3301dc0a21eb9ada19a08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 16:07:26 +0300
+Subject: net: dsa: felix: support phy-mode = "10g-qxgmii"
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 6f616757dd306fce4b55131df23737732e347d8f ]
+
+The "usxgmii" phy-mode that the Felix switch ports support on LS1028A is
+not quite USXGMII, it is defined by the USXGMII multiport specification
+document as 10G-QXGMII. It uses the same signaling as USXGMII, but it
+multiplexes 4 ports over the link, resulting in a maximum speed of 2.5G
+per port.
+
+This change is needed in preparation for the lynx-10g SerDes driver on
+LS1028A, which will make a more clear distinction between usxgmii
+(supported on lane 0) and 10g-qxgmii (supported on lane 1). These
+protocols have their configuration in different PCCR registers (PCCRB vs
+PCCR9).
+
+Continue parsing and supporting single-port-per-lane USXGMII when found
+in the device tree as usual (because it works), but add support for
+10G-QXGMII too. Using phy-mode = "10g-qxgmii" will be required when
+modifying the device trees to specify a "phys" phandle to the SerDes
+lane. The result when the "phys" phandle is present but the phy-mode is
+wrong is undefined.
+
+The only PHY driver in known use with this phy-mode, AQR412C, will gain
+logic to transition from "usxgmii" to "10g-qxgmii" in a future change.
+Prepare the driver by also setting PHY_INTERFACE_MODE_10G_QXGMII in
+supported_interfaces when PHY_INTERFACE_MODE_USXGMII is there, to
+prevent breakage with existing device trees.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Link: https://patch.msgid.link/20250903130730.2836022-3-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix.c         | 4 ++++
+ drivers/net/dsa/ocelot/felix.h         | 3 ++-
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 3 ++-
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c
+index 2dd4e56e1cf11..20ab558fde247 100644
+--- a/drivers/net/dsa/ocelot/felix.c
++++ b/drivers/net/dsa/ocelot/felix.c
+@@ -1153,6 +1153,9 @@ static void felix_phylink_get_caps(struct dsa_switch *ds, int port,
+ 
+ 	__set_bit(ocelot->ports[port]->phy_mode,
+ 		  config->supported_interfaces);
++	if (ocelot->ports[port]->phy_mode == PHY_INTERFACE_MODE_USXGMII)
++		__set_bit(PHY_INTERFACE_MODE_10G_QXGMII,
++			  config->supported_interfaces);
+ }
+ 
+ static void felix_phylink_mac_config(struct phylink_config *config,
+@@ -1359,6 +1362,7 @@ static const u32 felix_phy_match_table[PHY_INTERFACE_MODE_MAX] = {
+ 	[PHY_INTERFACE_MODE_SGMII] = OCELOT_PORT_MODE_SGMII,
+ 	[PHY_INTERFACE_MODE_QSGMII] = OCELOT_PORT_MODE_QSGMII,
+ 	[PHY_INTERFACE_MODE_USXGMII] = OCELOT_PORT_MODE_USXGMII,
++	[PHY_INTERFACE_MODE_10G_QXGMII] = OCELOT_PORT_MODE_10G_QXGMII,
+ 	[PHY_INTERFACE_MODE_1000BASEX] = OCELOT_PORT_MODE_1000BASEX,
+ 	[PHY_INTERFACE_MODE_2500BASEX] = OCELOT_PORT_MODE_2500BASEX,
+ };
+diff --git a/drivers/net/dsa/ocelot/felix.h b/drivers/net/dsa/ocelot/felix.h
+index 211991f494e35..a657b190c5d7b 100644
+--- a/drivers/net/dsa/ocelot/felix.h
++++ b/drivers/net/dsa/ocelot/felix.h
+@@ -12,8 +12,9 @@
+ #define OCELOT_PORT_MODE_SGMII		BIT(1)
+ #define OCELOT_PORT_MODE_QSGMII		BIT(2)
+ #define OCELOT_PORT_MODE_2500BASEX	BIT(3)
+-#define OCELOT_PORT_MODE_USXGMII	BIT(4)
++#define OCELOT_PORT_MODE_USXGMII	BIT(4) /* compatibility */
+ #define OCELOT_PORT_MODE_1000BASEX	BIT(5)
++#define OCELOT_PORT_MODE_10G_QXGMII	BIT(6)
+ 
+ struct device_node;
+ 
+diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
+index 7b35d24c38d76..8cf4c89865876 100644
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -34,7 +34,8 @@
+ 					 OCELOT_PORT_MODE_QSGMII | \
+ 					 OCELOT_PORT_MODE_1000BASEX | \
+ 					 OCELOT_PORT_MODE_2500BASEX | \
+-					 OCELOT_PORT_MODE_USXGMII)
++					 OCELOT_PORT_MODE_USXGMII | \
++					 OCELOT_PORT_MODE_10G_QXGMII)
+ 
+ static const u32 vsc9959_port_modes[VSC9959_NUM_PORTS] = {
+ 	VSC9959_PORT_MODE_SERDES,
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch b/queue-6.17/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
new file mode 100644
index 0000000000..be4c478087
--- /dev/null
+++ b/queue-6.17/net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
@@ -0,0 +1,106 @@
+From 98501a24f5176c3159ca22479fda7623707892da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:33:52 +0200
+Subject: net: dsa: microchip: Set SPI as bus interface during reset for
+ KSZ8463
+
+From: Bastien Curutchet <bastien.curutchet@bootlin.com>
+
+[ Upstream commit a0b977a3d19368b235f2a6c06e800fb25452029b ]
+
+At reset, the KSZ8463 uses a strap-based configuration to set SPI as
+bus interface. SPI is the only bus supported by the driver. If the
+required pull-ups/pull-downs are missing (by mistake or by design to
+save power) the pins may float and the configuration can go wrong
+preventing any communication with the switch.
+
+Introduce a ksz8463_configure_straps_spi() function called during the
+device reset. It relies on the 'straps-rxd-gpios' OF property and the
+'reset' pinmux configuration to enforce SPI as bus interface.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+Link: https://patch.msgid.link/20250918-ksz-strap-pins-v3-3-16662e881728@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 45 ++++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 9568cc391fe3e..a962055bfdbd8 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -23,6 +23,7 @@
+ #include <linux/of_mdio.h>
+ #include <linux/of_net.h>
+ #include <linux/micrel_phy.h>
++#include <linux/pinctrl/consumer.h>
+ #include <net/dsa.h>
+ #include <net/ieee8021q.h>
+ #include <net/pkt_cls.h>
+@@ -5345,6 +5346,38 @@ static int ksz_parse_drive_strength(struct ksz_device *dev)
+ 	return 0;
+ }
+ 
++static int ksz8463_configure_straps_spi(struct ksz_device *dev)
++{
++	struct pinctrl *pinctrl;
++	struct gpio_desc *rxd0;
++	struct gpio_desc *rxd1;
++
++	rxd0 = devm_gpiod_get_index_optional(dev->dev, "straps-rxd", 0, GPIOD_OUT_LOW);
++	if (IS_ERR(rxd0))
++		return PTR_ERR(rxd0);
++
++	rxd1 = devm_gpiod_get_index_optional(dev->dev, "straps-rxd", 1, GPIOD_OUT_HIGH);
++	if (IS_ERR(rxd1))
++		return PTR_ERR(rxd1);
++
++	if (!rxd0 && !rxd1)
++		return 0;
++
++	if ((rxd0 && !rxd1) || (rxd1 && !rxd0))
++		return -EINVAL;
++
++	pinctrl = devm_pinctrl_get_select(dev->dev, "reset");
++	if (IS_ERR(pinctrl))
++		return PTR_ERR(pinctrl);
++
++	return 0;
++}
++
++static int ksz8463_release_straps_spi(struct ksz_device *dev)
++{
++	return pinctrl_select_default_state(dev->dev);
++}
++
+ int ksz_switch_register(struct ksz_device *dev)
+ {
+ 	const struct ksz_chip_data *info;
+@@ -5360,10 +5393,22 @@ int ksz_switch_register(struct ksz_device *dev)
+ 		return PTR_ERR(dev->reset_gpio);
+ 
+ 	if (dev->reset_gpio) {
++		if (of_device_is_compatible(dev->dev->of_node, "microchip,ksz8463")) {
++			ret = ksz8463_configure_straps_spi(dev);
++			if (ret)
++				return ret;
++		}
++
+ 		gpiod_set_value_cansleep(dev->reset_gpio, 1);
+ 		usleep_range(10000, 12000);
+ 		gpiod_set_value_cansleep(dev->reset_gpio, 0);
+ 		msleep(100);
++
++		if (of_device_is_compatible(dev->dev->of_node, "microchip,ksz8463")) {
++			ret = ksz8463_release_straps_spi(dev);
++			if (ret)
++				return ret;
++		}
+ 	}
+ 
+ 	mutex_init(&dev->dev_mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-ethernet-microchip-sparx5-make-it-selectable-for.patch b/queue-6.17/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
new file mode 100644
index 0000000000..5067a57ec1
--- /dev/null
+++ b/queue-6.17/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
@@ -0,0 +1,37 @@
+From 1eb7f19653beb35dab37deaa53e6f25fd42870cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 13:00:24 +0200
+Subject: net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
+
+LAN969x switchdev support depends on the SparX-5 core,so make it selectable
+for ARCH_LAN969X.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index 35e1c0cf345ea..a4d6706590d25 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -3,7 +3,7 @@ config SPARX5_SWITCH
+ 	depends on NET_SWITCHDEV
+ 	depends on HAS_IOMEM
+ 	depends on OF
+-	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
+ 	depends on PTP_1588_CLOCK_OPTIONAL
+ 	depends on BRIDGE || BRIDGE=n
+ 	select PHYLINK
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-6.17/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..2cdd9c499a
--- /dev/null
+++ b/queue-6.17/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From 3b6631d93306c57d2e8cec4855e64ad3caeeb46e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index b9dd7b7198324..3394645a18fe8 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1389,7 +1389,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index 7fb1961f29210..6861a0bdc14e1 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch b/queue-6.17/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
new file mode 100644
index 0000000000..367c789a07
--- /dev/null
+++ b/queue-6.17/net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
@@ -0,0 +1,75 @@
+From 722ad0e64aa8e601cfe384f4f293c2aae0c82c6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 19:46:41 +0200
+Subject: net: ipv4: allow directed broadcast routes to use dst hint
+
+From: Oscar Maes <oscmaes92@gmail.com>
+
+[ Upstream commit 1b8c5fa0cb35efd08f07f700e6d78a541ebabe26 ]
+
+Currently, ip_extract_route_hint uses RTN_BROADCAST to decide
+whether to use the route dst hint mechanism.
+
+This check is too strict, as it prevents directed broadcast
+routes from using the hint, resulting in poor performance
+during bursts of directed broadcast traffic.
+
+Fix this in ip_extract_route_hint and modify ip_route_use_hint
+to preserve the intended behaviour.
+
+Signed-off-by: Oscar Maes <oscmaes92@gmail.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250819174642.5148-2-oscmaes92@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_input.c | 11 +++++++----
+ net/ipv4/route.c    |  2 +-
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
+index fc323994b1fa0..a09aca2c8567d 100644
+--- a/net/ipv4/ip_input.c
++++ b/net/ipv4/ip_input.c
+@@ -587,9 +587,13 @@ static void ip_sublist_rcv_finish(struct list_head *head)
+ }
+ 
+ static struct sk_buff *ip_extract_route_hint(const struct net *net,
+-					     struct sk_buff *skb, int rt_type)
++					     struct sk_buff *skb)
+ {
+-	if (fib4_has_custom_rules(net) || rt_type == RTN_BROADCAST ||
++	const struct iphdr *iph = ip_hdr(skb);
++
++	if (fib4_has_custom_rules(net) ||
++	    ipv4_is_lbcast(iph->daddr) ||
++	    ipv4_is_zeronet(iph->daddr) ||
+ 	    IPCB(skb)->flags & IPSKB_MULTIPATH)
+ 		return NULL;
+ 
+@@ -618,8 +622,7 @@ static void ip_list_rcv_finish(struct net *net, struct list_head *head)
+ 
+ 		dst = skb_dst(skb);
+ 		if (curr_dst != dst) {
+-			hint = ip_extract_route_hint(net, skb,
+-						     dst_rtable(dst)->rt_type);
++			hint = ip_extract_route_hint(net, skb);
+ 
+ 			/* dispatch old sublist */
+ 			if (!list_empty(&sublist))
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 5582ccd673eeb..86a20d12472f4 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2210,7 +2210,7 @@ ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+ 		goto martian_source;
+ 	}
+ 
+-	if (rt->rt_type != RTN_LOCAL)
++	if (!(rt->rt_flags & RTCF_LOCAL))
+ 		goto skip_validate_source;
+ 
+ 	reason = fib_validate_source_reason(skb, saddr, daddr, dscp, 0, dev,
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-6.17/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..7ebfe905f8
--- /dev/null
+++ b/queue-6.17/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From e8e11af968dc6f3f9c72c703646ee25e47af7c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index eb474f0987ae0..95372e0f1d216 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -301,13 +329,7 @@ static void ah6_output_done(void *data, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -378,12 +400,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -434,13 +452,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-6.17/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..856ee2efc0
--- /dev/null
+++ b/queue-6.17/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From 3f2d66d25e2f320e96b1ede2148cf6b850110d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index fc082a7a5a313..4af2ec705ba52 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -274,9 +274,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	if (gem_has_ptp(bp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-mana-reduce-waiting-time-if-hwc-not-responding.patch b/queue-6.17/net-mana-reduce-waiting-time-if-hwc-not-responding.patch
new file mode 100644
index 0000000000..6e1eb23af3
--- /dev/null
+++ b/queue-6.17/net-mana-reduce-waiting-time-if-hwc-not-responding.patch
@@ -0,0 +1,43 @@
+From dcac181295c1d3ddd67f166f6e7cea90729a8675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 13:57:21 -0700
+Subject: net: mana: Reduce waiting time if HWC not responding
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit c4deabbc1abe452ea230b86d53ed3711e5a8a062 ]
+
+If HW Channel (HWC) is not responding, reduce the waiting time, so further
+steps will fail quickly.
+This will prevent getting stuck for a long time (30 minutes or more), for
+example, during unloading while HWC is not responding.
+
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Link: https://patch.msgid.link/1757537841-5063-1-git-send-email-haiyangz@linux.microsoft.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microsoft/mana/hw_channel.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c b/drivers/net/ethernet/microsoft/mana/hw_channel.c
+index ef072e24c46d0..ada6c78a2bef4 100644
+--- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
++++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
+@@ -881,7 +881,12 @@ int mana_hwc_send_request(struct hw_channel_context *hwc, u32 req_len,
+ 	if (!wait_for_completion_timeout(&ctx->comp_event,
+ 					 (msecs_to_jiffies(hwc->hwc_timeout)))) {
+ 		if (hwc->hwc_timeout != 0)
+-			dev_err(hwc->dev, "HWC: Request timed out!\n");
++			dev_err(hwc->dev, "HWC: Request timed out: %u ms\n",
++				hwc->hwc_timeout);
++
++		/* Reduce further waiting if HWC no response */
++		if (hwc->hwc_timeout > 1)
++			hwc->hwc_timeout = 1;
+ 
+ 		err = -ETIMEDOUT;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch b/queue-6.17/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
new file mode 100644
index 0000000000..58e1cbb8dd
--- /dev/null
+++ b/queue-6.17/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
@@ -0,0 +1,66 @@
+From 9c6ffdc2961d33a7ab52212afc815e53c97e57f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 12:40:34 +0000
+Subject: net/mlx5e: Don't query FEC statistics when FEC is disabled
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
+
+Update mlx5e_stats_fec_get() to check the active FEC mode and skip
+statistics collection when FEC is disabled.
+
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Yael Chemla <ychemla@nvidia.com>
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index c6185ddba04b8..9c45c6e670ebf 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -1446,16 +1446,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt)
+ }
+ 
+ static void fec_set_block_stats(struct mlx5e_priv *priv,
++				int mode,
+ 				struct ethtool_fec_stats *fec_stats)
+ {
+ 	struct mlx5_core_dev *mdev = priv->mdev;
+ 	u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+-	int mode = fec_active_mode(mdev);
+-
+-	if (mode == MLX5E_FEC_NOFEC)
+-		return;
+ 
+ 	MLX5_SET(ppcnt_reg, in, local_port, 1);
+ 	MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP);
+@@ -1497,11 +1494,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,
+ void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
+ 			 struct ethtool_fec_stats *fec_stats)
+ {
+-	if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
++	int mode = fec_active_mode(priv->mdev);
++
++	if (mode == MLX5E_FEC_NOFEC ||
++	    !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
+ 		return;
+ 
+ 	fec_set_corrected_bits_total(priv, fec_stats);
+-	fec_set_block_stats(priv, fec_stats);
++	fec_set_block_stats(priv, mode, fec_stats);
+ }
+ 
+ #define PPORT_ETH_EXT_OFF(c) \
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-mlx5e-prevent-entering-switchdev-mode-with-incon.patch b/queue-6.17/net-mlx5e-prevent-entering-switchdev-mode-with-incon.patch
new file mode 100644
index 0000000000..b755cd498d
--- /dev/null
+++ b/queue-6.17/net-mlx5e-prevent-entering-switchdev-mode-with-incon.patch
@@ -0,0 +1,102 @@
+From 3265813a721ef228a5258b10f639065610ec896b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Sep 2025 00:25:18 +0300
+Subject: net/mlx5e: Prevent entering switchdev mode with inconsistent netns
+
+From: Jianbo Liu <jianbol@nvidia.com>
+
+[ Upstream commit 06fdc45f16c392dc3394c67e7c17ae63935715d3 ]
+
+When a PF enters switchdev mode, its netdevice becomes the uplink
+representor but remains in its current network namespace. All other
+representors (VFs, SFs) are created in the netns of the devlink
+instance.
+
+If the PF's netns has been moved and differs from the devlink's netns,
+enabling switchdev mode would create a state where the OVS control
+plane (ovs-vsctl) cannot manage the switch because the PF uplink
+representor and the other representors are split across different
+namespaces.
+
+To prevent this inconsistent configuration, block the request to enter
+switchdev mode if the PF netdevice's netns does not match the netns of
+its devlink instance.
+
+As part of this change, the PF's netns is first marked as immutable.
+This prevents race conditions where the netns could be changed after
+the check is performed but before the mode transition is complete, and
+it aligns the PF's behavior with that of the final uplink representor.
+
+Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
+Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/1759094723-843774-3-git-send-email-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/eswitch_offloads.c     | 33 +++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index f358e8fe432cf..59a1a3a5fc8b5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -3739,6 +3739,29 @@ void mlx5_eswitch_unblock_mode(struct mlx5_core_dev *dev)
+ 	up_write(&esw->mode_lock);
+ }
+ 
++/* Returns false only when uplink netdev exists and its netns is different from
++ * devlink's netns. True for all others so entering switchdev mode is allowed.
++ */
++static bool mlx5_devlink_netdev_netns_immutable_set(struct devlink *devlink,
++						    bool immutable)
++{
++	struct mlx5_core_dev *mdev = devlink_priv(devlink);
++	struct net_device *netdev;
++	bool ret;
++
++	netdev = mlx5_uplink_netdev_get(mdev);
++	if (!netdev)
++		return true;
++
++	rtnl_lock();
++	netdev->netns_immutable = immutable;
++	ret = net_eq(dev_net(netdev), devlink_net(devlink));
++	rtnl_unlock();
++
++	mlx5_uplink_netdev_put(mdev, netdev);
++	return ret;
++}
++
+ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode,
+ 				  struct netlink_ext_ack *extack)
+ {
+@@ -3781,6 +3804,14 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode,
+ 	esw->eswitch_operation_in_progress = true;
+ 	up_write(&esw->mode_lock);
+ 
++	if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV &&
++	    !mlx5_devlink_netdev_netns_immutable_set(devlink, true)) {
++		NL_SET_ERR_MSG_MOD(extack,
++				   "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's.");
++		err = -EINVAL;
++		goto skip;
++	}
++
+ 	if (mode == DEVLINK_ESWITCH_MODE_LEGACY)
+ 		esw->dev->priv.flags |= MLX5_PRIV_FLAGS_SWITCH_LEGACY;
+ 	mlx5_eswitch_disable_locked(esw);
+@@ -3799,6 +3830,8 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode,
+ 	}
+ 
+ skip:
++	if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && err)
++		mlx5_devlink_netdev_netns_immutable_set(devlink, false);
+ 	down_write(&esw->mode_lock);
+ 	esw->eswitch_operation_in_progress = false;
+ unlock:
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-6.17/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..c157a0b280
--- /dev/null
+++ b/queue-6.17/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From e7db445ef5156f5bde3d6accd1d1a703d7c5b606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index e180bdf2f82b0..664d5058e66e0 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-clear-eee-runtime-state-in-phy_halted-phy_er.patch b/queue-6.17/net-phy-clear-eee-runtime-state-in-phy_halted-phy_er.patch
new file mode 100644
index 0000000000..2d7006f75f
--- /dev/null
+++ b/queue-6.17/net-phy-clear-eee-runtime-state-in-phy_halted-phy_er.patch
@@ -0,0 +1,44 @@
+From 306eb316d0ceaa229e23899ec71515a1560c0e30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 15:20:00 +0200
+Subject: net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 0915cb22452723407ca9606b7e5cc3fe6ce767d5 ]
+
+Clear EEE runtime flags when the PHY transitions to HALTED or ERROR
+and the state machine drops the link. This avoids stale EEE state being
+reported via ethtool after the PHY is stopped or hits an error.
+
+This change intentionally only clears software runtime flags and avoids
+MDIO accesses in HALTED/ERROR. A follow-up patch will address other
+link state variables.
+
+Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/20250912132000.1598234-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index c02da57a4da5e..e046dd858f151 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1551,6 +1551,8 @@ static enum phy_state_work _phy_state_machine(struct phy_device *phydev)
+ 	case PHY_ERROR:
+ 		if (phydev->link) {
+ 			phydev->link = 0;
++			phydev->eee_active = false;
++			phydev->enable_tx_lpi = false;
+ 			phy_link_down(phydev);
+ 		}
+ 		state_work = PHY_STATE_WORK_SUSPEND;
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-clear-link-parameters-on-admin-link-down.patch b/queue-6.17/net-phy-clear-link-parameters-on-admin-link-down.patch
new file mode 100644
index 0000000000..50d780e45c
--- /dev/null
+++ b/queue-6.17/net-phy-clear-link-parameters-on-admin-link-down.patch
@@ -0,0 +1,62 @@
+From cc517f9d1c3a46fcc1eb90f1a56e9ccf16127637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:47:51 +0200
+Subject: net: phy: clear link parameters on admin link down
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 60f887b1290b43a4f5a3497982a725687b193fa4 ]
+
+When a PHY is halted (e.g. `ip link set dev lan2 down`), several
+fields in struct phy_device may still reflect the last active
+connection. This leads to ethtool showing stale values even though
+the link is down.
+
+Reset selected fields in _phy_state_machine() when transitioning
+to PHY_HALTED and the link was previously up:
+
+- speed/duplex -> UNKNOWN, but only in autoneg mode (in forced mode
+  these fields carry configuration, not status)
+- master_slave_state -> UNKNOWN if previously supported
+- mdix -> INVALID (state only, same meaning as "unknown")
+- lp_advertising -> always cleared
+
+The cleanup is skipped if the PHY is in PHY_ERROR state, so the
+last values remain available for diagnostics.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250917094751.2101285-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index e046dd858f151..02da4a203ddd4 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1548,6 +1548,19 @@ static enum phy_state_work _phy_state_machine(struct phy_device *phydev)
+ 		}
+ 		break;
+ 	case PHY_HALTED:
++		if (phydev->link) {
++			if (phydev->autoneg == AUTONEG_ENABLE) {
++				phydev->speed = SPEED_UNKNOWN;
++				phydev->duplex = DUPLEX_UNKNOWN;
++			}
++			if (phydev->master_slave_state !=
++						MASTER_SLAVE_STATE_UNSUPPORTED)
++				phydev->master_slave_state =
++						MASTER_SLAVE_STATE_UNKNOWN;
++			phydev->mdix = ETH_TP_MDI_INVALID;
++			linkmode_zero(phydev->lp_advertising);
++		}
++		fallthrough;
+ 	case PHY_ERROR:
+ 		if (phydev->link) {
+ 			phydev->link = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-dp83640-improve-phydev-and-driver-removal-ha.patch b/queue-6.17/net-phy-dp83640-improve-phydev-and-driver-removal-ha.patch
new file mode 100644
index 0000000000..e2292c0f89
--- /dev/null
+++ b/queue-6.17/net-phy-dp83640-improve-phydev-and-driver-removal-ha.patch
@@ -0,0 +1,129 @@
+From 4198a5f9e43916c141be6d56ff5be669ac177481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 23:33:16 +0200
+Subject: net: phy: dp83640: improve phydev and driver removal handling
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 42e2a9e11a1dcb81c83d50d18c547dc9a1c6d6ed ]
+
+Once the last user of a clock has been removed, the clock should be
+removed. So far orphaned clocks are cleaned up in dp83640_free_clocks()
+only. Add the logic to remove orphaned clocks in dp83640_remove().
+This allows to simplify the code, and use standard macro
+module_phy_driver(). dp83640 was the last external user of
+phy_driver_register(), so we can stop exporting this function afterwards.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Link: https://patch.msgid.link/6d4e80e7-c684-4d95-abbd-ea62b79a9a8a@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83640.c | 58 ++++++++++++++-------------------------
+ 1 file changed, 20 insertions(+), 38 deletions(-)
+
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index daab555721df8..74396453f5bb2 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -953,30 +953,6 @@ static void decode_status_frame(struct dp83640_private *dp83640,
+ 	}
+ }
+ 
+-static void dp83640_free_clocks(void)
+-{
+-	struct dp83640_clock *clock;
+-	struct list_head *this, *next;
+-
+-	mutex_lock(&phyter_clocks_lock);
+-
+-	list_for_each_safe(this, next, &phyter_clocks) {
+-		clock = list_entry(this, struct dp83640_clock, list);
+-		if (!list_empty(&clock->phylist)) {
+-			pr_warn("phy list non-empty while unloading\n");
+-			BUG();
+-		}
+-		list_del(&clock->list);
+-		mutex_destroy(&clock->extreg_lock);
+-		mutex_destroy(&clock->clock_lock);
+-		put_device(&clock->bus->dev);
+-		kfree(clock->caps.pin_config);
+-		kfree(clock);
+-	}
+-
+-	mutex_unlock(&phyter_clocks_lock);
+-}
+-
+ static void dp83640_clock_init(struct dp83640_clock *clock, struct mii_bus *bus)
+ {
+ 	INIT_LIST_HEAD(&clock->list);
+@@ -1479,6 +1455,7 @@ static void dp83640_remove(struct phy_device *phydev)
+ 	struct dp83640_clock *clock;
+ 	struct list_head *this, *next;
+ 	struct dp83640_private *tmp, *dp83640 = phydev->priv;
++	bool remove_clock = false;
+ 
+ 	if (phydev->mdio.addr == BROADCAST_ADDR)
+ 		return;
+@@ -1506,11 +1483,27 @@ static void dp83640_remove(struct phy_device *phydev)
+ 		}
+ 	}
+ 
++	if (!clock->chosen && list_empty(&clock->phylist))
++		remove_clock = true;
++
+ 	dp83640_clock_put(clock);
+ 	kfree(dp83640);
++
++	if (remove_clock) {
++		mutex_lock(&phyter_clocks_lock);
++		list_del(&clock->list);
++		mutex_unlock(&phyter_clocks_lock);
++
++		mutex_destroy(&clock->extreg_lock);
++		mutex_destroy(&clock->clock_lock);
++		put_device(&clock->bus->dev);
++		kfree(clock->caps.pin_config);
++		kfree(clock);
++	}
+ }
+ 
+-static struct phy_driver dp83640_driver = {
++static struct phy_driver dp83640_driver[] = {
++{
+ 	.phy_id		= DP83640_PHY_ID,
+ 	.phy_id_mask	= 0xfffffff0,
+ 	.name		= "NatSemi DP83640",
+@@ -1521,26 +1514,15 @@ static struct phy_driver dp83640_driver = {
+ 	.config_init	= dp83640_config_init,
+ 	.config_intr    = dp83640_config_intr,
+ 	.handle_interrupt = dp83640_handle_interrupt,
++},
+ };
+ 
+-static int __init dp83640_init(void)
+-{
+-	return phy_driver_register(&dp83640_driver, THIS_MODULE);
+-}
+-
+-static void __exit dp83640_exit(void)
+-{
+-	dp83640_free_clocks();
+-	phy_driver_unregister(&dp83640_driver);
+-}
++module_phy_driver(dp83640_driver);
+ 
+ MODULE_DESCRIPTION("National Semiconductor DP83640 PHY driver");
+ MODULE_AUTHOR("Richard Cochran <richardcochran@gmail.com>");
+ MODULE_LICENSE("GPL");
+ 
+-module_init(dp83640_init);
+-module_exit(dp83640_exit);
+-
+ static const struct mdio_device_id __maybe_unused dp83640_tbl[] = {
+ 	{ DP83640_PHY_ID, 0xfffffff0 },
+ 	{ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch b/queue-6.17/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
new file mode 100644
index 0000000000..60a8337d9e
--- /dev/null
+++ b/queue-6.17/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
@@ -0,0 +1,74 @@
+From 3b89d98e131fc1cf962642ba16f6415d7953b089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 23:25:05 +0200
+Subject: net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
+
+fixed_phy_register() creates and registers the phy_device. To be
+symmetric, we should not only unregister, but also free the phy_device
+in fixed_phy_unregister(). This allows to simplify code in users.
+
+Note wrt of_phy_deregister_fixed_link():
+put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/dsa_loop.c  | 9 +++------
+ drivers/net/mdio/of_mdio.c  | 1 -
+ drivers/net/phy/fixed_phy.c | 1 +
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index d8a35f25a4c82..ad907287a853a 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -386,13 +386,10 @@ static struct mdio_driver dsa_loop_drv = {
+ 
+ static void dsa_loop_phydevs_unregister(void)
+ {
+-	unsigned int i;
+-
+-	for (i = 0; i < NUM_FIXED_PHYS; i++)
+-		if (!IS_ERR(phydevs[i])) {
++	for (int i = 0; i < NUM_FIXED_PHYS; i++) {
++		if (!IS_ERR(phydevs[i]))
+ 			fixed_phy_unregister(phydevs[i]);
+-			phy_device_free(phydevs[i]);
+-		}
++	}
+ }
+ 
+ static int __init dsa_loop_init(void)
+diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
+index 98f667b121f7d..d8ca63ed87194 100644
+--- a/drivers/net/mdio/of_mdio.c
++++ b/drivers/net/mdio/of_mdio.c
+@@ -473,6 +473,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)
+ 	fixed_phy_unregister(phydev);
+ 
+ 	put_device(&phydev->mdio.dev);	/* of_phy_find_device() */
+-	phy_device_free(phydev);	/* fixed_phy_register() */
+ }
+ EXPORT_SYMBOL(of_phy_deregister_fixed_link);
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index 033656d574b89..b8bec7600ef8e 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -309,6 +309,7 @@ void fixed_phy_unregister(struct phy_device *phy)
+ 	phy_device_remove(phy);
+ 	of_node_put(phy->mdio.dev.of_node);
+ 	fixed_phy_del(phy->mdio.addr);
++	phy_device_free(phy);
+ }
+ EXPORT_SYMBOL_GPL(fixed_phy_unregister);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-6.17/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..c9e04eb255
--- /dev/null
+++ b/queue-6.17/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From 382c16b3d3ce6c42a85908c489cc21de40534ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index 623292948fa70..0ea366c1217eb 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1902,6 +1902,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -3923,7 +3960,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.handle_interrupt = marvell_handle_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-phy-mscc-report-and-configure-in-band-auto-negot.patch b/queue-6.17/net-phy-mscc-report-and-configure-in-band-auto-negot.patch
new file mode 100644
index 0000000000..cf953595a2
--- /dev/null
+++ b/queue-6.17/net-phy-mscc-report-and-configure-in-band-auto-negot.patch
@@ -0,0 +1,174 @@
+From 40227e2fc2c0d5260e4c3039038c761cd9aae8b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 10:44:54 +0300
+Subject: net: phy: mscc: report and configure in-band auto-negotiation for
+ SGMII/QSGMII
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit df979273bd716a93ca9ffa8f84aeb205c9bf2ab6 ]
+
+The following Vitesse/Microsemi/Microchip PHYs, among those supported by
+this driver, have the host interface configurable as SGMII or QSGMII:
+- VSC8504
+- VSC8514
+- VSC8552
+- VSC8562
+- VSC8572
+- VSC8574
+- VSC8575
+- VSC8582
+- VSC8584
+
+All these PHYs are documented to have bit 7 of "MAC SerDes PCS Control"
+as "MAC SerDes ANEG enable".
+
+Out of these, I could test the VSC8514 quad PHY in QSGMII. This works
+both with the in-band autoneg on and off, on the NXP LS1028A-RDB and
+T1040-RDB boards.
+
+Notably, the bit is sticky (survives soft resets), so giving Linux the
+tools to read and modify this settings makes it robust to changes made
+to it by previous boot layers (U-Boot).
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/20250813074454.63224-1-vladimir.oltean@nxp.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mscc/mscc.h      |  3 +++
+ drivers/net/phy/mscc/mscc_main.c | 40 ++++++++++++++++++++++++++++++++
+ 2 files changed, 43 insertions(+)
+
+diff --git a/drivers/net/phy/mscc/mscc.h b/drivers/net/phy/mscc/mscc.h
+index 2bfe314ef881c..2d8eca54c40a2 100644
+--- a/drivers/net/phy/mscc/mscc.h
++++ b/drivers/net/phy/mscc/mscc.h
+@@ -196,6 +196,9 @@ enum rgmii_clock_delay {
+ #define MSCC_PHY_EXTENDED_INT_MS_EGR	  BIT(9)
+ 
+ /* Extended Page 3 Registers */
++#define MSCC_PHY_SERDES_PCS_CTRL	  16
++#define MSCC_PHY_SERDES_ANEG		  BIT(7)
++
+ #define MSCC_PHY_SERDES_TX_VALID_CNT	  21
+ #define MSCC_PHY_SERDES_TX_CRC_ERR_CNT	  22
+ #define MSCC_PHY_SERDES_RX_VALID_CNT	  28
+diff --git a/drivers/net/phy/mscc/mscc_main.c b/drivers/net/phy/mscc/mscc_main.c
+index 24c75903f5354..ef0ef1570d392 100644
+--- a/drivers/net/phy/mscc/mscc_main.c
++++ b/drivers/net/phy/mscc/mscc_main.c
+@@ -2202,6 +2202,28 @@ static int vsc85xx_read_status(struct phy_device *phydev)
+ 	return genphy_read_status(phydev);
+ }
+ 
++static unsigned int vsc85xx_inband_caps(struct phy_device *phydev,
++					phy_interface_t interface)
++{
++	if (interface != PHY_INTERFACE_MODE_SGMII &&
++	    interface != PHY_INTERFACE_MODE_QSGMII)
++		return 0;
++
++	return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++}
++
++static int vsc85xx_config_inband(struct phy_device *phydev, unsigned int modes)
++{
++	u16 reg_val = 0;
++
++	if (modes == LINK_INBAND_ENABLE)
++		reg_val = MSCC_PHY_SERDES_ANEG;
++
++	return phy_modify_paged(phydev, MSCC_PHY_PAGE_EXTENDED_3,
++				MSCC_PHY_SERDES_PCS_CTRL, MSCC_PHY_SERDES_ANEG,
++				reg_val);
++}
++
+ static int vsc8514_probe(struct phy_device *phydev)
+ {
+ 	struct vsc8531_private *vsc8531;
+@@ -2414,6 +2436,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8514,
+@@ -2437,6 +2461,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8530,
+@@ -2557,6 +2583,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC856X,
+@@ -2579,6 +2607,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8572,
+@@ -2605,6 +2635,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8574,
+@@ -2631,6 +2663,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8575,
+@@ -2655,6 +2689,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8582,
+@@ -2679,6 +2715,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_sset_count = &vsc85xx_get_sset_count,
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ },
+ {
+ 	.phy_id		= PHY_ID_VSC8584,
+@@ -2704,6 +2742,8 @@ static struct phy_driver vsc85xx_driver[] = {
+ 	.get_strings    = &vsc85xx_get_strings,
+ 	.get_stats      = &vsc85xx_get_stats,
+ 	.link_change_notify = &vsc85xx_link_change_notify,
++	.inband_caps    = vsc85xx_inband_caps,
++	.config_inband  = vsc85xx_config_inband,
+ }
+ 
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-prevent-rps-table-overwrite-of-active-flows.patch b/queue-6.17/net-prevent-rps-table-overwrite-of-active-flows.patch
new file mode 100644
index 0000000000..2a9617325b
--- /dev/null
+++ b/queue-6.17/net-prevent-rps-table-overwrite-of-active-flows.patch
@@ -0,0 +1,261 @@
+From 75759f9f872fa7f7b04b43db2d5cf667e2545588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 08:40:04 +0530
+Subject: net: Prevent RPS table overwrite of active flows
+
+From: Krishna Kumar <krikku@gmail.com>
+
+[ Upstream commit 97bcc5b6f45425ac56fb04b0893cdaa607ec7e45 ]
+
+This patch fixes an issue where two different flows on the same RXq
+produce the same hash resulting in continuous flow overwrites.
+
+Flow #1: A packet for Flow #1 comes in, kernel calls the steering
+         function. The driver gives back a filter id. The kernel saves
+	 this filter id in the selected slot. Later, the driver's
+	 service task checks if any filters have expired and then
+	 installs the rule for Flow #1.
+Flow #2: A packet for Flow #2 comes in. It goes through the same steps.
+         But this time, the chosen slot is being used by Flow #1. The
+	 driver gives a new filter id and the kernel saves it in the
+	 same slot. When the driver's service task runs, it runs through
+	 all the flows, checks if Flow #1 should be expired, the kernel
+	 returns True as the slot has a different filter id, and then
+	 the driver installs the rule for Flow #2.
+Flow #1: Another packet for Flow #1 comes in. The same thing repeats.
+         The slot is overwritten with a new filter id for Flow #1.
+
+This causes a repeated cycle of flow programming for missed packets,
+wasting CPU cycles while not improving performance. This problem happens
+at higher rates when the RPS table is small, but tests show it still
+happens even with 12,000 connections and an RPS size of 16K per queue
+(global table size = 144x16K = 64K).
+
+This patch prevents overwriting an rps_dev_flow entry if it is active.
+The intention is that it is better to do aRFS for the first flow instead
+of hurting all flows on the same hash. Without this, two (or more) flows
+on one RX queue with the same hash can keep overwriting each other. This
+causes the driver to reprogram the flow repeatedly.
+
+Changes:
+  1. Add a new 'hash' field to struct rps_dev_flow.
+  2. Add rps_flow_is_active(): a helper function to check if a flow is
+     active or not, extracted from rps_may_expire_flow(). It is further
+     simplified as per reviewer feedback.
+  3. In set_rps_cpu():
+     - Avoid overwriting by programming a new filter if:
+        - The slot is not in use, or
+        - The slot is in use but the flow is not active, or
+        - The slot has an active flow with the same hash, but target CPU
+          differs.
+     - Save the hash in the rps_dev_flow entry.
+  4. rps_may_expire_flow(): Use earlier extracted rps_flow_is_active().
+
+Testing & results:
+  - Driver: ice (E810 NIC), Kernel: net-next
+  - #CPUs = #RXq = 144 (1:1)
+  - Number of flows: 12K
+  - Eight RPS settings from 256 to 32768. Though RPS=256 is not ideal,
+    it is still sufficient to cover 12K flows (256*144 rx-queues = 64K
+    global table slots)
+  - Global Table Size = 144 * RPS (effectively equal to 256 * RPS)
+  - Each RPS test duration = 8 mins (org code) + 8 mins (new code).
+  - Metrics captured on client
+
+Legend for following tables:
+Steer-C: #times ndo_rx_flow_steer() was Called by set_rps_cpu()
+Steer-L: #times ice_arfs_flow_steer() Looped over aRFS entries
+Add:     #times driver actually programmed aRFS (ice_arfs_build_entry())
+Del:     #times driver deleted the flow (ice_arfs_del_flow_rules())
+Units:   K = 1,000 times, M = 1 million times
+
+  |-------|---------|------|     Org Code    |---------|---------|
+  | RPS   | Latency | CPU  | Add    |  Del   | Steer-C | Steer-L |
+  |-------|---------|------|--------|--------|---------|---------|
+  | 256   | 227.0   | 93.2 | 1.6M   | 1.6M   | 121.7M  | 267.6M  |
+  | 512   | 225.9   | 94.1 | 11.5M  | 11.2M  | 65.7M   | 199.6M  |
+  | 1024  | 223.5   | 95.6 | 16.5M  | 16.5M  | 27.1M   | 187.3M  |
+  | 2048  | 222.2   | 96.3 | 10.5M  | 10.5M  | 12.5M   | 115.2M  |
+  | 4096  | 223.9   | 94.1 | 5.5M   | 5.5M   | 7.2M    | 65.9M   |
+  | 8192  | 224.7   | 92.5 | 2.7M   | 2.7M   | 3.0M    | 29.9M   |
+  | 16384 | 223.5   | 92.5 | 1.3M   | 1.3M   | 1.4M    | 13.9M   |
+  | 32768 | 219.6   | 93.2 | 838.1K | 838.1K | 965.1K  | 8.9M    |
+  |-------|---------|------|   New Code      |---------|---------|
+  | 256   | 201.5   | 99.1 | 13.4K  | 5.0K   | 13.7K   | 75.2K   |
+  | 512   | 202.5   | 98.2 | 11.2K  | 5.9K   | 11.2K   | 55.5K   |
+  | 1024  | 207.3   | 93.9 | 11.5K  | 9.7K   | 11.5K   | 59.6K   |
+  | 2048  | 207.5   | 96.7 | 11.8K  | 11.1K  | 15.5K   | 79.3K   |
+  | 4096  | 206.9   | 96.6 | 11.8K  | 11.7K  | 11.8K   | 63.2K   |
+  | 8192  | 205.8   | 96.7 | 11.9K  | 11.8K  | 11.9K   | 63.9K   |
+  | 16384 | 200.9   | 98.2 | 11.9K  | 11.9K  | 11.9K   | 64.2K   |
+  | 32768 | 202.5   | 98.0 | 11.9K  | 11.9K  | 11.9K   | 64.2K   |
+  |-------|---------|------|--------|--------|---------|---------|
+
+Some observations:
+  1. Overall Latency improved: (1790.19-1634.94)/1790.19*100 = 8.67%
+  2. Overall CPU increased:    (777.32-751.49)/751.45*100    = 3.44%
+  3. Flow Management (add/delete) remained almost constant at ~11K
+     compared to values in millions.
+
+Signed-off-by: Krishna Kumar <krikku@gmail.com>
+Link: https://patch.msgid.link/20250825031005.3674864-2-krikku@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/rps.h    |  7 +++--
+ net/core/dev.c       | 64 +++++++++++++++++++++++++++++++++++++++-----
+ net/core/net-sysfs.c |  4 ++-
+ 3 files changed, 65 insertions(+), 10 deletions(-)
+
+diff --git a/include/net/rps.h b/include/net/rps.h
+index d8ab3a08bcc48..9917dce42ca45 100644
+--- a/include/net/rps.h
++++ b/include/net/rps.h
+@@ -25,13 +25,16 @@ struct rps_map {
+ 
+ /*
+  * The rps_dev_flow structure contains the mapping of a flow to a CPU, the
+- * tail pointer for that CPU's input queue at the time of last enqueue, and
+- * a hardware filter index.
++ * tail pointer for that CPU's input queue at the time of last enqueue, a
++ * hardware filter index, and the hash of the flow if aRFS is enabled.
+  */
+ struct rps_dev_flow {
+ 	u16		cpu;
+ 	u16		filter;
+ 	unsigned int	last_qtail;
++#ifdef CONFIG_RFS_ACCEL
++	u32		hash;
++#endif
+ };
+ #define RPS_NO_FILTER 0xffff
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 5194b70769cc5..a374efa23f079 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4849,6 +4849,36 @@ static u32 rfs_slot(u32 hash, const struct rps_dev_flow_table *flow_table)
+ 	return hash_32(hash, flow_table->log);
+ }
+ 
++#ifdef CONFIG_RFS_ACCEL
++/**
++ * rps_flow_is_active - check whether the flow is recently active.
++ * @rflow: Specific flow to check activity.
++ * @flow_table: per-queue flowtable that @rflow belongs to.
++ * @cpu: CPU saved in @rflow.
++ *
++ * If the CPU has processed many packets since the flow's last activity
++ * (beyond 10 times the table size), the flow is considered stale.
++ *
++ * Return: true if flow was recently active.
++ */
++static bool rps_flow_is_active(struct rps_dev_flow *rflow,
++			       struct rps_dev_flow_table *flow_table,
++			       unsigned int cpu)
++{
++	unsigned int flow_last_active;
++	unsigned int sd_input_head;
++
++	if (cpu >= nr_cpu_ids)
++		return false;
++
++	sd_input_head = READ_ONCE(per_cpu(softnet_data, cpu).input_queue_head);
++	flow_last_active = READ_ONCE(rflow->last_qtail);
++
++	return (int)(sd_input_head - flow_last_active) <
++		(int)(10 << flow_table->log);
++}
++#endif
++
+ static struct rps_dev_flow *
+ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
+ 	    struct rps_dev_flow *rflow, u16 next_cpu)
+@@ -4859,8 +4889,11 @@ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
+ 		struct netdev_rx_queue *rxqueue;
+ 		struct rps_dev_flow_table *flow_table;
+ 		struct rps_dev_flow *old_rflow;
++		struct rps_dev_flow *tmp_rflow;
++		unsigned int tmp_cpu;
+ 		u16 rxq_index;
+ 		u32 flow_id;
++		u32 hash;
+ 		int rc;
+ 
+ 		/* Should we steer this flow to a different hardware queue? */
+@@ -4875,14 +4908,32 @@ set_rps_cpu(struct net_device *dev, struct sk_buff *skb,
+ 		flow_table = rcu_dereference(rxqueue->rps_flow_table);
+ 		if (!flow_table)
+ 			goto out;
+-		flow_id = rfs_slot(skb_get_hash(skb), flow_table);
++
++		hash = skb_get_hash(skb);
++		flow_id = rfs_slot(hash, flow_table);
++
++		tmp_rflow = &flow_table->flows[flow_id];
++		tmp_cpu = READ_ONCE(tmp_rflow->cpu);
++
++		if (READ_ONCE(tmp_rflow->filter) != RPS_NO_FILTER) {
++			if (rps_flow_is_active(tmp_rflow, flow_table,
++					       tmp_cpu)) {
++				if (hash != READ_ONCE(tmp_rflow->hash) ||
++				    next_cpu == tmp_cpu)
++					goto out;
++			}
++		}
++
+ 		rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb,
+ 							rxq_index, flow_id);
+ 		if (rc < 0)
+ 			goto out;
++
+ 		old_rflow = rflow;
+-		rflow = &flow_table->flows[flow_id];
++		rflow = tmp_rflow;
+ 		WRITE_ONCE(rflow->filter, rc);
++		WRITE_ONCE(rflow->hash, hash);
++
+ 		if (old_rflow->filter == rc)
+ 			WRITE_ONCE(old_rflow->filter, RPS_NO_FILTER);
+ 	out:
+@@ -5017,17 +5068,16 @@ bool rps_may_expire_flow(struct net_device *dev, u16 rxq_index,
+ 	struct rps_dev_flow_table *flow_table;
+ 	struct rps_dev_flow *rflow;
+ 	bool expire = true;
+-	unsigned int cpu;
+ 
+ 	rcu_read_lock();
+ 	flow_table = rcu_dereference(rxqueue->rps_flow_table);
+ 	if (flow_table && flow_id < (1UL << flow_table->log)) {
++		unsigned int cpu;
++
+ 		rflow = &flow_table->flows[flow_id];
+ 		cpu = READ_ONCE(rflow->cpu);
+-		if (READ_ONCE(rflow->filter) == filter_id && cpu < nr_cpu_ids &&
+-		    ((int)(READ_ONCE(per_cpu(softnet_data, cpu).input_queue_head) -
+-			   READ_ONCE(rflow->last_qtail)) <
+-		     (int)(10 << flow_table->log)))
++		if (READ_ONCE(rflow->filter) == filter_id &&
++		    rps_flow_is_active(rflow, flow_table, cpu))
+ 			expire = false;
+ 	}
+ 	rcu_read_unlock();
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index c28cd66654447..5ea9f64adce3e 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1120,8 +1120,10 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
+ 			return -ENOMEM;
+ 
+ 		table->log = ilog2(mask) + 1;
+-		for (count = 0; count <= mask; count++)
++		for (count = 0; count <= mask; count++) {
+ 			table->flows[count].cpu = RPS_NO_CPU;
++			table->flows[count].filter = RPS_NO_FILTER;
++		}
+ 	} else {
+ 		table = NULL;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-6.17/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..2e556239a9
--- /dev/null
+++ b/queue-6.17/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From 2e74b76c36cdfedd5647a009a059db4cf43e8b10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 5fc8027c92c7c..695fa3592c9a2 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2360,6 +2360,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2386,6 +2387,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2401,8 +2403,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-6.17/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..42677ccb73
--- /dev/null
+++ b/queue-6.17/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From dab5742b17aab7cb4f8ba3f60f1b4d8b86e5946e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7b16d1207b80c..b9f55e4e360fb 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7977,7 +7977,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv, &priv->dma_conf);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	phylink_rx_clk_stop_block(priv->phylink);
+ 	stmmac_set_rx_mode(ndev);
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch b/queue-6.17/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
new file mode 100644
index 0000000000..30488504a4
--- /dev/null
+++ b/queue-6.17/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
@@ -0,0 +1,49 @@
+From e6d34025499414c638607e494f6a34a86ffd57c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:02:15 +0200
+Subject: net: stmmac: Correctly handle Rx checksum offload errors
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit ee0aace5f844ef59335148875d05bec8764e71e8 ]
+
+The stmmac_rx function would previously set skb->ip_summed to
+CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
+and the packet was of a known IP ethertype.
+
+However, this logic failed to check if the hardware had actually
+reported a checksum error. The hardware status, indicating a header or
+payload checksum failure, was being ignored at this stage. This could
+cause corrupt packets to be passed up the network stack as valid.
+
+This patch corrects the logic by checking the `csum_none` status flag,
+which is set when the hardware reports a checksum error. If this flag
+is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
+ensuring the kernel's network stack will perform its own validation and
+properly handle the corrupt packet.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20250818090217.2789521-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index b9f55e4e360fb..7a375de2258c4 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5735,7 +5735,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 
+ 		skb->protocol = eth_type_trans(skb, priv->dev);
+ 
+-		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb))
++		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb) ||
++		    (status & csum_none))
+ 			skb_checksum_none_assert(skb);
+ 		else
+ 			skb->ip_summed = CHECKSUM_UNNECESSARY;
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-stmmac-est-drop-frames-causing-hlbs-error.patch b/queue-6.17/net-stmmac-est-drop-frames-causing-hlbs-error.patch
new file mode 100644
index 0000000000..ec2a5a32c0
--- /dev/null
+++ b/queue-6.17/net-stmmac-est-drop-frames-causing-hlbs-error.patch
@@ -0,0 +1,92 @@
+From f8c74818b268571118212b6d7f6218f9d46d365d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 22:06:13 +0800
+Subject: net: stmmac: est: Drop frames causing HLBS error
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit 7ce48d497475d7222bd8258c5c055eb7d928793c ]
+
+Drop those frames causing Head-of-Line Blocking due to Scheduling
+(HLBS) error to avoid HLBS interrupt flooding and netdev watchdog
+timeouts due to blocked packets. Tx queues can be configured to drop
+those blocked packets by setting Drop Frames causing Scheduling Error
+(DFBS) bit of EST_CONTROL register.
+
+Also, add per queue HLBS drop count.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Furong Xu <0x1207@gmail.com>
+Link: https://patch.msgid.link/20250925-hlbs_2-v3-1-3b39472776c2@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/common.h     | 1 +
+ drivers/net/ethernet/stmicro/stmmac/stmmac_est.c | 9 ++++++---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_est.h | 1 +
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h
+index cbffccb3b9af0..450a51a994b92 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/common.h
++++ b/drivers/net/ethernet/stmicro/stmmac/common.h
+@@ -228,6 +228,7 @@ struct stmmac_extra_stats {
+ 	unsigned long mtl_est_btrlm;
+ 	unsigned long max_sdu_txq_drop[MTL_MAX_TX_QUEUES];
+ 	unsigned long mtl_est_txq_hlbf[MTL_MAX_TX_QUEUES];
++	unsigned long mtl_est_txq_hlbs[MTL_MAX_TX_QUEUES];
+ 	/* per queue statistics */
+ 	struct stmmac_txq_stats txq_stats[MTL_MAX_TX_QUEUES];
+ 	struct stmmac_rxq_stats rxq_stats[MTL_MAX_RX_QUEUES];
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+index ac6f2e3a3fcd2..4b513d27a9889 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.c
+@@ -63,7 +63,7 @@ static int est_configure(struct stmmac_priv *priv, struct stmmac_est *cfg,
+ 			 EST_GMAC5_PTOV_SHIFT;
+ 	}
+ 	if (cfg->enable)
+-		ctrl |= EST_EEST | EST_SSWL;
++		ctrl |= EST_EEST | EST_SSWL | EST_DFBS;
+ 	else
+ 		ctrl &= ~EST_EEST;
+ 
+@@ -109,6 +109,10 @@ static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,
+ 
+ 		x->mtl_est_hlbs++;
+ 
++		for (i = 0; i < txqcnt; i++)
++			if (value & BIT(i))
++				x->mtl_est_txq_hlbs[i]++;
++
+ 		/* Clear Interrupt */
+ 		writel(value, est_addr + EST_SCH_ERR);
+ 
+@@ -131,10 +135,9 @@ static void est_irq_status(struct stmmac_priv *priv, struct net_device *dev,
+ 
+ 		x->mtl_est_hlbf++;
+ 
+-		for (i = 0; i < txqcnt; i++) {
++		for (i = 0; i < txqcnt; i++)
+ 			if (feqn & BIT(i))
+ 				x->mtl_est_txq_hlbf[i]++;
+-		}
+ 
+ 		/* Clear Interrupt */
+ 		writel(feqn, est_addr + EST_FRM_SZ_ERR);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
+index d247fa383a6e4..f70221c9c84af 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_est.h
+@@ -16,6 +16,7 @@
+ #define EST_XGMAC_PTOV_MUL		9
+ #define EST_SSWL			BIT(1)
+ #define EST_EEST			BIT(0)
++#define EST_DFBS			BIT(5)
+ 
+ #define EST_STATUS			0x00000008
+ #define EST_GMAC5_BTRL			GENMASK(11, 8)
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-wangxun-limit-tx_max_coalesced_frames_irq.patch b/queue-6.17/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
new file mode 100644
index 0000000000..8f7bc3c0c1
--- /dev/null
+++ b/queue-6.17/net-wangxun-limit-tx_max_coalesced_frames_irq.patch
@@ -0,0 +1,42 @@
+From 437c73769315451ec22843d3c88c1eff2c3434e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 10:34:06 +0800
+Subject: net: wangxun: limit tx_max_coalesced_frames_irq
+
+From: Jiawen Wu <jiawenwu@trustnetic.com>
+
+[ Upstream commit fd4aa243f154a80bbeb3dd311d2114eeb538f479 ]
+
+Add limitation on tx_max_coalesced_frames_irq as 0 ~ 65535, because
+'wx->tx_work_limit' is declared as a member of type u16.
+
+Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250821023408.53472-3-jiawenwu@trustnetic.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/wangxun/libwx/wx_ethtool.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
+index c12a4cb951f68..254a48ede2660 100644
+--- a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
++++ b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
+@@ -334,8 +334,11 @@ int wx_set_coalesce(struct net_device *netdev,
+ 			return -EOPNOTSUPP;
+ 	}
+ 
+-	if (ec->tx_max_coalesced_frames_irq)
+-		wx->tx_work_limit = ec->tx_max_coalesced_frames_irq;
++	if (ec->tx_max_coalesced_frames_irq > U16_MAX  ||
++	    !ec->tx_max_coalesced_frames_irq)
++		return -EINVAL;
++
++	wx->tx_work_limit = ec->tx_max_coalesced_frames_irq;
+ 
+ 	switch (wx->mac.type) {
+ 	case wx_mac_sp:
+-- 
+2.51.0
+
diff --git a/queue-6.17/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-6.17/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..51112844fe
--- /dev/null
+++ b/queue-6.17/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From 2bb6f83b392071e14be5cf7c76024fcfc83c950f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index 34137768e7f9a..15acfb74fd238 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -2087,6 +2087,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch b/queue-6.17/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
new file mode 100644
index 0000000000..b110fd687c
--- /dev/null
+++ b/queue-6.17/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
@@ -0,0 +1,129 @@
+From cdff2b5d8ee2ba42d2fb6f259035aeb8904b3653 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:01:02 +0200
+Subject: netfilter: nf_reject: don't reply to icmp error messages
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
+
+tcp reject code won't reply to a tcp reset.
+
+But the icmp reject 'netdev' family versions will reply to icmp
+dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
+by the inet family implementation (and internally by the REJECT target).
+
+Check for the icmp(6) type and do not respond if its an unreachable error.
+
+Without this, something like 'ip protocol icmp reject', when used
+in a netdev chain attached to 'lo', cause a packet loop.
+
+Same for two hosts that both use such a rule: each error packet
+will be replied to.
+
+Such situation persist until the (bogus) rule is amended to ratelimit or
+checks the icmp type before the reject statement.
+
+As the inet versions don't do this make the netdev ones follow along.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
+ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index 0d3cb2ba6fc84..a7a3439fe7800 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+ 
++static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
++{
++	const struct iphdr *iph = ip_hdr(skb);
++	u8 *tp, _type;
++	int thoff;
++
++	if (iph->protocol != IPPROTO_ICMP)
++		return false;
++
++	thoff = skb_network_offset(skb) + sizeof(*iph);
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmphdr, type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMP_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+ 		return NULL;
+ 
++	/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
++	if (nf_skb_is_icmp_unreach(oldskb))
++		return NULL;
++
+ 	/* RFC says return as much as we can without exceeding 576 bytes. */
+ 	len = min_t(unsigned int, 536, oldskb->len);
+ 
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index cb2d38e80de9a..3c56e94e6943b 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+ 
++static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
++{
++	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
++	u8 proto = ip6h->nexthdr;
++	u8 _type, *tp;
++	int thoff;
++	__be16 fo;
++
++	thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
++
++	if (thoff < 0 || thoff >= skb->len || fo != 0)
++		return false;
++
++	if (proto != IPPROTO_ICMPV6)
++		return false;
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmp6hdr, icmp6_type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMPV6_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 	if (!nf_reject_ip6hdr_validate(oldskb))
+ 		return NULL;
+ 
++	/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
++	if (nf_skb_is_icmp6_unreach(oldskb))
++		return NULL;
++
+ 	/* Include "As much of invoking packet as possible without the ICMPv6
+ 	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.17/netfilter-nf_tables-all-transaction-allocations-can-.patch b/queue-6.17/netfilter-nf_tables-all-transaction-allocations-can-.patch
new file mode 100644
index 0000000000..e1bcc73f47
--- /dev/null
+++ b/queue-6.17/netfilter-nf_tables-all-transaction-allocations-can-.patch
@@ -0,0 +1,179 @@
+From 70c7a63a29c2eec072a98a01a8499b2caf46a5ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Aug 2025 10:15:38 +0200
+Subject: netfilter: nf_tables: all transaction allocations can now sleep
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 3d95a2e016abab29ccb6f384576b2038e544a5a8 ]
+
+Now that nft_setelem_flush is not called with rcu read lock held or
+disabled softinterrupts anymore this can now use GFP_KERNEL too.
+
+This is the last atomic allocation of transaction elements, so remove
+all gfp_t arguments and the wrapper function.
+
+This makes attempts to delete large sets much more reliable, before
+this was prone to transient memory allocation failures.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 47 ++++++++++++++---------------------
+ 1 file changed, 19 insertions(+), 28 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index c3c73411c40c4..eed434e0a9702 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -151,12 +151,12 @@ static void nft_ctx_init(struct nft_ctx *ctx,
+ 	bitmap_zero(ctx->reg_inited, NFT_REG32_NUM);
+ }
+ 
+-static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
+-					     int msg_type, u32 size, gfp_t gfp)
++static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
++					 int msg_type, u32 size)
+ {
+ 	struct nft_trans *trans;
+ 
+-	trans = kzalloc(size, gfp);
++	trans = kzalloc(size, GFP_KERNEL);
+ 	if (trans == NULL)
+ 		return NULL;
+ 
+@@ -172,12 +172,6 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,
+ 	return trans;
+ }
+ 
+-static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,
+-					 int msg_type, u32 size)
+-{
+-	return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
+-}
+-
+ static struct nft_trans_binding *nft_trans_get_binding(struct nft_trans *trans)
+ {
+ 	switch (trans->msg_type) {
+@@ -442,8 +436,7 @@ static bool nft_trans_collapse_set_elem_allowed(const struct nft_trans_elem *a,
+ 
+ static bool nft_trans_collapse_set_elem(struct nftables_pernet *nft_net,
+ 					struct nft_trans_elem *tail,
+-					struct nft_trans_elem *trans,
+-					gfp_t gfp)
++					struct nft_trans_elem *trans)
+ {
+ 	unsigned int nelems, old_nelems = tail->nelems;
+ 	struct nft_trans_elem *new_trans;
+@@ -466,9 +459,11 @@ static bool nft_trans_collapse_set_elem(struct nftables_pernet *nft_net,
+ 	/* krealloc might free tail which invalidates list pointers */
+ 	list_del_init(&tail->nft_trans.list);
+ 
+-	new_trans = krealloc(tail, struct_size(tail, elems, nelems), gfp);
++	new_trans = krealloc(tail, struct_size(tail, elems, nelems),
++			     GFP_KERNEL);
+ 	if (!new_trans) {
+-		list_add_tail(&tail->nft_trans.list, &nft_net->commit_list);
++		list_add_tail(&tail->nft_trans.list,
++			      &nft_net->commit_list);
+ 		return false;
+ 	}
+ 
+@@ -484,7 +479,7 @@ static bool nft_trans_collapse_set_elem(struct nftables_pernet *nft_net,
+ }
+ 
+ static bool nft_trans_try_collapse(struct nftables_pernet *nft_net,
+-				   struct nft_trans *trans, gfp_t gfp)
++				   struct nft_trans *trans)
+ {
+ 	struct nft_trans *tail;
+ 
+@@ -501,7 +496,7 @@ static bool nft_trans_try_collapse(struct nftables_pernet *nft_net,
+ 	case NFT_MSG_DELSETELEM:
+ 		return nft_trans_collapse_set_elem(nft_net,
+ 						   nft_trans_container_elem(tail),
+-						   nft_trans_container_elem(trans), gfp);
++						   nft_trans_container_elem(trans));
+ 	}
+ 
+ 	return false;
+@@ -537,17 +532,14 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr
+ 	}
+ }
+ 
+-static void nft_trans_commit_list_add_elem(struct net *net, struct nft_trans *trans,
+-					   gfp_t gfp)
++static void nft_trans_commit_list_add_elem(struct net *net, struct nft_trans *trans)
+ {
+ 	struct nftables_pernet *nft_net = nft_pernet(net);
+ 
+ 	WARN_ON_ONCE(trans->msg_type != NFT_MSG_NEWSETELEM &&
+ 		     trans->msg_type != NFT_MSG_DELSETELEM);
+ 
+-	might_alloc(gfp);
+-
+-	if (nft_trans_try_collapse(nft_net, trans, gfp)) {
++	if (nft_trans_try_collapse(nft_net, trans)) {
+ 		kfree(trans);
+ 		return;
+ 	}
+@@ -7573,7 +7565,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 						}
+ 
+ 						ue->priv = elem_priv;
+-						nft_trans_commit_list_add_elem(ctx->net, trans, GFP_KERNEL);
++						nft_trans_commit_list_add_elem(ctx->net, trans);
+ 						goto err_elem_free;
+ 					}
+ 				}
+@@ -7597,7 +7589,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
+ 	}
+ 
+ 	nft_trans_container_elem(trans)->elems[0].priv = elem.priv;
+-	nft_trans_commit_list_add_elem(ctx->net, trans, GFP_KERNEL);
++	nft_trans_commit_list_add_elem(ctx->net, trans);
+ 	return 0;
+ 
+ err_set_full:
+@@ -7863,7 +7855,7 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
+ 	nft_setelem_data_deactivate(ctx->net, set, elem.priv);
+ 
+ 	nft_trans_container_elem(trans)->elems[0].priv = elem.priv;
+-	nft_trans_commit_list_add_elem(ctx->net, trans, GFP_KERNEL);
++	nft_trans_commit_list_add_elem(ctx->net, trans);
+ 	return 0;
+ 
+ fail_ops:
+@@ -7888,9 +7880,8 @@ static int nft_setelem_flush(const struct nft_ctx *ctx,
+ 	if (!nft_set_elem_active(ext, iter->genmask))
+ 		return 0;
+ 
+-	trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
+-				    struct_size_t(struct nft_trans_elem, elems, 1),
+-				    GFP_ATOMIC);
++	trans = nft_trans_alloc(ctx, NFT_MSG_DELSETELEM,
++				struct_size_t(struct nft_trans_elem, elems, 1));
+ 	if (!trans)
+ 		return -ENOMEM;
+ 
+@@ -7901,7 +7892,7 @@ static int nft_setelem_flush(const struct nft_ctx *ctx,
+ 	nft_trans_elem_set(trans) = set;
+ 	nft_trans_container_elem(trans)->nelems = 1;
+ 	nft_trans_container_elem(trans)->elems[0].priv = elem_priv;
+-	nft_trans_commit_list_add_elem(ctx->net, trans, GFP_ATOMIC);
++	nft_trans_commit_list_add_elem(ctx->net, trans);
+ 
+ 	return 0;
+ }
+@@ -7918,7 +7909,7 @@ static int __nft_set_catchall_flush(const struct nft_ctx *ctx,
+ 
+ 	nft_setelem_data_deactivate(ctx->net, set, elem_priv);
+ 	nft_trans_container_elem(trans)->elems[0].priv = elem_priv;
+-	nft_trans_commit_list_add_elem(ctx->net, trans, GFP_KERNEL);
++	nft_trans_commit_list_add_elem(ctx->net, trans);
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/netlink-specs-fou-change-local-v6-peer-v6-check.patch b/queue-6.17/netlink-specs-fou-change-local-v6-peer-v6-check.patch
new file mode 100644
index 0000000000..6cda65f09b
--- /dev/null
+++ b/queue-6.17/netlink-specs-fou-change-local-v6-peer-v6-check.patch
@@ -0,0 +1,74 @@
+From 1265cf1f99134856c2f37ad338ebe610ec1055fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 15:46:35 +0000
+Subject: netlink: specs: fou: change local-v6/peer-v6 check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+
+[ Upstream commit 9f9581ba74a931843c6d807ecfeaff9fb8c1b731 ]
+
+While updating the binary min-len implementation, I noticed that
+the only user, should AFAICT be using exact-len instead.
+
+In net/ipv4/fou_core.c FOU_ATTR_LOCAL_V6 and FOU_ATTR_PEER_V6
+are only used for singular IPv6 addresses, and there are AFAICT
+no known implementations trying to send more, it therefore
+appears safe to change it to an exact-len policy.
+
+This patch therefore changes the local-v6/peer-v6 attributes to
+use an exact-len check, instead of a min-len check.
+
+Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+Reviewed-by: Donald Hunter <donald.hunter@gmail.com>
+Link: https://patch.msgid.link/20250902154640.759815-2-ast@fiberby.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/fou.yaml | 4 ++--
+ net/ipv4/fou_nl.c                    | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Documentation/netlink/specs/fou.yaml b/Documentation/netlink/specs/fou.yaml
+index 57735726262ec..8e7974ec453fc 100644
+--- a/Documentation/netlink/specs/fou.yaml
++++ b/Documentation/netlink/specs/fou.yaml
+@@ -52,7 +52,7 @@ attribute-sets:
+         name: local-v6
+         type: binary
+         checks:
+-          min-len: 16
++          exact-len: 16
+       -
+         name: peer-v4
+         type: u32
+@@ -60,7 +60,7 @@ attribute-sets:
+         name: peer-v6
+         type: binary
+         checks:
+-          min-len: 16
++          exact-len: 16
+       -
+         name: peer-port
+         type: u16
+diff --git a/net/ipv4/fou_nl.c b/net/ipv4/fou_nl.c
+index 3d9614609b2d3..506260b4a4dc2 100644
+--- a/net/ipv4/fou_nl.c
++++ b/net/ipv4/fou_nl.c
+@@ -18,9 +18,9 @@ const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX + 1] = {
+ 	[FOU_ATTR_TYPE] = { .type = NLA_U8, },
+ 	[FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
+ 	[FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },
+-	[FOU_ATTR_LOCAL_V6] = { .len = 16, },
++	[FOU_ATTR_LOCAL_V6] = NLA_POLICY_EXACT_LEN(16),
+ 	[FOU_ATTR_PEER_V4] = { .type = NLA_U32, },
+-	[FOU_ATTR_PEER_V6] = { .len = 16, },
++	[FOU_ATTR_PEER_V6] = NLA_POLICY_EXACT_LEN(16),
+ 	[FOU_ATTR_PEER_PORT] = { .type = NLA_BE16, },
+ 	[FOU_ATTR_IFINDEX] = { .type = NLA_S32, },
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.17/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-6.17/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..0647596e27
--- /dev/null
+++ b/queue-6.17/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From 98b3543441124915d0d52e6d162320e7d08300c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 4de3e4bd724b7..b76da06864e53 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -391,7 +391,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-6.17/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-6.17/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..1011721241
--- /dev/null
+++ b/queue-6.17/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From 9ad14f569a0ebdc3e90fba89776a671dfc94f8d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 611e6283c194f..4de3e4bd724b7 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7872,10 +7872,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-6.17/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..d48c2becfe
--- /dev/null
+++ b/queue-6.17/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From ac856dd158e5ae0ab806c8f527bdd2bbf11a03f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 7612e977e80b5..01179f7de3225 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2744,6 +2744,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.17/ntfs3-pretend-extend-records-as-regular-files.patch b/queue-6.17/ntfs3-pretend-extend-records-as-regular-files.patch
new file mode 100644
index 0000000000..f24305ea2c
--- /dev/null
+++ b/queue-6.17/ntfs3-pretend-extend-records-as-regular-files.patch
@@ -0,0 +1,37 @@
+From 84217af2745a8e30b6f141b9ba36df735a048d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:43:24 +0900
+Subject: ntfs3: pretend $Extend records as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 37cbbee7fa580..b08b009121653 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -471,6 +471,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ 		   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
+ 		/* Records in $Extend are not a files or general directories. */
+ 		inode->i_op = &ntfs_file_inode_operations;
++		mode = S_IFREG;
+ 	} else {
+ 		err = -EINVAL;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-6.17/octeontx2-af-broadcast-xon-on-all-channels.patch b/queue-6.17/octeontx2-af-broadcast-xon-on-all-channels.patch
new file mode 100644
index 0000000000..78e7a051ef
--- /dev/null
+++ b/queue-6.17/octeontx2-af-broadcast-xon-on-all-channels.patch
@@ -0,0 +1,92 @@
+From 302edce84d463da0f769367f54e87cb7528547d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 12:16:25 +0530
+Subject: Octeontx2-af: Broadcast XON on all channels
+
+From: Hariprasad Kelam <hkelam@marvell.com>
+
+[ Upstream commit a7bd72158063740212344fad5d99dcef45bc70d6 ]
+
+The NIX block receives traffic from multiple channels, including:
+
+MAC block (RPM)
+Loopback module (LBK)
+CPT block
+
+                     RPM
+                      |
+                -----------------
+       LBK   --|     NIX         |
+                -----------------
+                     |
+                    CPT
+
+Due to a hardware errata,  CN10k and earlier Octeon silicon series,
+the hardware may incorrectly assert XOFF on certain channels during
+reset. As a workaround, a write operation to the NIX_AF_RX_CHANX_CFG
+register can be performed to broadcast XON signals on the affected
+channels
+
+Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
+Link: https://patch.msgid.link/20250820064625.1464361-1-hkelam@marvell.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.c  |  3 +++
+ drivers/net/ethernet/marvell/octeontx2/af/rvu.h  |  1 +
+ .../net/ethernet/marvell/octeontx2/af/rvu_nix.c  | 16 ++++++++++++++++
+ 3 files changed, 20 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+index c6bb3aaa8e0d0..2d78e08f985f0 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+@@ -1164,6 +1164,9 @@ static int rvu_setup_hw_resources(struct rvu *rvu)
+ 	rvu_program_channels(rvu);
+ 	cgx_start_linkup(rvu);
+ 
++	rvu_block_bcast_xon(rvu, BLKADDR_NIX0);
++	rvu_block_bcast_xon(rvu, BLKADDR_NIX1);
++
+ 	err = rvu_mcs_init(rvu);
+ 	if (err) {
+ 		dev_err(rvu->dev, "%s: Failed to initialize mcs\n", __func__);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+index 18c7bb39dbc73..b582833419232 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.h
+@@ -1031,6 +1031,7 @@ int rvu_nix_mcast_update_mcam_entry(struct rvu *rvu, u16 pcifunc,
+ void rvu_nix_flr_free_bpids(struct rvu *rvu, u16 pcifunc);
+ int rvu_alloc_cint_qint_mem(struct rvu *rvu, struct rvu_pfvf *pfvf,
+ 			    int blkaddr, int nixlf);
++void rvu_block_bcast_xon(struct rvu *rvu, int blkaddr);
+ /* NPC APIs */
+ void rvu_npc_freemem(struct rvu *rvu);
+ int rvu_npc_get_pkind(struct rvu *rvu, u16 pf);
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+index 60db1f616cc82..828316211b245 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -6616,3 +6616,19 @@ int rvu_mbox_handler_nix_mcast_grp_update(struct rvu *rvu,
+ 
+ 	return ret;
+ }
++
++/* On CN10k and older series of silicons, hardware may incorrectly
++ * assert XOFF on certain channels. Issue a write on NIX_AF_RX_CHANX_CFG
++ * to broadcacst XON on the same.
++ */
++void rvu_block_bcast_xon(struct rvu *rvu, int blkaddr)
++{
++	struct rvu_block *block = &rvu->hw->block[blkaddr];
++	u64 cfg;
++
++	if (!block->implemented || is_cn20k(rvu->pdev))
++		return;
++
++	cfg = rvu_read64(rvu, blkaddr, NIX_AF_RX_CHANX_CFG(0));
++	rvu_write64(rvu, blkaddr, NIX_AF_RX_CHANX_CFG(0), cfg);
++}
+-- 
+2.51.0
+
diff --git a/queue-6.17/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch b/queue-6.17/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
new file mode 100644
index 0000000000..87770fcef5
--- /dev/null
+++ b/queue-6.17/openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
@@ -0,0 +1,40 @@
+From c5f406ff5383de14e647726e69448821e52cd9cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 18:12:56 +0000
+Subject: openrisc: Add R_OR1K_32_PCREL relocation type module support
+
+From: chenmiao <chenmiao.ku@gmail.com>
+
+[ Upstream commit 9d0cb6d00be891586261a35da7f8c3c956825c39 ]
+
+To ensure the proper functioning of the jump_label test module, this patch
+adds support for the R_OR1K_32_PCREL relocation type for any modules. The
+implementation calculates the PC-relative offset by subtracting the
+instruction location from the target value and stores the result at the
+specified location.
+
+Signed-off-by: chenmiao <chenmiao.ku@gmail.com>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/module.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/openrisc/kernel/module.c b/arch/openrisc/kernel/module.c
+index c9ff4c4a0b29b..4ac4fbaa827c1 100644
+--- a/arch/openrisc/kernel/module.c
++++ b/arch/openrisc/kernel/module.c
+@@ -55,6 +55,10 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
+ 			value |= *location & 0xfc000000;
+ 			*location = value;
+ 			break;
++		case R_OR1K_32_PCREL:
++			value -= (uint32_t)location;
++			*location = value;
++			break;
+ 		case R_OR1K_AHI16:
+ 			/* Adjust the operand to match with a signed LO16.  */
+ 			value += 0x8000;
+-- 
+2.51.0
+
diff --git a/queue-6.17/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-6.17/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..6cbc813b81
--- /dev/null
+++ b/queue-6.17/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From 4e5a5328e9f7d7af63d795020a4d7aa809fda2d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index 74ef75586f384..eee3c5ed1bbbb 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/ovl-make-sure-that-ovl_create_real-returns-a-hashed-.patch b/queue-6.17/ovl-make-sure-that-ovl_create_real-returns-a-hashed-.patch
new file mode 100644
index 0000000000..7d2a145d0c
--- /dev/null
+++ b/queue-6.17/ovl-make-sure-that-ovl_create_real-returns-a-hashed-.patch
@@ -0,0 +1,80 @@
+From fd5c0017b190ea6a06ec9409063b46a101f8a73a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 19:55:26 +0200
+Subject: ovl: make sure that ovl_create_real() returns a hashed dentry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit ad1423922781e6552f18d055a5742b1cff018cdc ]
+
+e8bd877fb76bb9f3 ("ovl: fix possible double unlink") added a sanity
+check of !d_unhashed(child) to try to verify that child dentry was not
+unlinked while parent dir was unlocked.
+
+This "was not unlink" check has a false positive result in the case of
+casefolded parent dir, because in that case, ovl_create_temp() returns
+an unhashed dentry after ovl_create_real() gets an unhashed dentry from
+ovl_lookup_upper() and makes it positive.
+
+To avoid returning unhashed dentry from ovl_create_temp(), let
+ovl_create_real() lookup again after making the newdentry positive,
+so it always returns a hashed positive dentry (or an error).
+
+This fixes the error in ovl_parent_lock() in ovl_check_rename_whiteout()
+after ovl_create_temp() and allows mount of overlayfs with casefolding
+enabled layers.
+
+Reported-by: André Almeida <andrealmeid@igalia.com>
+Closes: https://lore.kernel.org/r/18704e8c-c734-43f3-bc7c-b8be345e1bf5@igalia.com/
+Suggested-by: Neil Brown <neil@brown.name>
+Reviewed-by: Neil Brown <neil@brown.name>
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/dir.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index dbd63a74df4b1..039e829aa7dee 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -205,12 +205,32 @@ struct dentry *ovl_create_real(struct ovl_fs *ofs, struct dentry *parent,
+ 			err = -EPERM;
+ 		}
+ 	}
+-	if (!err && WARN_ON(!newdentry->d_inode)) {
++	if (err)
++		goto out;
++
++	if (WARN_ON(!newdentry->d_inode)) {
+ 		/*
+ 		 * Not quite sure if non-instantiated dentry is legal or not.
+ 		 * VFS doesn't seem to care so check and warn here.
+ 		 */
+ 		err = -EIO;
++	} else if (d_unhashed(newdentry)) {
++		struct dentry *d;
++		/*
++		 * Some filesystems (i.e. casefolded) may return an unhashed
++		 * negative dentry from the ovl_lookup_upper() call before
++		 * ovl_create_real().
++		 * In that case, lookup again after making the newdentry
++		 * positive, so ovl_create_upper() always returns a hashed
++		 * positive dentry.
++		 */
++		d = ovl_lookup_upper(ofs, newdentry->d_name.name, parent,
++				     newdentry->d_name.len);
++		dput(newdentry);
++		if (IS_ERR_OR_NULL(d))
++			err = d ? PTR_ERR(d) : -ENOENT;
++		else
++			return d;
+ 	}
+ out:
+ 	if (err) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch b/queue-6.17/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
new file mode 100644
index 0000000000..022333c35e
--- /dev/null
+++ b/queue-6.17/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
@@ -0,0 +1,43 @@
+From dcc0fa5e3548cf2dbd2db88fa4e39b31da938ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:17:03 -0700
+Subject: page_pool: always add GFP_NOWARN for ATOMIC allocations
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
+
+Driver authors often forget to add GFP_NOWARN for page allocation
+from the datapath. This is annoying to users as OOMs are a fact
+of life, and we pretty much expect network Rx to hit page allocation
+failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
+by default.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 19c92aa04e549..e224d2145eed9 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -596,6 +596,12 @@ static noinline netmem_ref __page_pool_alloc_netmems_slow(struct page_pool *pool
+ 	netmem_ref netmem;
+ 	int i, nr_pages;
+ 
++	/* Unconditionally set NOWARN if allocating from NAPI.
++	 * Drivers forget to set it, and OOM reports on packet Rx are useless.
++	 */
++	if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
++		gfp |= __GFP_NOWARN;
++
+ 	/* Don't support bulk alloc for high-order pages */
+ 	if (unlikely(pp_order))
+ 		return page_to_netmem(__page_pool_alloc_page_order(pool, gfp));
+-- 
+2.51.0
+
diff --git a/queue-6.17/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-6.17/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..71baf6b247
--- /dev/null
+++ b/queue-6.17/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 7ac5ce635ae813fd77c3288b3ab7565912bd6f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index e224d2145eed9..1a5edec485f14 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -211,11 +211,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-aer-fix-null-pointer-access-by-aer_info.patch b/queue-6.17/pci-aer-fix-null-pointer-access-by-aer_info.patch
new file mode 100644
index 0000000000..7346d08277
--- /dev/null
+++ b/queue-6.17/pci-aer-fix-null-pointer-access-by-aer_info.patch
@@ -0,0 +1,38 @@
+From 0870b593be3f4c35ee000a13a48920957410d6e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 02:25:27 +0800
+Subject: PCI/AER: Fix NULL pointer access by aer_info
+
+From: Vernon Yang <yanglincheng@kylinos.cn>
+
+[ Upstream commit 0a27bdb14b028fed30a10cec2f945c38cb5ca4fa ]
+
+The kzalloc(GFP_KERNEL) may return NULL, so all accesses to aer_info->xxx
+will result in kernel panic. Fix it.
+
+Signed-off-by: Vernon Yang <yanglincheng@kylinos.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250904182527.67371-1-vernon2gm@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/aer.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
+index 9d23294ceb2f6..3dba9c0c6ae11 100644
+--- a/drivers/pci/pcie/aer.c
++++ b/drivers/pci/pcie/aer.c
+@@ -383,6 +383,10 @@ void pci_aer_init(struct pci_dev *dev)
+ 		return;
+ 
+ 	dev->aer_info = kzalloc(sizeof(*dev->aer_info), GFP_KERNEL);
++	if (!dev->aer_info) {
++		dev->aer_cap = 0;
++		return;
++	}
+ 
+ 	ratelimit_state_init(&dev->aer_info->correctable_ratelimit,
+ 			     DEFAULT_RATELIMIT_INTERVAL, DEFAULT_RATELIMIT_BURST);
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-6.17/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..da7974c9c7
--- /dev/null
+++ b/queue-6.17/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From d341190af615446399314a7ffdf7d133356ca56c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 59a4631de79fe..fffd63d6665e8 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -531,7 +531,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 70a19573440ee..61806bbd8aa32 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -92,7 +92,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -123,7 +123,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 1d81c4bf6c6db..2f07ba661bda7 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -468,7 +468,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -476,13 +476,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-6.17/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..50bc658d26
--- /dev/null
+++ b/queue-6.17/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 7f7c20d691bb0ecb8a51ac83229f4de3f2aa2141 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d97335a401930..6eb3d20386e95 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2717,6 +2717,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch b/queue-6.17/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
new file mode 100644
index 0000000000..cabb4d1eb3
--- /dev/null
+++ b/queue-6.17/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
@@ -0,0 +1,53 @@
+From 58c1ee0cd238706742bf1c9ed62f17fdd53b027d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 18:59:15 +0200
+Subject: PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 09fefb24ed5e15f3b112f6c04b21a90ea23eaf8b ]
+
+dw_pcie_edma_irq_verify() is supposed to verify the eDMA IRQs in devicetree
+by fetching them using either 'dma' or 'dmaX' IRQ names. Former is used
+when the platform uses a single IRQ for all eDMA channels and latter is
+used when the platform uses separate IRQ per channel. But currently,
+dw_pcie_edma_irq_verify() bails out early if edma::nr_irqs is 1, i.e., when
+a single IRQ is used. This gives an impression that the driver could work
+with any single IRQ in devicetree, not necessarily with name 'dma'.
+
+But dw_pcie_edma_irq_vector(), which actually requests the IRQ, does
+require the single IRQ to be named as 'dma'. So this creates inconsistency
+between dw_pcie_edma_irq_verify() and dw_pcie_edma_irq_vector().
+
+Thus, to fix this inconsistency, make sure dw_pcie_edma_irq_verify() also
+verifies the single IRQ name by removing the bail out code.
+
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: fix typos]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250908165914.547002-3-cassel@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
+index 89aad5a08928c..c7a2cf5e886f3 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.c
++++ b/drivers/pci/controller/dwc/pcie-designware.c
+@@ -1045,9 +1045,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)
+ 	char name[15];
+ 	int ret;
+ 
+-	if (pci->edma.nr_irqs == 1)
+-		return 0;
+-	else if (pci->edma.nr_irqs > 1)
++	if (pci->edma.nr_irqs > 1)
+ 		return pci->edma.nr_irqs != ch_cnt ? -EINVAL : 0;
+ 
+ 	ret = platform_get_irq_byname_optional(pdev, "dma");
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch b/queue-6.17/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
new file mode 100644
index 0000000000..2a12620a25
--- /dev/null
+++ b/queue-6.17/pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
@@ -0,0 +1,58 @@
+From e35030ec7bf87d03123d582bd3901474c35deb17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 20:42:10 +0200
+Subject: PCI: endpoint: pci-epf-test: Limit PCIe BAR size for fixed BARs
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit d5f6bd3ee3f5048f272182dc91675c082773999e ]
+
+Currently, the test allocates BAR sizes according to fixed table bar_size.
+This does not work with controllers which have fixed size BARs that are
+smaller than the requested BAR size. One such controller is Renesas R-Car
+V4H PCIe controller, which has BAR4 size limited to 256 bytes, which is
+much less than one of the BAR size, 131072 currently requested by this
+test. A lot of controllers drivers in-tree have fixed size BARs, and they
+do work perfectly fine, but it is only because their fixed size is larger
+than the size requested by pci-epf-test.c
+
+Adjust the test such that in case a fixed size BAR is detected, the fixed
+BAR size is used, as that is the only possible option.
+
+This helps with test failures reported as follows:
+
+  pci_epf_test pci_epf_test.0: requested BAR size is larger than fixed size
+  pci_epf_test pci_epf_test.0: Failed to allocate space for BAR4
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Link: https://patch.msgid.link/20250905184240.144431-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index 044f5ea0716d1..31617772ad516 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -1067,7 +1067,12 @@ static int pci_epf_test_alloc_space(struct pci_epf *epf)
+ 		if (bar == test_reg_bar)
+ 			continue;
+ 
+-		base = pci_epf_alloc_space(epf, bar_size[bar], bar,
++		if (epc_features->bar[bar].type == BAR_FIXED)
++			test_reg_size = epc_features->bar[bar].fixed_size;
++		else
++			test_reg_size = bar_size[bar];
++
++		base = pci_epf_alloc_space(epf, test_reg_size, bar,
+ 					   epc_features, PRIMARY_INTERFACE);
+ 		if (!base)
+ 			dev_err(dev, "Failed to allocate space for BAR%d\n",
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-err-update-device-error_state-already-after-rese.patch b/queue-6.17/pci-err-update-device-error_state-already-after-rese.patch
new file mode 100644
index 0000000000..8ac55f20e2
--- /dev/null
+++ b/queue-6.17/pci-err-update-device-error_state-already-after-rese.patch
@@ -0,0 +1,107 @@
+From 4f56c27078762dc3dc80376b4d1257f29b6de7f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 07:11:04 +0200
+Subject: PCI/ERR: Update device error_state already after reset
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 45bc82563d5505327d97963bc54d3709939fa8f8 ]
+
+After a Fatal Error has been reported by a device and has been recovered
+through a Secondary Bus Reset, AER updates the device's error_state to
+pci_channel_io_normal before invoking its driver's ->resume() callback.
+
+By contrast, EEH updates the error_state earlier, namely after resetting
+the device and before invoking its driver's ->slot_reset() callback.
+Commit c58dc575f3c8 ("powerpc/pseries: Set error_state to
+pci_channel_io_normal in eeh_report_reset()") explains in great detail
+that the earlier invocation is necessitated by various drivers checking
+accessibility of the device with pci_channel_offline() and avoiding
+accesses if it returns true.  It returns true for any other error_state
+than pci_channel_io_normal.
+
+The device should be accessible already after reset, hence the reasoning
+is that it's safe to update the error_state immediately afterwards.
+
+This deviation between AER and EEH seems problematic because drivers
+behave differently depending on which error recovery mechanism the
+platform uses.  Three drivers have gone so far as to update the
+error_state themselves, presumably to work around AER's behavior.
+
+For consistency, amend AER to update the error_state at the same recovery
+steps as EEH.  Drop the now unnecessary workaround from the three drivers.
+
+Keep updating the error_state before ->resume() in case ->error_detected()
+or ->mmio_enabled() return PCI_ERS_RESULT_RECOVERED, which causes
+->slot_reset() to be skipped.  There are drivers doing this even for Fatal
+Errors, e.g. mhi_pci_error_detected().
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/4517af6359ffb9d66152b827a5d2833459144e3f.1755008151.git.lukas@wunner.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 1 -
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c    | 2 --
+ drivers/pci/pcie/err.c                              | 3 ++-
+ drivers/scsi/qla2xxx/qla_os.c                       | 5 -----
+ 4 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index d7cdea8f604d0..91e7b38143ead 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -4215,7 +4215,6 @@ static pci_ers_result_t qlcnic_83xx_io_slot_reset(struct pci_dev *pdev)
+ 	struct qlcnic_adapter *adapter = pci_get_drvdata(pdev);
+ 	int err = 0;
+ 
+-	pdev->error_state = pci_channel_io_normal;
+ 	err = pci_enable_device(pdev);
+ 	if (err)
+ 		goto disconnect;
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+index 53cdd36c41236..e051d8c7a28d6 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+@@ -3766,8 +3766,6 @@ static int qlcnic_attach_func(struct pci_dev *pdev)
+ 	struct qlcnic_adapter *adapter = pci_get_drvdata(pdev);
+ 	struct net_device *netdev = adapter->netdev;
+ 
+-	pdev->error_state = pci_channel_io_normal;
+-
+ 	err = pci_enable_device(pdev);
+ 	if (err)
+ 		return err;
+diff --git a/drivers/pci/pcie/err.c b/drivers/pci/pcie/err.c
+index a4990c9ad493a..e85b9cd5fec1b 100644
+--- a/drivers/pci/pcie/err.c
++++ b/drivers/pci/pcie/err.c
+@@ -141,7 +141,8 @@ static int report_slot_reset(struct pci_dev *dev, void *data)
+ 
+ 	device_lock(&dev->dev);
+ 	pdrv = dev->driver;
+-	if (!pdrv || !pdrv->err_handler || !pdrv->err_handler->slot_reset)
++	if (!pci_dev_set_io_state(dev, pci_channel_io_normal) ||
++	    !pdrv || !pdrv->err_handler || !pdrv->err_handler->slot_reset)
+ 		goto out;
+ 
+ 	err_handler = pdrv->err_handler;
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index d4b484c0fd9d7..4460421834cb2 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -7883,11 +7883,6 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
+ 	       "Slot Reset.\n");
+ 
+ 	ha->pci_error_state = QLA_PCI_SLOT_RESET;
+-	/* Workaround: qla2xxx driver which access hardware earlier
+-	 * needs error state to be pci_channel_io_online.
+-	 * Otherwise mailbox command timesout.
+-	 */
+-	pdev->error_state = pci_channel_io_normal;
+ 
+ 	pci_restore_state(pdev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-imx6-enable-the-vaux-supply-if-available.patch b/queue-6.17/pci-imx6-enable-the-vaux-supply-if-available.patch
new file mode 100644
index 0000000000..af0ea183f4
--- /dev/null
+++ b/queue-6.17/pci-imx6-enable-the-vaux-supply-if-available.patch
@@ -0,0 +1,42 @@
+From b1dc46cfb56b242f408c3f8df894f75c85a2bfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 10:23:28 +0800
+Subject: PCI: imx6: Enable the Vaux supply if available
+
+From: Richard Zhu <hongxing.zhu@nxp.com>
+
+[ Upstream commit c221cbf8dc547eb8489152ac62ef103fede99545 ]
+
+When the 3.3Vaux supply is present, fetch it at the probe time and keep it
+enabled for the entire PCIe controller lifecycle so that the link can enter
+L2 state and the devices can signal wakeup using either Beacon or WAKE#
+mechanisms.
+
+Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
+[mani: reworded the subject, description and error message]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Link: https://patch.msgid.link/20250820022328.2143374-1-hongxing.zhu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index 80e48746bbaf6..db51e382a7cf3 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1745,6 +1745,10 @@ static int imx_pcie_probe(struct platform_device *pdev)
+ 	pci->max_link_speed = 1;
+ 	of_property_read_u32(node, "fsl,max-link-speed", &pci->max_link_speed);
+ 
++	ret = devm_regulator_get_enable_optional(&pdev->dev, "vpcie3v3aux");
++	if (ret < 0 && ret != -ENODEV)
++		return dev_err_probe(dev, ret, "failed to enable Vaux supply\n");
++
+ 	imx_pcie->vpcie = devm_regulator_get_optional(&pdev->dev, "vpcie");
+ 	if (IS_ERR(imx_pcie->vpcie)) {
+ 		if (PTR_ERR(imx_pcie->vpcie) != -ENODEV)
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-6.17/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..240f7a3045
--- /dev/null
+++ b/queue-6.17/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From 0266c4b31c1ea0c20dae5676e3fa4e18bb2a16c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index da5657a020074..1cb5e423eed4f 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -360,7 +360,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-6.17/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch b/queue-6.17/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
new file mode 100644
index 0000000000..7b48edcf53
--- /dev/null
+++ b/queue-6.17/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
@@ -0,0 +1,60 @@
+From f17fa33c7e64c76455afa8c9258fdc49460c41b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 22:19:15 -0500
+Subject: PCI/PM: Skip resuming to D0 if device is disconnected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
+
+When a device is surprise-removed (e.g., due to a dock unplug), the PCI
+core unconfigures all downstream devices and sets their error state to
+pci_channel_io_perm_failure. This marks them as disconnected via
+pci_dev_is_disconnected().
+
+During device removal, the runtime PM framework may attempt to resume the
+device to D0 via pm_runtime_get_sync(), which calls into pci_power_up().
+Since the device is already disconnected, this resume attempt is
+unnecessary and results in a predictable errors like this, typically when
+undocking from a TBT3 or USB4 dock with PCIe tunneling:
+
+  pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
+
+Avoid powering up disconnected devices by checking their status early in
+pci_power_up() and returning -EIO.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+[bhelgaas: add typical message]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 005b92e6585e9..372de7961d2a6 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1374,6 +1374,11 @@ int pci_power_up(struct pci_dev *dev)
+ 		return -EIO;
+ 	}
+ 
++	if (pci_dev_is_disconnected(dev)) {
++		dev->current_state = PCI_D3cold;
++		return -EIO;
++	}
++
+ 	pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+ 	if (PCI_POSSIBLE_ERROR(pmcsr)) {
+ 		pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
+-- 
+2.51.0
+
diff --git a/queue-6.17/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-6.17/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..ee5acd7cbd
--- /dev/null
+++ b/queue-6.17/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 1b7fe7b29682cbc76d09c6709202359e2463037c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index de5389374d79d..1bd986cba8f7f 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -145,7 +145,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -155,6 +155,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-6.17/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch b/queue-6.17/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
new file mode 100644
index 0000000000..47552468e4
--- /dev/null
+++ b/queue-6.17/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
@@ -0,0 +1,77 @@
+From b929878dedd40050ef3683f572307ceaccc70d9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:07:24 +0200
+Subject: phy: renesas: r8a779f0-ether-serdes: add new step added to latest
+ datasheet
+
+From: Michael Dege <michael.dege@renesas.com>
+
+[ Upstream commit e4a8db93b5ec9bca1cc66b295544899e3afd5e86 ]
+
+R-Car S4-8 datasheet Rev.1.20 describes some additional register
+settings at the end of the initialization.
+
+Signed-off-by: Michael Dege <michael.dege@renesas.com>
+Link: https://lore.kernel.org/r/20250703-renesas-serdes-update-v4-2-1db5629cac2b@renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 +++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/phy/renesas/r8a779f0-ether-serdes.c b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+index 3b2d8cef75e52..4d12d091b0ab0 100644
+--- a/drivers/phy/renesas/r8a779f0-ether-serdes.c
++++ b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+@@ -49,6 +49,13 @@ static void r8a779f0_eth_serdes_write32(void __iomem *addr, u32 offs, u32 bank,
+ 	iowrite32(data, addr + offs);
+ }
+ 
++static u32 r8a779f0_eth_serdes_read32(void __iomem *addr, u32 offs,  u32 bank)
++{
++	iowrite32(bank, addr + R8A779F0_ETH_SERDES_BANK_SELECT);
++
++	return ioread32(addr + offs);
++}
++
+ static int
+ r8a779f0_eth_serdes_reg_wait(struct r8a779f0_eth_serdes_channel *channel,
+ 			     u32 offs, u32 bank, u32 mask, u32 expected)
+@@ -274,6 +281,7 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ *channel)
+ {
+ 	int ret;
++	u32 val;
+ 
+ 	ret = r8a779f0_eth_serdes_chan_setting(channel);
+ 	if (ret)
+@@ -287,6 +295,26 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ 
+ 	r8a779f0_eth_serdes_write32(channel->addr, 0x03d0, 0x380, 0x0000);
+ 
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x00c0, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val | BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val & ~BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x0144, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val | BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val & ~BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
+ 	return r8a779f0_eth_serdes_monitor_linkup(channel);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch b/queue-6.17/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
new file mode 100644
index 0000000000..2e72b75461
--- /dev/null
+++ b/queue-6.17/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
@@ -0,0 +1,55 @@
+From 212c97c441a3360f65375087a0b328a0b9c29cd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:04:52 +0200
+Subject: phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
+ register 0
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
+
+The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
+value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
+this offset is perfectly fine (in fact, register 0 is the only one in
+this register file).
+Introduce a boolean variable to indicate valid registers and allow writes
+to register 0.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+index 2ab99e1d47ebe..75533d0710250 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+@@ -87,10 +87,11 @@ struct dphy_reg {
+ 	u32 offset;
+ 	u32 mask;
+ 	u32 shift;
++	u8 valid;
+ };
+ 
+ #define PHY_REG(_offset, _width, _shift) \
+-	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
++	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
+ 
+ static const struct dphy_reg rk1808_grf_dphy_regs[] = {
+ 	[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
+@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
+ 	const struct dphy_drv_data *drv_data = priv->drv_data;
+ 	const struct dphy_reg *reg = &drv_data->grf_regs[index];
+ 
+-	if (reg->offset)
++	if (reg->valid)
+ 		regmap_write(priv->grf, reg->offset,
+ 			     HIWORD_UPDATE(value, reg->mask, reg->shift));
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/platform-x86-amd-pmf-fix-the-custom-bios-input-handl.patch b/queue-6.17/platform-x86-amd-pmf-fix-the-custom-bios-input-handl.patch
new file mode 100644
index 0000000000..06c1c5f6f7
--- /dev/null
+++ b/queue-6.17/platform-x86-amd-pmf-fix-the-custom-bios-input-handl.patch
@@ -0,0 +1,154 @@
+From 082e8cf67bab7c7110fffe0bb984470625a4e771 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 16:31:33 +0530
+Subject: platform/x86/amd/pmf: Fix the custom bios input handling mechanism
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit d82e3d2dd0ba019ac6cdd81e47bf4c8ac895cfa0 ]
+
+Originally, the 'amd_pmf_get_custom_bios_inputs()' function was written
+under the assumption that the BIOS would only send a single pending
+request for the driver to process. However, following OEM enablement, it
+became clear that multiple pending requests for custom BIOS inputs might
+be sent at the same time, a scenario that the current code logic does not
+support when it comes to handling multiple custom BIOS inputs.
+
+To address this, the code logic needs to be improved to not only manage
+multiple simultaneous custom BIOS inputs but also to ensure it is scalable
+for future additional inputs.
+
+Co-developed-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Signed-off-by: Patil Rajesh Reddy <Patil.Reddy@amd.com>
+Tested-by: Yijun Shen <Yijun.Shen@Dell.com>
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://patch.msgid.link/20250901110140.2519072-3-Shyam-sundar.S-k@amd.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/pmf.h | 15 +++++-----
+ drivers/platform/x86/amd/pmf/spc.c | 48 +++++++++++++++++++++++-------
+ 2 files changed, 44 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/pmf.h b/drivers/platform/x86/amd/pmf/pmf.h
+index 45b60238d5277..df1b4a4f9586b 100644
+--- a/drivers/platform/x86/amd/pmf/pmf.h
++++ b/drivers/platform/x86/amd/pmf/pmf.h
+@@ -621,14 +621,14 @@ enum ta_slider {
+ 	TA_MAX,
+ };
+ 
+-enum apmf_smartpc_custom_bios_inputs {
+-	APMF_SMARTPC_CUSTOM_BIOS_INPUT1,
+-	APMF_SMARTPC_CUSTOM_BIOS_INPUT2,
++struct amd_pmf_pb_bitmap {
++	const char *name;
++	u32 bit_mask;
+ };
+ 
+-enum apmf_preq_smartpc {
+-	NOTIFY_CUSTOM_BIOS_INPUT1 = 5,
+-	NOTIFY_CUSTOM_BIOS_INPUT2,
++static const struct amd_pmf_pb_bitmap custom_bios_inputs[] __used = {
++	{"NOTIFY_CUSTOM_BIOS_INPUT1",     BIT(5)},
++	{"NOTIFY_CUSTOM_BIOS_INPUT2",     BIT(6)},
+ };
+ 
+ enum platform_type {
+@@ -686,8 +686,7 @@ struct ta_pmf_condition_info {
+ 	u32 power_slider;
+ 	u32 lid_state;
+ 	bool user_present;
+-	u32 bios_input1;
+-	u32 bios_input2;
++	u32 bios_input_1[2];
+ 	u32 monitor_count;
+ 	u32 rsvd2[2];
+ 	u32 bat_design;
+diff --git a/drivers/platform/x86/amd/pmf/spc.c b/drivers/platform/x86/amd/pmf/spc.c
+index 1d90f9382024b..869b4134513f3 100644
+--- a/drivers/platform/x86/amd/pmf/spc.c
++++ b/drivers/platform/x86/amd/pmf/spc.c
+@@ -70,8 +70,20 @@ static const char *ta_slider_as_str(unsigned int state)
+ 	}
+ }
+ 
++static u32 amd_pmf_get_ta_custom_bios_inputs(struct ta_pmf_enact_table *in, int index)
++{
++	switch (index) {
++	case 0 ... 1:
++		return in->ev_info.bios_input_1[index];
++	default:
++		return 0;
++	}
++}
++
+ void amd_pmf_dump_ta_inputs(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in)
+ {
++	int i;
++
+ 	dev_dbg(dev->dev, "==== TA inputs START ====\n");
+ 	dev_dbg(dev->dev, "Slider State: %s\n", ta_slider_as_str(in->ev_info.power_slider));
+ 	dev_dbg(dev->dev, "Power Source: %s\n", amd_pmf_source_as_str(in->ev_info.power_source));
+@@ -90,29 +102,43 @@ void amd_pmf_dump_ta_inputs(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *
+ 	dev_dbg(dev->dev, "Platform type: %s\n", platform_type_as_str(in->ev_info.platform_type));
+ 	dev_dbg(dev->dev, "Laptop placement: %s\n",
+ 		laptop_placement_as_str(in->ev_info.device_state));
+-	dev_dbg(dev->dev, "Custom BIOS input1: %u\n", in->ev_info.bios_input1);
+-	dev_dbg(dev->dev, "Custom BIOS input2: %u\n", in->ev_info.bios_input2);
++	for (i = 0; i < ARRAY_SIZE(custom_bios_inputs); i++)
++		dev_dbg(dev->dev, "Custom BIOS input%d: %u\n", i + 1,
++			amd_pmf_get_ta_custom_bios_inputs(in, i));
+ 	dev_dbg(dev->dev, "==== TA inputs END ====\n");
+ }
+ #else
+ void amd_pmf_dump_ta_inputs(struct amd_pmf_dev *dev, struct ta_pmf_enact_table *in) {}
+ #endif
+ 
++/*
++ * This helper function sets the appropriate BIOS input value in the TA enact
++ * table based on the provided index. We need this approach because the custom
++ * BIOS input array is not continuous, due to the existing TA structure layout.
++ */
++static void amd_pmf_set_ta_custom_bios_input(struct ta_pmf_enact_table *in, int index, u32 value)
++{
++	switch (index) {
++	case 0 ... 1:
++		in->ev_info.bios_input_1[index] = value;
++		break;
++	default:
++		return;
++	}
++}
++
+ static void amd_pmf_get_custom_bios_inputs(struct amd_pmf_dev *pdev,
+ 					   struct ta_pmf_enact_table *in)
+ {
++	unsigned int i;
++
+ 	if (!pdev->req.pending_req)
+ 		return;
+ 
+-	switch (pdev->req.pending_req) {
+-	case BIT(NOTIFY_CUSTOM_BIOS_INPUT1):
+-		in->ev_info.bios_input1 = pdev->req.custom_policy[APMF_SMARTPC_CUSTOM_BIOS_INPUT1];
+-		break;
+-	case BIT(NOTIFY_CUSTOM_BIOS_INPUT2):
+-		in->ev_info.bios_input2 = pdev->req.custom_policy[APMF_SMARTPC_CUSTOM_BIOS_INPUT2];
+-		break;
+-	default:
+-		dev_dbg(pdev->dev, "Invalid preq for BIOS input: 0x%x\n", pdev->req.pending_req);
++	for (i = 0; i < ARRAY_SIZE(custom_bios_inputs); i++) {
++		if (!(pdev->req.pending_req & custom_bios_inputs[i].bit_mask))
++			continue;
++		amd_pmf_set_ta_custom_bios_input(in, i, pdev->req.custom_policy[i]);
+ 	}
+ 
+ 	/* Clear pending requests after handling */
+-- 
+2.51.0
+
diff --git a/queue-6.17/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch b/queue-6.17/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
new file mode 100644
index 0000000000..85d6467fa9
--- /dev/null
+++ b/queue-6.17/platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
@@ -0,0 +1,54 @@
+From 14a0b5e234a7cf7e59fefb8a296d65beadcfc13d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 14:10:34 -0700
+Subject: platform/x86/intel-uncore-freq: Fix warning in partitioned system
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 6d47b4f08436cb682fb2644e6265a3897fd42a77 ]
+
+A partitioned system configured with only one package and one compute
+die, warning will be generated for duplicate sysfs entry. This typically
+occurs during the platform bring-up phase.
+
+Partitioned systems expose dies, equivalent to TPMI compute domains,
+through the CPUID. Each partitioned system must contains at least one
+compute die per partition, resulting in a minimum of two dies per
+package. Hence the function topology_max_dies_per_package() returns at
+least two, and the condition "topology_max_dies_per_package() > 1"
+prevents the creation of a root domain.
+
+In this case topology_max_dies_per_package() will return 1 and root
+domain will be created for partition 0 and a duplicate sysfs warning
+for partition 1 as both partitions have same package ID.
+
+To address this also check for non zero partition in addition to
+topology_max_dies_per_package() > 1.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20250819211034.3776284-1-srinivas.pandruvada@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+index bfcf92aa4d69d..3e531fd1c6297 100644
+--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+@@ -638,7 +638,7 @@ static int uncore_probe(struct auxiliary_device *auxdev, const struct auxiliary_
+ 
+ 	auxiliary_set_drvdata(auxdev, tpmi_uncore);
+ 
+-	if (topology_max_dies_per_package() > 1)
++	if (topology_max_dies_per_package() > 1 || plat_info->partition)
+ 		return 0;
+ 
+ 	tpmi_uncore->root_cluster.root_domain = true;
+-- 
+2.51.0
+
diff --git a/queue-6.17/platform-x86-intel-uncore-freq-present-unique-domain.patch b/queue-6.17/platform-x86-intel-uncore-freq-present-unique-domain.patch
new file mode 100644
index 0000000000..f3d1b86eaf
--- /dev/null
+++ b/queue-6.17/platform-x86-intel-uncore-freq-present-unique-domain.patch
@@ -0,0 +1,145 @@
+From 7f956167477e4cb5062782e4d59b731d1807969e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 12:11:54 -0700
+Subject: platform/x86/intel-uncore-freq: Present unique domain ID per package
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit a191224186ec16a4cb1775b2a647ea91f5c139e1 ]
+
+In partitioned systems, the domain ID is unique in the partition and a
+package can have multiple partitions.
+
+Some user-space tools, such as turbostat, assume the domain ID is unique
+per package. These tools map CPU power domains, which are unique to a
+package. However, this approach does not work in partitioned systems.
+
+There is no architectural definition of "partition" to present to user
+space.
+
+To support these tools, set the domain_id to be unique per package. For
+compute die IDs, uniqueness can be achieved using the platform info
+cdie_mask, mirroring the behavior observed in non-partitioned systems.
+
+For IO dies, which lack a direct CPU relationship, any unique logical
+ID can be assigned. Here domain IDs for IO dies are configured after all
+compute domain IDs. During the probe, keep the index of the next IO
+domain ID after the last IO domain ID of the current partition. Since
+CPU packages are symmetric, partition information is same for all
+packages.
+
+The Intel Speed Select driver has already implemented a similar change
+to make the domain ID unique, with compute dies listed first, followed
+by I/O dies.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://lore.kernel.org/r/20250903191154.1081159-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../uncore-frequency/uncore-frequency-tpmi.c  | 74 ++++++++++++++++++-
+ 1 file changed, 73 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+index 3e531fd1c6297..1237d95708865 100644
+--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+@@ -374,6 +374,77 @@ static void uncore_set_agent_type(struct tpmi_uncore_cluster_info *cluster_info)
+ 	cluster_info->uncore_data.agent_type_mask = FIELD_GET(UNCORE_AGENT_TYPES, status);
+ }
+ 
++#define MAX_PARTITIONS	2
++
++/* IO domain ID start index for a partition */
++static u8 io_die_start[MAX_PARTITIONS];
++
++/* Next IO domain ID index after the current partition IO die IDs */
++static u8 io_die_index_next;
++
++/* Lock to protect io_die_start, io_die_index_next */
++static DEFINE_MUTEX(domain_lock);
++
++static void set_domain_id(int id,  int num_resources,
++			  struct oobmsm_plat_info *plat_info,
++			  struct tpmi_uncore_cluster_info *cluster_info)
++{
++	u8 part_io_index, cdie_range, pkg_io_index, max_dies;
++
++	if (plat_info->partition >= MAX_PARTITIONS) {
++		cluster_info->uncore_data.domain_id = id;
++		return;
++	}
++
++	if (cluster_info->uncore_data.agent_type_mask & AGENT_TYPE_CORE) {
++		cluster_info->uncore_data.domain_id = cluster_info->cdie_id;
++		return;
++	}
++
++	/* Unlikely but cdie_mask may have holes, so take range */
++	cdie_range = fls(plat_info->cdie_mask) - ffs(plat_info->cdie_mask) + 1;
++	max_dies = topology_max_dies_per_package();
++
++	/*
++	 * If the CPU doesn't enumerate dies, then use current cdie range
++	 * as the max.
++	 */
++	if (cdie_range > max_dies)
++		max_dies = cdie_range;
++
++	guard(mutex)(&domain_lock);
++
++	if (!io_die_index_next)
++		io_die_index_next = max_dies;
++
++	if (!io_die_start[plat_info->partition]) {
++		io_die_start[plat_info->partition] = io_die_index_next;
++		/*
++		 * number of IO dies = num_resources - cdie_range. Hence
++		 * next partition io_die_index_next is set after IO dies
++		 * in the current partition.
++		 */
++		io_die_index_next += (num_resources - cdie_range);
++	}
++
++	/*
++	 * Index from IO die start within the partition:
++	 * This is the first valid domain after the cdies.
++	 * For example the current resource index 5 and cdies end at
++	 * index 3 (cdie_cnt = 4). Then the IO only index 5 - 4 = 1.
++	 */
++	part_io_index = id - cdie_range;
++
++	/*
++	 * Add to the IO die start index for this partition in this package
++	 * to make unique in the package.
++	 */
++	pkg_io_index = io_die_start[plat_info->partition] + part_io_index;
++
++	/* Assign this to domain ID */
++	cluster_info->uncore_data.domain_id = pkg_io_index;
++}
++
+ /* Callback for sysfs read for TPMI uncore values. Called under mutex locks. */
+ static int uncore_read(struct uncore_data *data, unsigned int *value, enum uncore_index index)
+ {
+@@ -610,11 +681,12 @@ static int uncore_probe(struct auxiliary_device *auxdev, const struct auxiliary_
+ 			cluster_info->uncore_data.package_id = pkg;
+ 			/* There are no dies like Cascade Lake */
+ 			cluster_info->uncore_data.die_id = 0;
+-			cluster_info->uncore_data.domain_id = i;
+ 			cluster_info->uncore_data.cluster_id = j;
+ 
+ 			set_cdie_id(i, cluster_info, plat_info);
+ 
++			set_domain_id(i, num_resources, plat_info, cluster_info);
++
+ 			cluster_info->uncore_root = tpmi_uncore;
+ 
+ 			if (TPMI_MINOR_VERSION(pd_info->ufs_header_ver) >= UNCORE_ELC_SUPPORTED_VERSION)
+-- 
+2.51.0
+
diff --git a/queue-6.17/platform-x86-think-lmi-add-extra-tc-bios-error-messa.patch b/queue-6.17/platform-x86-think-lmi-add-extra-tc-bios-error-messa.patch
new file mode 100644
index 0000000000..c2669ad6ec
--- /dev/null
+++ b/queue-6.17/platform-x86-think-lmi-add-extra-tc-bios-error-messa.patch
@@ -0,0 +1,53 @@
+From 68f62e9043e4fc22a200a7819c821f8d55b11a12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:38:14 -0400
+Subject: platform/x86: think-lmi: Add extra TC BIOS error messages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit a0d6959c345d89d811288a718e3f6b145dcadc8c ]
+
+Add extra error messages that are used by ThinkCenter platforms.
+
+Signed-off-by: Kean Ren <kean0048@gmail.com>
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20250903173824.1472244-4-mpearson-lenovo@squebb.ca
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/lenovo/think-lmi.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/platform/x86/lenovo/think-lmi.c b/drivers/platform/x86/lenovo/think-lmi.c
+index 0992b41b6221d..e6a2c8e94cfdc 100644
+--- a/drivers/platform/x86/lenovo/think-lmi.c
++++ b/drivers/platform/x86/lenovo/think-lmi.c
+@@ -179,10 +179,21 @@ MODULE_PARM_DESC(debug_support, "Enable debug command support");
+ 
+ static const struct tlmi_err_codes tlmi_errs[] = {
+ 	{"Success", 0},
++	{"Set Certificate operation was successful.", 0},
+ 	{"Not Supported", -EOPNOTSUPP},
+ 	{"Invalid Parameter", -EINVAL},
+ 	{"Access Denied", -EACCES},
+ 	{"System Busy", -EBUSY},
++	{"Set Certificate operation failed with status:Invalid Parameter.", -EINVAL},
++	{"Set Certificate operation failed with status:Invalid certificate type.", -EINVAL},
++	{"Set Certificate operation failed with status:Invalid password format.", -EINVAL},
++	{"Set Certificate operation failed with status:Password retry count exceeded.", -EACCES},
++	{"Set Certificate operation failed with status:Password Invalid.", -EACCES},
++	{"Set Certificate operation failed with status:Operation aborted.", -EBUSY},
++	{"Set Certificate operation failed with status:No free slots to write.", -ENOSPC},
++	{"Set Certificate operation failed with status:Certificate not found.", -EEXIST},
++	{"Set Certificate operation failed with status:Internal error.", -EFAULT},
++	{"Set Certificate operation failed with status:Certificate too large.", -EFBIG},
+ };
+ 
+ static const char * const encoding_options[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/platform-x86-x86-android-tablets-stop-using-eprobe_d.patch b/queue-6.17/platform-x86-x86-android-tablets-stop-using-eprobe_d.patch
new file mode 100644
index 0000000000..224181f2f8
--- /dev/null
+++ b/queue-6.17/platform-x86-x86-android-tablets-stop-using-eprobe_d.patch
@@ -0,0 +1,67 @@
+From 19edd2690afc126791d967d6d7942128c9b330b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Sep 2025 22:07:13 +0200
+Subject: platform/x86: x86-android-tablets: Stop using EPROBE_DEFER
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hansg@kernel.org>
+
+[ Upstream commit 01fd7cf3534aa107797d130f461ba7bcad30414d ]
+
+Since the x86-android-tablets code uses platform_create_bundle() it cannot
+use EPROBE_DEFER and the driver-core will translate EPROBE_DEFER to ENXIO.
+
+Stop using EPROBE_DEFER instead log an error and return ENODEV, or for
+non-fatal cases log a warning and return 0.
+
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hansg@kernel.org>
+Link: https://patch.msgid.link/20250920200713.20193-21-hansg@kernel.org
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/x86-android-tablets/core.c  | 6 ++++--
+ drivers/platform/x86/x86-android-tablets/other.c | 6 ++++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/x86-android-tablets/core.c b/drivers/platform/x86/x86-android-tablets/core.c
+index 2a9c471785050..8c8f10983f289 100644
+--- a/drivers/platform/x86/x86-android-tablets/core.c
++++ b/drivers/platform/x86/x86-android-tablets/core.c
+@@ -277,8 +277,10 @@ get_serdev_controller_by_pci_parent(const struct x86_serdev_info *info)
+ 	struct pci_dev *pdev;
+ 
+ 	pdev = pci_get_domain_bus_and_slot(0, 0, info->ctrl.pci.devfn);
+-	if (!pdev)
+-		return ERR_PTR(-EPROBE_DEFER);
++	if (!pdev) {
++		pr_err("error could not get PCI serdev at devfn 0x%02x\n", info->ctrl.pci.devfn);
++		return ERR_PTR(-ENODEV);
++	}
+ 
+ 	/* This puts our reference on pdev and returns a ref on the ctrl */
+ 	return get_serdev_controller_from_parent(&pdev->dev, 0, info->ctrl_devname);
+diff --git a/drivers/platform/x86/x86-android-tablets/other.c b/drivers/platform/x86/x86-android-tablets/other.c
+index f7bd9f863c85e..aa4f8810974d5 100644
+--- a/drivers/platform/x86/x86-android-tablets/other.c
++++ b/drivers/platform/x86/x86-android-tablets/other.c
+@@ -809,8 +809,10 @@ static int __init vexia_edu_atla10_9v_init(struct device *dev)
+ 
+ 	/* Reprobe the SDIO controller to enumerate the now enabled Wifi module */
+ 	pdev = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x11, 0));
+-	if (!pdev)
+-		return -EPROBE_DEFER;
++	if (!pdev) {
++		pr_warn("Could not get PCI SDIO at devfn 0x%02x\n", PCI_DEVFN(0x11, 0));
++		return 0;
++	}
+ 
+ 	ret = device_reprobe(&pdev->dev);
+ 	if (ret)
+-- 
+2.51.0
+
diff --git a/queue-6.17/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-6.17/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..b6b7cdf926
--- /dev/null
+++ b/queue-6.17/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From d9f887fd1e3ad166ad4e893d81b70128e4ade8e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 48ad0116f3590..ef78ff77cf8f2 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/ptp-limit-time-setting-of-ptp-clocks.patch b/queue-6.17/ptp-limit-time-setting-of-ptp-clocks.patch
new file mode 100644
index 0000000000..3208e9bb32
--- /dev/null
+++ b/queue-6.17/ptp-limit-time-setting-of-ptp-clocks.patch
@@ -0,0 +1,81 @@
+From 26acde09d6c01f6e3f9cd3be10d3f9f021c624e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:32:53 +0200
+Subject: ptp: Limit time setting of PTP clocks
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
+
+Networking drivers implementing PTP clocks and kernel socket code
+handling hardware timestamps use the 64-bit signed ktime_t type counting
+nanoseconds. When a PTP clock reaches the maximum value in year 2262,
+the timestamps returned to applications will overflow into year 1667.
+The same thing happens when injecting a large offset with
+clock_adjtime(ADJ_SETOFFSET).
+
+The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
+CLOCK_REALTIME") limited the maximum accepted value setting the system
+clock to 30 years before the maximum representable value (i.e. year
+2232) to avoid the overflow, assuming the system will not run for more
+than 30 years.
+
+Enforce the same limit for PTP clocks. Don't allow negative values and
+values closer than 30 years to the maximum value. Drivers may implement
+an even lower limit if the hardware registers cannot represent the whole
+interval between years 1970 and 2262 in the required resolution.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <jstultz@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 1cc06b7cb17ef..3e0726c6f55b3 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -100,6 +100,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ 		return -EBUSY;
+ 	}
+ 
++	if (!timespec64_valid_settod(tp))
++		return -EINVAL;
++
+ 	return  ptp->info->settime64(ptp->info, tp);
+ }
+ 
+@@ -130,7 +133,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 	ops = ptp->info;
+ 
+ 	if (tx->modes & ADJ_SETOFFSET) {
+-		struct timespec64 ts;
++		struct timespec64 ts, ts2;
+ 		ktime_t kt;
+ 		s64 delta;
+ 
+@@ -143,6 +146,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 		if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
+ 			return -EINVAL;
+ 
++		/* Make sure the offset is valid */
++		err = ptp_clock_gettime(pc, &ts2);
++		if (err)
++			return err;
++		ts2 = timespec64_add(ts2, ts);
++		if (!timespec64_valid_settod(&ts2))
++			return -EINVAL;
++
+ 		kt = timespec64_to_ktime(ts);
+ 		delta = ktime_to_ns(kt);
+ 		err = ops->adjtime(ops, delta);
+-- 
+2.51.0
+
diff --git a/queue-6.17/ptp_ocp-make-ptp_ocp-driver-compatible-with-ptp_extt.patch b/queue-6.17/ptp_ocp-make-ptp_ocp-driver-compatible-with-ptp_extt.patch
new file mode 100644
index 0000000000..17ee666667
--- /dev/null
+++ b/queue-6.17/ptp_ocp-make-ptp_ocp-driver-compatible-with-ptp_extt.patch
@@ -0,0 +1,53 @@
+From 09f51f27cd5ef93cdcbcbe5fc8f42e9db360f237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:11:46 +0000
+Subject: ptp_ocp: make ptp_ocp driver compatible with PTP_EXTTS_REQUEST2
+
+From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+
+[ Upstream commit d3ca2ef0c915d219e0d958e0bdcc4be6c02c210b ]
+
+Originally ptp_ocp driver was not strictly checking flags for external
+timestamper and was always activating rising edge timestamping as it's
+the only supported mode. Recent changes to ptp made it incompatible with
+PTP_EXTTS_REQUEST2 ioctl. Adjust ptp_clock_info to provide supported
+mode and be compatible with new infra.
+
+While at here remove explicit check of periodic output flags from the
+driver and provide supported flags for ptp core to check.
+
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250918131146.651468-1-vadim.fedorenko@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_ocp.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ptp/ptp_ocp.c b/drivers/ptp/ptp_ocp.c
+index f354f2f51a48c..a5c3632529862 100644
+--- a/drivers/ptp/ptp_ocp.c
++++ b/drivers/ptp/ptp_ocp.c
+@@ -1485,6 +1485,8 @@ static const struct ptp_clock_info ptp_ocp_clock_info = {
+ 	.pps		= true,
+ 	.n_ext_ts	= 6,
+ 	.n_per_out	= 5,
++	.supported_extts_flags = PTP_STRICT_FLAGS | PTP_RISING_EDGE,
++	.supported_perout_flags = PTP_PEROUT_DUTY_CYCLE | PTP_PEROUT_PHASE,
+ };
+ 
+ static void
+@@ -2095,10 +2097,6 @@ ptp_ocp_signal_from_perout(struct ptp_ocp *bp, int gen,
+ {
+ 	struct ptp_ocp_signal s = { };
+ 
+-	if (req->flags & ~(PTP_PEROUT_DUTY_CYCLE |
+-			   PTP_PEROUT_PHASE))
+-		return -EOPNOTSUPP;
+-
+ 	s.polarity = bp->signal[gen].polarity;
+ 	s.period = ktime_set(req->period.sec, req->period.nsec);
+ 	if (!s.period)
+-- 
+2.51.0
+
diff --git a/queue-6.17/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-6.17/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..8e80338e8b
--- /dev/null
+++ b/queue-6.17/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From d9c775ff55f77e179bf08e3aa586f17e9ce65066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 4b0ac73565ea9..bf79e2e9b7ecb 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3409,7 +3409,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3514,7 +3514,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3715,7 +3715,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
+-- 
+2.51.0
+
diff --git a/queue-6.17/rdma-irdma-update-kconfig.patch b/queue-6.17/rdma-irdma-update-kconfig.patch
new file mode 100644
index 0000000000..39d400362a
--- /dev/null
+++ b/queue-6.17/rdma-irdma-update-kconfig.patch
@@ -0,0 +1,43 @@
+From 7c7a699ec597c7c392edb47e61358c621ac36045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:25:45 -0500
+Subject: RDMA/irdma: Update Kconfig
+
+From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+
+[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
+
+Update Kconfig to add dependency on idpf module and
+add IPU E2000 to the list of supported devices.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com
+Tested-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/Kconfig b/drivers/infiniband/hw/irdma/Kconfig
+index 5f49a58590ed7..0bd7e3fca1fbb 100644
+--- a/drivers/infiniband/hw/irdma/Kconfig
++++ b/drivers/infiniband/hw/irdma/Kconfig
+@@ -4,10 +4,11 @@ config INFINIBAND_IRDMA
+ 	depends on INET
+ 	depends on IPV6 || !IPV6
+ 	depends on PCI
+-	depends on ICE && I40E
++	depends on IDPF && ICE && I40E
+ 	select GENERIC_ALLOCATOR
+ 	select AUXILIARY_BUS
+ 	select CRC32
+ 	help
+-	  This is an Intel(R) Ethernet Protocol Driver for RDMA driver
+-	  that support E810 (iWARP/RoCE) and X722 (iWARP) network devices.
++	  This is an Intel(R) Ethernet Protocol Driver for RDMA that
++	  supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP)
++	  network devices.
+-- 
+2.51.0
+
diff --git a/queue-6.17/rdma-mana_ib-drain-send-wrs-of-gsi-qp.patch b/queue-6.17/rdma-mana_ib-drain-send-wrs-of-gsi-qp.patch
new file mode 100644
index 0000000000..fa37441cd1
--- /dev/null
+++ b/queue-6.17/rdma-mana_ib-drain-send-wrs-of-gsi-qp.patch
@@ -0,0 +1,104 @@
+From 530c6ff95ebdc5741ee527268c8fc5ff5e18e510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jul 2025 02:00:18 -0700
+Subject: RDMA/mana_ib: Drain send wrs of GSI QP
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit 44d69d3cf2e8047c279cbb9708f05e2c43e33234 ]
+
+Drain send WRs of the GSI QP on device removal.
+
+In rare servicing scenarios, the hardware may delete the
+state of the GSI QP, preventing it from generating CQEs
+for pending send WRs. Since WRs submitted to the GSI QP
+hold CM resources, the device cannot be removed until
+those WRs are completed. This patch marks all pending
+send WRs as failed, allowing the GSI QP to release the CM
+resources and enabling safe device removal.
+
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://patch.msgid.link/1753779618-23629-1-git-send-email-kotaranov@linux.microsoft.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/cq.c      | 26 ++++++++++++++++++++++++++
+ drivers/infiniband/hw/mana/device.c  |  3 +++
+ drivers/infiniband/hw/mana/mana_ib.h |  3 +++
+ 3 files changed, 32 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
+index 28e154bbb50f8..1becc87791235 100644
+--- a/drivers/infiniband/hw/mana/cq.c
++++ b/drivers/infiniband/hw/mana/cq.c
+@@ -291,6 +291,32 @@ static int mana_process_completions(struct mana_ib_cq *cq, int nwc, struct ib_wc
+ 	return wc_index;
+ }
+ 
++void mana_drain_gsi_sqs(struct mana_ib_dev *mdev)
++{
++	struct mana_ib_qp *qp = mana_get_qp_ref(mdev, MANA_GSI_QPN, false);
++	struct ud_sq_shadow_wqe *shadow_wqe;
++	struct mana_ib_cq *cq;
++	unsigned long flags;
++
++	if (!qp)
++		return;
++
++	cq = container_of(qp->ibqp.send_cq, struct mana_ib_cq, ibcq);
++
++	spin_lock_irqsave(&cq->cq_lock, flags);
++	while ((shadow_wqe = shadow_queue_get_next_to_complete(&qp->shadow_sq))
++			!= NULL) {
++		shadow_wqe->header.error_code = IB_WC_GENERAL_ERR;
++		shadow_queue_advance_next_to_complete(&qp->shadow_sq);
++	}
++	spin_unlock_irqrestore(&cq->cq_lock, flags);
++
++	if (cq->ibcq.comp_handler)
++		cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
++
++	mana_put_qp_ref(qp);
++}
++
+ int mana_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+ {
+ 	struct mana_ib_cq *cq = container_of(ibcq, struct mana_ib_cq, ibcq);
+diff --git a/drivers/infiniband/hw/mana/device.c b/drivers/infiniband/hw/mana/device.c
+index fa60872f169f4..bdeddb642b877 100644
+--- a/drivers/infiniband/hw/mana/device.c
++++ b/drivers/infiniband/hw/mana/device.c
+@@ -230,6 +230,9 @@ static void mana_ib_remove(struct auxiliary_device *adev)
+ {
+ 	struct mana_ib_dev *dev = dev_get_drvdata(&adev->dev);
+ 
++	if (mana_ib_is_rnic(dev))
++		mana_drain_gsi_sqs(dev);
++
+ 	ib_unregister_device(&dev->ib_dev);
+ 	dma_pool_destroy(dev->av_pool);
+ 	if (mana_ib_is_rnic(dev)) {
+diff --git a/drivers/infiniband/hw/mana/mana_ib.h b/drivers/infiniband/hw/mana/mana_ib.h
+index 5d31034ac7fb3..af09a3e6ccb78 100644
+--- a/drivers/infiniband/hw/mana/mana_ib.h
++++ b/drivers/infiniband/hw/mana/mana_ib.h
+@@ -43,6 +43,8 @@
+  */
+ #define MANA_AV_BUFFER_SIZE	64
+ 
++#define MANA_GSI_QPN		(1)
++
+ struct mana_ib_adapter_caps {
+ 	u32 max_sq_id;
+ 	u32 max_rq_id;
+@@ -718,6 +720,7 @@ int mana_ib_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *wr,
+ int mana_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
+ 		      const struct ib_send_wr **bad_wr);
+ 
++void mana_drain_gsi_sqs(struct mana_ib_dev *mdev);
+ int mana_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
+ int mana_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-6.17/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..fdde5e5b31
--- /dev/null
+++ b/queue-6.17/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 25d6a3148495e56ee09a224ddd3ddb5d4fc2eabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index dc360252c5157..5b1c072e2e7ff 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-6.17/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-6.17/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..7e40609a42
--- /dev/null
+++ b/queue-6.17/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From a64056c34119baf4e1abc149c3034b51925355de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 769c6d6d6a731..58d5b85e58cda 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -164,6 +164,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch b/queue-6.17/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
new file mode 100644
index 0000000000..664260126f
--- /dev/null
+++ b/queue-6.17/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
@@ -0,0 +1,54 @@
+From 6d2a90a35aa01db9e1c00b93bec266505dcdc9d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 10:39:37 -0500
+Subject: remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 461edcf73eec57bc0006fbb5209f5012c514c58b ]
+
+Use device life-cycle managed runtime enable function to simplify probe
+and exit paths.
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20250814153940.670564-1-afd@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/wkup_m3_rproc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/remoteproc/wkup_m3_rproc.c b/drivers/remoteproc/wkup_m3_rproc.c
+index d8be21e717212..35c2145b12db7 100644
+--- a/drivers/remoteproc/wkup_m3_rproc.c
++++ b/drivers/remoteproc/wkup_m3_rproc.c
+@@ -148,7 +148,9 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
++	ret = devm_pm_runtime_enable(dev);
++	if (ret < 0)
++		return dev_err_probe(dev, ret, "Failed to enable runtime PM\n");
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+@@ -219,7 +221,6 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 	rproc_free(rproc);
+ err:
+ 	pm_runtime_put_noidle(dev);
+-	pm_runtime_disable(dev);
+ 	return ret;
+ }
+ 
+@@ -230,7 +231,6 @@ static void wkup_m3_rproc_remove(struct platform_device *pdev)
+ 	rproc_del(rproc);
+ 	rproc_free(rproc);
+ 	pm_runtime_put_sync(&pdev->dev);
+-	pm_runtime_disable(&pdev->dev);
+ }
+ 
+ #ifdef CONFIG_PM
+-- 
+2.51.0
+
diff --git a/queue-6.17/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch b/queue-6.17/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
new file mode 100644
index 0000000000..10b1f96f2d
--- /dev/null
+++ b/queue-6.17/rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
@@ -0,0 +1,56 @@
+From cf596f44d5fb77bf7c5ba2a94e083bbbf7a686d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jun 2025 15:57:22 -0500
+Subject: rpmsg: char: Export alias for RPMSG ID rpmsg-raw from table
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 6e29c30d8ddea6109ea7e0b9f17e7841df0794ea ]
+
+Module aliases are used by userspace to identify the correct module to
+load for a detected hardware. The currently supported RPMSG device IDs for
+this module include "rpmsg-raw", but the module alias is "rpmsg_chrdev".
+
+Use the helper macro MODULE_DEVICE_TABLE(rpmsg) to export the correct
+supported IDs. And while here, to keep backwards compatibility we also add
+the other ID "rpmsg_chrdev" so that it is also still exported as an alias.
+
+This has the side benefit of adding support for some legacy firmware
+which still uses the original "rpmsg_chrdev" ID. This was the ID used for
+this driver before it was upstreamed (as reflected by the module alias).
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Acked-by: Hari Nagalla <hnagalla@ti.com>
+Tested-by: Hari Nagalla <hnagalla@ti.com>
+Link: https://lore.kernel.org/r/20250619205722.133827-1-afd@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rpmsg/rpmsg_char.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c
+index eec7642d26863..96fcdd2d7093c 100644
+--- a/drivers/rpmsg/rpmsg_char.c
++++ b/drivers/rpmsg/rpmsg_char.c
+@@ -522,8 +522,10 @@ static void rpmsg_chrdev_remove(struct rpmsg_device *rpdev)
+ 
+ static struct rpmsg_device_id rpmsg_chrdev_id_table[] = {
+ 	{ .name	= "rpmsg-raw" },
++	{ .name	= "rpmsg_chrdev" },
+ 	{ },
+ };
++MODULE_DEVICE_TABLE(rpmsg, rpmsg_chrdev_id_table);
+ 
+ static struct rpmsg_driver rpmsg_chrdev_driver = {
+ 	.probe = rpmsg_chrdev_probe,
+@@ -565,6 +567,5 @@ static void rpmsg_chrdev_exit(void)
+ }
+ module_exit(rpmsg_chrdev_exit);
+ 
+-MODULE_ALIAS("rpmsg:rpmsg_chrdev");
+ MODULE_DESCRIPTION("RPMSG device interface");
+ MODULE_LICENSE("GPL v2");
+-- 
+2.51.0
+
diff --git a/queue-6.17/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch b/queue-6.17/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
new file mode 100644
index 0000000000..72870e6608
--- /dev/null
+++ b/queue-6.17/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
@@ -0,0 +1,80 @@
+From faa49891b85153ebc2fefd7ecafff079b82fba16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:39 +0200
+Subject: s390/pci: Use pci_uevent_ers() in PCI recovery
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
+
+Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by
+EEH and AER PCIe recovery routines.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_event.c | 3 +++
+ drivers/pci/pci-driver.c  | 2 +-
+ include/linux/pci.h       | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
+index da0de34d2e5ca..27db1e72c623f 100644
+--- a/arch/s390/pci/pci_event.c
++++ b/arch/s390/pci/pci_event.c
+@@ -88,6 +88,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev,
+ 	pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT;
+ 
+ 	ers_res = driver->err_handler->error_detected(pdev,  pdev->error_state);
++	pci_uevent_ers(pdev, ers_res);
+ 	if (ers_result_indicates_abort(ers_res))
+ 		pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev));
+ 	else if (ers_res == PCI_ERS_RESULT_NEED_RESET)
+@@ -244,6 +245,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 		ers_res = PCI_ERS_RESULT_RECOVERED;
+ 
+ 	if (ers_res != PCI_ERS_RESULT_RECOVERED) {
++		pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT);
+ 		pr_err("%s: Automatic recovery failed; operator intervention is required\n",
+ 		       pci_name(pdev));
+ 		status_str = "failed (driver can't recover)";
+@@ -253,6 +255,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 	pr_info("%s: The device is ready to resume operations\n", pci_name(pdev));
+ 	if (driver->err_handler->resume)
+ 		driver->err_handler->resume(pdev);
++	pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
+ out_unlock:
+ 	device_unlock(&pdev->dev);
+ 	zpci_report_status(zdev, "recovery", status_str);
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 6405acdb5d0f3..302d61783f6c0 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1582,7 +1582,7 @@ static int pci_uevent(const struct device *dev, struct kobj_uevent_env *env)
+ 	return 0;
+ }
+ 
+-#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ /**
+  * pci_uevent_ers - emit a uevent during recovery path of PCI device
+  * @pdev: PCI device undergoing error recovery
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 59876de13860d..7735acf6f3490 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2764,7 +2764,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ 	return false;
+ }
+ 
+-#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch b/queue-6.17/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
new file mode 100644
index 0000000000..065c288923
--- /dev/null
+++ b/queue-6.17/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
@@ -0,0 +1,70 @@
+From 09c1b10279d0f0ef1aafeb7eb6405effa9fe0582 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:37:57 -0700
+Subject: scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
+
+The fc_ct_ms_fill() helper currently formats the OS name and version
+into entry->value using "%s v%s". Since init_utsname()->sysname and
+->release are unbounded strings, snprintf() may attempt to write more
+than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
+-Wformat-truncation warning with W=1.
+
+In file included from drivers/scsi/libfc/fc_elsct.c:18:
+drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
+drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
+be truncated writing up to 64 bytes into a region of size between 62
+and 126 [-Werror=format-truncation=]
+  359 |                         "%s v%s",
+      |                              ^~
+  360 |                         init_utsname()->sysname,
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
+3 and 131 bytes into a destination of size 128
+  357 |                 snprintf((char *)&entry->value,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  358 |                         FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  359 |                         "%s v%s",
+      |                         ~~~~~~~~~
+  360 |                         init_utsname()->sysname,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by using "%.62s v%.62s", which ensures sysname and release are
+truncated to fit within the 128-byte field defined by
+FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
+
+[mkp: clarified commit description]
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_encode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
+index 02e31db31d68e..e046091a549ae 100644
+--- a/drivers/scsi/libfc/fc_encode.h
++++ b/drivers/scsi/libfc/fc_encode.h
+@@ -356,7 +356,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
+ 		put_unaligned_be16(len, &entry->len);
+ 		snprintf((char *)&entry->value,
+ 			FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+-			"%s v%s",
++			"%.62s v%.62s",
+ 			init_utsname()->sysname,
+ 			init_utsname()->release);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-6.17/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..c1b86a5a52
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From 131d4befa4aeec9da0c2213f140d9d47809a8889 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 508ceeecf2d95..6d9d8c196936a 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -5935,7 +5935,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -6109,8 +6109,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irqrestore(&pnode->lock, flags);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -6202,7 +6208,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch b/queue-6.17/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
new file mode 100644
index 0000000000..42a43973da
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
@@ -0,0 +1,49 @@
+From 789cddb69c7361787ee63041152da7e9fa358668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:00 -0700
+Subject: scsi: lpfc: Clean up allocated queues when queue setup mbox commands
+ fail
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 803dfd83df33b7565f23aef597d5dd036adfa792 ]
+
+lpfc_sli4_queue_setup() does not allocate memory and is used for
+submitting CREATE_QUEUE mailbox commands.  Thus, if such mailbox
+commands fail we should clean up by also freeing the memory allocated
+for the queues with lpfc_sli4_queue_destroy().  Change the intended
+clean up label for the lpfc_sli4_queue_setup() error case to
+out_destroy_queue.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-4-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index a8fbdf7119d88..d82ea9df098b8 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -8820,7 +8820,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ 	if (unlikely(rc)) {
+ 		lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
+ 				"0381 Error %d during queue setup.\n", rc);
+-		goto out_stop_timers;
++		goto out_destroy_queue;
+ 	}
+ 	/* Initialize the driver internal SLI layer lists. */
+ 	lpfc_sli4_setup(phba);
+@@ -9103,7 +9103,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
+ 	lpfc_free_iocb_list(phba);
+ out_destroy_queue:
+ 	lpfc_sli4_queue_destroy(phba);
+-out_stop_timers:
+ 	lpfc_stop_hba_timers(phba);
+ out_free_mbox:
+ 	mempool_free(mboxq, phba->mbox_mem_pool);
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch b/queue-6.17/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
new file mode 100644
index 0000000000..b69e4928b9
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
@@ -0,0 +1,43 @@
+From 7a5e2576be7784ec9ecd6bbf2d2c8601081da9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:02 -0700
+Subject: scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit b5bf6d681fce69cd1a57bfc0f1bdbbb348035117 ]
+
+The kref for Fabric_DID ndlps is not decremented after repeated FDISC
+failures and exhausting maximum allowed retries.  This can leave the
+ndlp lingering unnecessarily.  Add a test and set bit operation for the
+NLP_DROPPED flag. If not previously set, then a kref is decremented. The
+ndlp is freed when the remaining reference for the completing ELS is
+put.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-6-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index fca81e0c7c2e1..4c405bade4f34 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -11259,6 +11259,11 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS,
+ 			      "0126 FDISC cmpl status: x%x/x%x)\n",
+ 			      ulp_status, ulp_word4);
++
++		/* drop initial reference */
++		if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag))
++			lpfc_nlp_put(ndlp);
++
+ 		goto fdisc_failed;
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-6.17/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..05e81b8ff3
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From b62ff389b8f2f82af05e7467c597b8ea3625caa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index f319f3af04009..566dd84e0677a 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch b/queue-6.17/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
new file mode 100644
index 0000000000..de4cf59541
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
@@ -0,0 +1,100 @@
+From 670a35151f4c796f43dfc2332c48a0fc03f96504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:04 -0700
+Subject: scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point
+ topology
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 2bf81856a403c92a4ce375288f33fba82ca2ccc6 ]
+
+There is a timing race condition when a PRLI may be sent on the wire
+before PLOGI_ACC in Point to Point topology.  Fix by deferring REG_RPI
+mbox completion handling to after PLOGI_ACC's CQE completion.  Because
+the discovery state machine only sends PRLI after REG_RPI mbox
+completion, PRLI is now guaranteed to be sent after PLOGI_ACC.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-8-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c       | 10 +++++++---
+ drivers/scsi/lpfc/lpfc_nportdisc.c | 23 ++++++++++++++++++-----
+ 2 files changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 3f703932b2f07..8762fb84f14f1 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5339,12 +5339,12 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		ulp_status, ulp_word4, did);
+ 	/* ELS response tag <ulpIoTag> completes */
+ 	lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS,
+-			 "0110 ELS response tag x%x completes "
++			 "0110 ELS response tag x%x completes fc_flag x%lx"
+ 			 "Data: x%x x%x x%x x%x x%lx x%x x%x x%x %p %p\n",
+-			 iotag, ulp_status, ulp_word4, tmo,
++			 iotag, vport->fc_flag, ulp_status, ulp_word4, tmo,
+ 			 ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state,
+ 			 ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox, ndlp);
+-	if (mbox) {
++	if (mbox && !test_bit(FC_PT2PT, &vport->fc_flag)) {
+ 		if (ulp_status == 0 &&
+ 		    test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) {
+ 			if (!lpfc_unreg_rpi(vport, ndlp) &&
+@@ -5403,6 +5403,10 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 		}
+ out_free_mbox:
+ 		lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
++	} else if (mbox && test_bit(FC_PT2PT, &vport->fc_flag) &&
++		   test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) {
++		lpfc_mbx_cmpl_reg_login(phba, mbox);
++		clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
+ 	}
+ out:
+ 	if (ndlp && shost) {
+diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
+index a596b80d03d4d..3799bdf2f1b88 100644
+--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
+@@ -326,8 +326,14 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
+ 		/* Now that REG_RPI completed successfully,
+ 		 * we can now proceed with sending the PLOGI ACC.
+ 		 */
+-		rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
+-				      save_iocb, ndlp, NULL);
++		if (test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) {
++			rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
++					      save_iocb, ndlp, login_mbox);
++		} else {
++			rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI,
++					      save_iocb, ndlp, NULL);
++		}
++
+ 		if (rc) {
+ 			lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
+ 					"4576 PLOGI ACC fails pt2pt discovery: "
+@@ -335,9 +341,16 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox)
+ 		}
+ 	}
+ 
+-	/* Now process the REG_RPI cmpl */
+-	lpfc_mbx_cmpl_reg_login(phba, login_mbox);
+-	clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
++	/* If this is a fabric topology, complete the reg_rpi and prli now.
++	 * For Pt2Pt, the reg_rpi and PRLI are deferred until after the LS_ACC
++	 * completes.  This ensures, in Pt2Pt, that the PLOGI LS_ACC is sent
++	 * before the PRLI.
++	 */
++	if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) {
++		/* Now process the REG_RPI cmpl */
++		lpfc_mbx_cmpl_reg_login(phba, login_mbox);
++		clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag);
++	}
+ 	kfree(save_iocb);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch b/queue-6.17/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
new file mode 100644
index 0000000000..da12e49275
--- /dev/null
+++ b/queue-6.17/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
@@ -0,0 +1,64 @@
+From 8109e16d9d4a0693ce62100298ba20d4d343f0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:01 -0700
+Subject: scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
+ lpfc_cleanup
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
+
+In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
+F_Port_Ctrl ndlp object.  In cases when an ABTS is issued, the
+outstanding kref is needed for when a second XRI_ABORTED CQE is
+received.  The final kref for the ndlp is designed to be decremented in
+lpfc_sli4_els_xri_aborted instead.  Also, add a new log message to allow
+for future diagnostics when debugging related issues.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c  | 6 +++++-
+ drivers/scsi/lpfc/lpfc_init.c | 7 -------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 4c405bade4f34..3f703932b2f07 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -12013,7 +12013,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 			sglq_entry->state = SGL_FREED;
+ 			spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+ 					       iflag);
+-
++			lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
++					LOG_DISCOVERY | LOG_NODE,
++					"0732 ELS XRI ABORT on Node: ndlp=x%px "
++					"xri=x%x\n",
++					ndlp, xri);
+ 			if (ndlp) {
+ 				lpfc_set_rrq_active(phba, ndlp,
+ 					sglq_entry->sli4_lxritag,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 4081d2a358eee..f7824266db5e8 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -3057,13 +3057,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
+ 		lpfc_vmid_vport_cleanup(vport);
+ 
+ 	list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
+-		if (vport->port_type != LPFC_PHYSICAL_PORT &&
+-		    ndlp->nlp_DID == Fabric_DID) {
+-			/* Just free up ndlp with Fabric_DID for vports */
+-			lpfc_nlp_put(ndlp);
+-			continue;
+-		}
+-
+ 		if (ndlp->nlp_DID == Fabric_Cntl_DID &&
+ 		    ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
+ 			lpfc_nlp_put(ndlp);
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch b/queue-6.17/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
new file mode 100644
index 0000000000..47925287eb
--- /dev/null
+++ b/queue-6.17/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
@@ -0,0 +1,56 @@
+From ba5ccc496e5e70865d5649f69e15df1e60a21b77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:34 +0530
+Subject: scsi: mpi3mr: Fix controller init failure on fault during queue
+ creation
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
+
+Firmware can enter a transient fault while creating operational queues.
+The driver fails the load immediately.
+
+Add a retry loop that checks controller status and history bit after
+queue creation. If either indicates a fault, retry init up to a set
+limit before failing.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index 9e18cc2747104..8fe6e0bf342e2 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -2353,6 +2353,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ {
+ 	int retval = 0;
+ 	u16 num_queues = 0, i = 0, msix_count_op_q = 1;
++	u32 ioc_status;
++	enum mpi3mr_iocstate ioc_state;
+ 
+ 	num_queues = min_t(int, mrioc->facts.max_op_reply_q,
+ 	    mrioc->facts.max_op_req_q);
+@@ -2408,6 +2410,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ 		retval = -1;
+ 		goto out_failed;
+ 	}
++	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
++	ioc_state = mpi3mr_get_iocstate(mrioc);
++	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
++	    ioc_state != MRIOC_STATE_READY) {
++		mpi3mr_print_fault_info(mrioc);
++		retval = -1;
++		goto out_failed;
++	}
+ 	mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
+ 	ioc_info(mrioc,
+ 	    "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-mpi3mr-fix-device-loss-during-enclosure-reboot-.patch b/queue-6.17/scsi-mpi3mr-fix-device-loss-during-enclosure-reboot-.patch
new file mode 100644
index 0000000000..c9c5b82f1a
--- /dev/null
+++ b/queue-6.17/scsi-mpi3mr-fix-device-loss-during-enclosure-reboot-.patch
@@ -0,0 +1,94 @@
+From ff294cb93c9f3a5bfe57cca12b1f352eb5ea0291 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:33 +0530
+Subject: scsi: mpi3mr: Fix device loss during enclosure reboot due to zero
+ link speed
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit d6c8e8b7c98c3cb326515ef4bc5c57e16ac5ae4e ]
+
+During enclosure reboot or expander reset, firmware may report a link
+speed of 0 in "Device Add" events while the link is still coming up.
+The driver drops such devices, leaving them missing even after the link
+recovers.
+
+Fix this by treating link speed 0 as 1.5 Gbps during device addition so
+the device is exposed to the OS. The actual link speed will be updated
+later when link-up events arrive.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-2-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_os.c        |  8 ++++----
+ drivers/scsi/mpi3mr/mpi3mr_transport.c | 11 +++++++++--
+ 2 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index e467b56949e98..1582cdbc66302 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -2049,8 +2049,8 @@ static void mpi3mr_fwevt_bh(struct mpi3mr_ioc *mrioc,
+ 	if (!fwevt->process_evt)
+ 		goto evt_ack;
+ 
+-	dprint_event_bh(mrioc, "processing event(0x%02x) in the bottom half handler\n",
+-	    fwevt->event_id);
++	dprint_event_bh(mrioc, "processing event(0x%02x) -(0x%08x) in the bottom half handler\n",
++			fwevt->event_id, fwevt->evt_ctx);
+ 
+ 	switch (fwevt->event_id) {
+ 	case MPI3_EVENT_DEVICE_ADDED:
+@@ -3076,8 +3076,8 @@ void mpi3mr_os_handle_events(struct mpi3mr_ioc *mrioc,
+ 	}
+ 	if (process_evt_bh || ack_req) {
+ 		dprint_event_th(mrioc,
+-			"scheduling bottom half handler for event(0x%02x),ack_required=%d\n",
+-			evt_type, ack_req);
++		    "scheduling bottom half handler for event(0x%02x) - (0x%08x), ack_required=%d\n",
++		    evt_type, le32_to_cpu(event_reply->event_context), ack_req);
+ 		sz = event_reply->event_data_length * 4;
+ 		fwevt = mpi3mr_alloc_fwevt(sz);
+ 		if (!fwevt) {
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c
+index c8d6ced5640e9..d70f002d6487d 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_transport.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c
+@@ -413,9 +413,11 @@ static void mpi3mr_remove_device_by_sas_address(struct mpi3mr_ioc *mrioc,
+ 			 sas_address, hba_port);
+ 	if (tgtdev) {
+ 		if (!list_empty(&tgtdev->list)) {
+-			list_del_init(&tgtdev->list);
+ 			was_on_tgtdev_list = 1;
+-			mpi3mr_tgtdev_put(tgtdev);
++			if (tgtdev->state == MPI3MR_DEV_REMOVE_HS_STARTED) {
++				list_del_init(&tgtdev->list);
++				mpi3mr_tgtdev_put(tgtdev);
++			}
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
+@@ -2079,6 +2081,8 @@ int mpi3mr_expander_add(struct mpi3mr_ioc *mrioc, u16 handle)
+ 				link_rate = (expander_pg1.negotiated_link_rate &
+ 				    MPI3_SAS_NEG_LINK_RATE_LOGICAL_MASK) >>
+ 				    MPI3_SAS_NEG_LINK_RATE_LOGICAL_SHIFT;
++				if (link_rate < MPI3_SAS_NEG_LINK_RATE_1_5)
++					link_rate = MPI3_SAS_NEG_LINK_RATE_1_5;
+ 				mpi3mr_update_links(mrioc, sas_address_parent,
+ 				    handle, i, link_rate, hba_port);
+ 			}
+@@ -2388,6 +2392,9 @@ int mpi3mr_report_tgtdev_to_sas_transport(struct mpi3mr_ioc *mrioc,
+ 
+ 	link_rate = mpi3mr_get_sas_negotiated_logical_linkrate(mrioc, tgtdev);
+ 
++	if (link_rate < MPI3_SAS_NEG_LINK_RATE_1_5)
++		link_rate = MPI3_SAS_NEG_LINK_RATE_1_5;
++
+ 	mpi3mr_update_links(mrioc, sas_address_parent, tgtdev->dev_handle,
+ 	    parent_phy_number, link_rate, hba_port);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch b/queue-6.17/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
new file mode 100644
index 0000000000..2b85babbf0
--- /dev/null
+++ b/queue-6.17/scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
@@ -0,0 +1,74 @@
+From acb18e7f98acd8914ed80d3279a79e239fb0be48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:35 +0530
+Subject: scsi: mpi3mr: Fix I/O failures during controller reset
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit b7b2176e30fc8e57664e5a8a23387af66eb7f72b ]
+
+I/Os can race with controller reset and fail.
+
+Block requests at the mid layer when reset starts using
+scsi_host_block(), and resume with scsi_host_unblock() after reset
+completes.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-4-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 +++
+ drivers/scsi/mpi3mr/mpi3mr_os.c | 2 ++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index 0152d31d430ab..9e18cc2747104 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -5420,6 +5420,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 	    mpi3mr_reset_rc_name(reset_reason));
+ 
+ 	mrioc->device_refresh_on = 0;
++	scsi_block_requests(mrioc->shost);
+ 	mrioc->reset_in_progress = 1;
+ 	mrioc->stop_bsgs = 1;
+ 	mrioc->prev_reset_result = -1;
+@@ -5528,6 +5529,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 	if (!retval) {
+ 		mrioc->diagsave_timeout = 0;
+ 		mrioc->reset_in_progress = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->pel_abort_requested = 0;
+ 		if (mrioc->pel_enabled) {
+ 			mrioc->pel_cmds.retry_count = 0;
+@@ -5552,6 +5554,7 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc,
+ 		mrioc->device_refresh_on = 0;
+ 		mrioc->unrecoverable = 1;
+ 		mrioc->reset_in_progress = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->stop_bsgs = 0;
+ 		retval = -1;
+ 		mpi3mr_flush_cmds_for_unrecovered_controller(mrioc);
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
+index 1582cdbc66302..5516ac62a5065 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
+@@ -2866,12 +2866,14 @@ static void mpi3mr_preparereset_evt_th(struct mpi3mr_ioc *mrioc,
+ 		    "prepare for reset event top half with rc=start\n");
+ 		if (mrioc->prepare_for_reset)
+ 			return;
++		scsi_block_requests(mrioc->shost);
+ 		mrioc->prepare_for_reset = 1;
+ 		mrioc->prepare_for_reset_timeout_counter = 0;
+ 	} else if (evtdata->reason_code == MPI3_EVENT_PREPARE_RESET_RC_ABORT) {
+ 		dprint_event_th(mrioc,
+ 		    "prepare for reset top half with rc=abort\n");
+ 		mrioc->prepare_for_reset = 0;
++		scsi_unblock_requests(mrioc->shost);
+ 		mrioc->prepare_for_reset_timeout_counter = 0;
+ 	}
+ 	if ((event_reply->msg_flags & MPI3_EVENT_NOTIFY_MSGFLAGS_ACK_MASK)
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch b/queue-6.17/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
new file mode 100644
index 0000000000..ef55e90228
--- /dev/null
+++ b/queue-6.17/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
@@ -0,0 +1,39 @@
+From 69d898b63a7202369df7228a67b8ba77f491f01d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:12 +0530
+Subject: scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
+
+Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in
+_transport_convert_phy_link_rate(). This maps the new 22.5 Gbps
+negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link
+speeds.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index 66fd301f03b0d..f3400d01cc2ae 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)
+ 	case MPI25_SAS_NEG_LINK_RATE_12_0:
+ 		rc = SAS_LINK_RATE_12_0_GBPS;
+ 		break;
++	case MPI26_SAS_NEG_LINK_RATE_22_5:
++		rc = SAS_LINK_RATE_22_5_GBPS;
++		break;
+ 	case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED:
+ 		rc = SAS_PHY_DISABLED;
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-6.17/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..1b5d56f57c
--- /dev/null
+++ b/queue-6.17/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From 3b935eb220f9a442cc4f1ffa6e824aa96ab1fb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 0c96875cf8fd1..cbfda8c04e956 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -682,7 +682,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-6.17/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..4c119ce235
--- /dev/null
+++ b/queue-6.17/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From d7069815a07a05abc4ac25923d29436f57a929d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 7618f9cc9986d..0c96875cf8fd1 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index 599410bcdfea5..8ff4b89ff81e2 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -552,6 +552,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 91b2cdf3535cd..b63b6ffcaaf5b 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -547,6 +547,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-core-change-mcq-interrupt-enable-flow.patch b/queue-6.17/scsi-ufs-core-change-mcq-interrupt-enable-flow.patch
new file mode 100644
index 0000000000..f88cf634de
--- /dev/null
+++ b/queue-6.17/scsi-ufs-core-change-mcq-interrupt-enable-flow.patch
@@ -0,0 +1,118 @@
+From 73f44a9e8deb9e43907e1b92fb4bc83ca4cc659a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 17:16:19 +0800
+Subject: scsi: ufs: core: Change MCQ interrupt enable flow
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 253757797973c54ea967f8fd8f40d16e4a78e6d4 ]
+
+Move the MCQ interrupt enable process to
+ufshcd_mcq_make_queues_operational() to ensure that interrupts are set
+correctly when making queues operational, similar to
+ufshcd_make_hba_operational(). This change addresses the issue where
+ufshcd_mcq_make_queues_operational() was not fully operational due to
+missing interrupt enablement.
+
+This change only affects host drivers that call
+ufshcd_mcq_make_queues_operational(), i.e. ufs-mediatek.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufs-mcq.c | 11 +++++++++++
+ drivers/ufs/core/ufshcd.c  | 12 +-----------
+ include/ufs/ufshcd.h       |  1 +
+ 3 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
+index cc88aaa106da3..c9bdd4140fd04 100644
+--- a/drivers/ufs/core/ufs-mcq.c
++++ b/drivers/ufs/core/ufs-mcq.c
+@@ -29,6 +29,10 @@
+ #define MCQ_ENTRY_SIZE_IN_DWORD	8
+ #define CQE_UCD_BA GENMASK_ULL(63, 7)
+ 
++#define UFSHCD_ENABLE_MCQ_INTRS	(UTP_TASK_REQ_COMPL |\
++				 UFSHCD_ERROR_MASK |\
++				 MCQ_CQ_EVENT_STATUS)
++
+ /* Max mcq register polling time in microseconds */
+ #define MCQ_POLL_US 500000
+ 
+@@ -355,9 +359,16 @@ EXPORT_SYMBOL_GPL(ufshcd_mcq_poll_cqe_lock);
+ void ufshcd_mcq_make_queues_operational(struct ufs_hba *hba)
+ {
+ 	struct ufs_hw_queue *hwq;
++	u32 intrs;
+ 	u16 qsize;
+ 	int i;
+ 
++	/* Enable required interrupts */
++	intrs = UFSHCD_ENABLE_MCQ_INTRS;
++	if (hba->quirks & UFSHCD_QUIRK_MCQ_BROKEN_INTR)
++		intrs &= ~MCQ_CQ_EVENT_STATUS;
++	ufshcd_enable_intr(hba, intrs);
++
+ 	for (i = 0; i < hba->nr_hw_queues; i++) {
+ 		hwq = &hba->uhq[i];
+ 		hwq->id = i;
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index bd6d1d4c82427..b6d5d135527c0 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -45,11 +45,6 @@
+ 				 UTP_TASK_REQ_COMPL |\
+ 				 UFSHCD_ERROR_MASK)
+ 
+-#define UFSHCD_ENABLE_MCQ_INTRS	(UTP_TASK_REQ_COMPL |\
+-				 UFSHCD_ERROR_MASK |\
+-				 MCQ_CQ_EVENT_STATUS)
+-
+-
+ /* UIC command timeout, unit: ms */
+ enum {
+ 	UIC_CMD_TIMEOUT_DEFAULT	= 500,
+@@ -372,7 +367,7 @@ EXPORT_SYMBOL_GPL(ufshcd_disable_irq);
+  * @hba: per adapter instance
+  * @intrs: interrupt bits
+  */
+-static void ufshcd_enable_intr(struct ufs_hba *hba, u32 intrs)
++void ufshcd_enable_intr(struct ufs_hba *hba, u32 intrs)
+ {
+ 	u32 old_val = ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
+ 	u32 new_val = old_val | intrs;
+@@ -8925,16 +8920,11 @@ static int ufshcd_alloc_mcq(struct ufs_hba *hba)
+ static void ufshcd_config_mcq(struct ufs_hba *hba)
+ {
+ 	int ret;
+-	u32 intrs;
+ 
+ 	ret = ufshcd_mcq_vops_config_esi(hba);
+ 	hba->mcq_esi_enabled = !ret;
+ 	dev_info(hba->dev, "ESI %sconfigured\n", ret ? "is not " : "");
+ 
+-	intrs = UFSHCD_ENABLE_MCQ_INTRS;
+-	if (hba->quirks & UFSHCD_QUIRK_MCQ_BROKEN_INTR)
+-		intrs &= ~MCQ_CQ_EVENT_STATUS;
+-	ufshcd_enable_intr(hba, intrs);
+ 	ufshcd_mcq_make_queues_operational(hba);
+ 	ufshcd_mcq_config_mac(hba, hba->nutrs);
+ 
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index a4eb5bde46e88..a060fa71b2b1b 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -1321,6 +1321,7 @@ static inline void ufshcd_rmwl(struct ufs_hba *hba, u32 mask, u32 val, u32 reg)
+ 
+ void ufshcd_enable_irq(struct ufs_hba *hba);
+ void ufshcd_disable_irq(struct ufs_hba *hba);
++void ufshcd_enable_intr(struct ufs_hba *hba, u32 intrs);
+ int ufshcd_alloc_host(struct device *, struct ufs_hba **);
+ int ufshcd_hba_enable(struct ufs_hba *hba);
+ int ufshcd_init(struct ufs_hba *, void __iomem *, unsigned int);
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-core-disable-timestamp-functionality-if-not.patch b/queue-6.17/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
new file mode 100644
index 0000000000..74479f7ee5
--- /dev/null
+++ b/queue-6.17/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
@@ -0,0 +1,67 @@
+From a158e0407d28a14faa35912175d38962d9f1e358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 12:06:07 -0700
+Subject: scsi: ufs: core: Disable timestamp functionality if not supported
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit fb1f4568346153d2f80fdb4ffcfa0cf4fb257d3c ]
+
+Some Kioxia UFS 4 devices do not support the qTimestamp attribute.  Set
+the UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT for these devices such that no
+error messages appear in the kernel log about failures to set the
+qTimestamp attribute.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Tested-by: Nitin Rawat <quic_nitirawa@quicinc.com> # on SM8650-QRD
+Reviewed-by: Nitin Rawat <quic_nitirawa@quicinc.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Message-ID: <20250909190614.3531435-1-bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +++++-
+ include/ufs/ufs_quirks.h  | 3 +++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 8bb6c48216963..bd6d1d4c82427 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -316,6 +316,9 @@ static const struct ufs_dev_quirk ufs_fixups[] = {
+ 	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
+ 	  .model = "THGLF2G9D8KBADG",
+ 	  .quirk = UFS_DEVICE_QUIRK_PA_TACTIVATE },
++	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
++	  .model = "THGJFJT1E45BATP",
++	  .quirk = UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT },
+ 	{}
+ };
+ 
+@@ -8794,7 +8797,8 @@ static void ufshcd_set_timestamp_attr(struct ufs_hba *hba)
+ 	struct ufs_dev_info *dev_info = &hba->dev_info;
+ 	struct utp_upiu_query_v4_0 *upiu_data;
+ 
+-	if (dev_info->wspecversion < 0x400)
++	if (dev_info->wspecversion < 0x400 ||
++	    hba->dev_quirks & UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT)
+ 		return;
+ 
+ 	ufshcd_dev_man_lock(hba);
+diff --git a/include/ufs/ufs_quirks.h b/include/ufs/ufs_quirks.h
+index f52de5ed1b3b6..83563247c36cb 100644
+--- a/include/ufs/ufs_quirks.h
++++ b/include/ufs/ufs_quirks.h
+@@ -113,4 +113,7 @@ struct ufs_dev_quirk {
+  */
+ #define UFS_DEVICE_QUIRK_PA_HIBER8TIME          (1 << 12)
+ 
++/* Some UFS 4 devices do not support the qTimestamp attribute */
++#define UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT	(1 << 13)
++
+ #endif /* UFS_QUIRKS_H_ */
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch b/queue-6.17/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
new file mode 100644
index 0000000000..293b2a51ff
--- /dev/null
+++ b/queue-6.17/scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
@@ -0,0 +1,57 @@
+From 655a1e551c4cd7437c6cbee642ddeba93294cfb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 11:09:23 +0530
+Subject: scsi: ufs: exynos: fsd: Gate ref_clk and put UFS device in reset on
+ suspend
+
+From: Bharat Uppal <bharat.uppal@samsung.com>
+
+[ Upstream commit 6d55af0f0740bf3d77943425fdafb77dc0fa6bb9 ]
+
+On FSD platform, gating the reference clock (ref_clk) and putting the
+UFS device in reset by asserting the reset signal during UFS suspend,
+improves the power savings and ensures the PHY is fully turned off.
+
+These operations are added as FSD specific suspend hook to avoid
+unintended side effects on other SoCs supported by this driver.
+
+Co-developed-by: Nimesh Sati <nimesh.sati@samsung.com>
+Signed-off-by: Nimesh Sati <nimesh.sati@samsung.com>
+Signed-off-by: Bharat Uppal <bharat.uppal@samsung.com>
+Link: https://lore.kernel.org/r/20250821053923.69411-1-bharat.uppal@samsung.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-exynos.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
+index f0adcd9dd553d..513cbcfa10acd 100644
+--- a/drivers/ufs/host/ufs-exynos.c
++++ b/drivers/ufs/host/ufs-exynos.c
+@@ -1896,6 +1896,13 @@ static int fsd_ufs_pre_pwr_change(struct exynos_ufs *ufs,
+ 	return 0;
+ }
+ 
++static int fsd_ufs_suspend(struct exynos_ufs *ufs)
++{
++	exynos_ufs_gate_clks(ufs);
++	hci_writel(ufs, 0, HCI_GPIO_OUT);
++	return 0;
++}
++
+ static inline u32 get_mclk_period_unipro_18(struct exynos_ufs *ufs)
+ {
+ 	return (16 * 1000 * 1000000UL / ufs->mclk_rate);
+@@ -2162,6 +2169,7 @@ static const struct exynos_ufs_drv_data fsd_ufs_drvs = {
+ 	.pre_link               = fsd_ufs_pre_link,
+ 	.post_link              = fsd_ufs_post_link,
+ 	.pre_pwr_change         = fsd_ufs_pre_pwr_change,
++	.suspend                = fsd_ufs_suspend,
+ };
+ 
+ static const struct exynos_ufs_drv_data gs101_ufs_drvs = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch b/queue-6.17/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
new file mode 100644
index 0000000000..10d85421bb
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
@@ -0,0 +1,61 @@
+From 78d8aac10e415901fa7038fe6002a6847a7d786b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:22 +0800
+Subject: scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO
+ mode change
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
+
+Assign power mode userdata settings before transitioning to FASTAUTO
+power mode. This ensures that default timeout values are set for various
+parameters, enhancing the reliability and performance of the power mode
+change process.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 4171fa672450d..ada21360aa270 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1349,6 +1349,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
+ 			       PA_NO_ADAPT);
+ 
++		if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) {
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2),
++					DL_AFC0ReqTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3),
++					DL_FC1ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4),
++					DL_TC1ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5),
++					DL_AFC1ReqTimeOutVal_Default);
++
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal),
++					DL_AFC0ReqTimeOutVal_Default);
++		}
++
+ 		ret = ufshcd_uic_change_pwr_mode(hba,
+ 					FASTAUTO_MODE << 4 | FASTAUTO_MODE);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch b/queue-6.17/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
new file mode 100644
index 0000000000..106124a006
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
@@ -0,0 +1,44 @@
+From 4b4e9faec63ccf5cd75d8c0797499d10b7f29e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:25 +0800
+Subject: scsi: ufs: host: mediatek: Change reset sequence for improved
+ stability
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
+
+Modify the reset sequence to ensure that the device reset pin is set low
+before the host is disabled. This change enhances the stability of the
+reset process by ensuring the correct order of operations.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index ada21360aa270..82160da8ec71b 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1503,11 +1503,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba)
+ {
+ 	struct arm_smccc_res res;
+ 
+-	/* disable hba before device reset */
+-	ufshcd_hba_stop(hba);
+-
+ 	ufs_mtk_device_reset_ctrl(0, res);
+ 
++	/* disable hba in middle of device reset */
++	ufshcd_hba_stop(hba);
++
+ 	/*
+ 	 * The reset signal is active low. UFS devices shall detect
+ 	 * more than or equal to 1us of positive or negative RST_n
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-correct-system-pm-flow.patch b/queue-6.17/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
new file mode 100644
index 0000000000..9392105708
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-correct-system-pm-flow.patch
@@ -0,0 +1,69 @@
+From 48c7f4eeeb7a73187f071dcadd39bd1797bb3a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:39 +0800
+Subject: scsi: ufs: host: mediatek: Correct system PM flow
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 77b96ef70b6ba46e3473e5e3a66095c4bc0e93a4 ]
+
+Refine the system power management (PM) flow by skipping low power mode
+(LPM) and MTCMOS settings if runtime PM is already applied. Prevent
+redundant operations to ensure a more efficient PM process.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 6bdbbee1f0708..91081d2aabe44 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -2264,27 +2264,38 @@ static int ufs_mtk_system_suspend(struct device *dev)
+ 
+ 	ret = ufshcd_system_suspend(dev);
+ 	if (ret)
+-		return ret;
++		goto out;
++
++	if (pm_runtime_suspended(hba->dev))
++		goto out;
+ 
+ 	ufs_mtk_dev_vreg_set_lpm(hba, true);
+ 
+ 	if (ufs_mtk_is_rtff_mtcmos(hba))
+ 		ufs_mtk_mtcmos_ctrl(false, res);
+ 
+-	return 0;
++out:
++	return ret;
+ }
+ 
+ static int ufs_mtk_system_resume(struct device *dev)
+ {
++	int ret = 0;
+ 	struct ufs_hba *hba = dev_get_drvdata(dev);
+ 	struct arm_smccc_res res;
+ 
++	if (pm_runtime_suspended(hba->dev))
++		goto out;
++
+ 	ufs_mtk_dev_vreg_set_lpm(hba, false);
+ 
+ 	if (ufs_mtk_is_rtff_mtcmos(hba))
+ 		ufs_mtk_mtcmos_ctrl(true, res);
+ 
+-	return ufshcd_system_resume(dev);
++out:
++	ret = ufshcd_system_resume(dev);
++
++	return ret;
+ }
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch b/queue-6.17/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
new file mode 100644
index 0000000000..890e4730b8
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
@@ -0,0 +1,109 @@
+From ba448928e2c89e99fbfe7178a748a7055c9c9ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:42 +0800
+Subject: scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode
+ changes
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit f5ca8d0c7a6388abd5d8023cc682e1543728cc73 ]
+
+Disable auto-hibern8 during power mode transitions to prevent unintended
+entry into auto-hibern8. Restore the original auto-hibern8 timer value
+after completing the power mode change to maintain system stability and
+prevent potential issues during power state transitions.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 53 +++++++++++++++++++--------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 91081d2aabe44..3defb5f135e33 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1400,19 +1400,49 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 	return ret;
+ }
+ 
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++{
++	int ret;
++
++	/* disable auto-hibern8 */
++	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
++
++	/* wait host return to idle state when auto-hibern8 off */
++	ufs_mtk_wait_idle_state(hba, 5);
++
++	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
++	if (ret) {
++		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
++}
++
+ static int ufs_mtk_pwr_change_notify(struct ufs_hba *hba,
+ 				enum ufs_notify_change_status stage,
+ 				const struct ufs_pa_layer_attr *dev_max_params,
+ 				struct ufs_pa_layer_attr *dev_req_params)
+ {
+ 	int ret = 0;
++	static u32 reg;
+ 
+ 	switch (stage) {
+ 	case PRE_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba)) {
++			reg = ufshcd_readl(hba, REG_AUTO_HIBERNATE_IDLE_TIMER);
++			ufs_mtk_auto_hibern8_disable(hba);
++		}
+ 		ret = ufs_mtk_pre_pwr_change(hba, dev_max_params,
+ 					     dev_req_params);
+ 		break;
+ 	case POST_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba))
++			ufshcd_writel(hba, reg, REG_AUTO_HIBERNATE_IDLE_TIMER);
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+@@ -1646,29 +1676,6 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+-{
+-	int ret;
+-
+-	/* disable auto-hibern8 */
+-	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
+-
+-	/* wait host return to idle state when auto-hibern8 off */
+-	ufs_mtk_wait_idle_state(hba, 5);
+-
+-	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret) {
+-		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
+-
+-		ufshcd_force_error_recovery(hba);
+-
+-		/* trigger error handler and break suspend */
+-		ret = -EBUSY;
+-	}
+-
+-	return ret;
+-}
+-
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 	enum ufs_notify_change_status status)
+ {
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch b/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
new file mode 100644
index 0000000000..064d89ef4b
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
@@ -0,0 +1,99 @@
+From cf313e29493f058661e4060bd79a5fa293588cba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:37 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on hibernation exit
+ failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit faac32d4ece30609f1a0930ca0ae951cf6dc1786 ]
+
+Improve the recovery process for hibernation exit failures. Trigger the
+error handler and break the suspend operation to ensure effective
+recovery from hibernation errors. Activate the error handling mechanism
+by ufshcd_force_error_recovery and scheduling the error handler work.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c       |  3 ++-
+ drivers/ufs/host/ufs-mediatek.c | 14 +++++++++++---
+ include/ufs/ufshcd.h            |  1 +
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 52f2c599a348e..8bb6c48216963 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6462,13 +6462,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba)
+ 	}
+ }
+ 
+-static void ufshcd_force_error_recovery(struct ufs_hba *hba)
++void ufshcd_force_error_recovery(struct ufs_hba *hba)
+ {
+ 	spin_lock_irq(hba->host->host_lock);
+ 	hba->force_reset = true;
+ 	ufshcd_schedule_eh_work(hba);
+ 	spin_unlock_irq(hba->host->host_lock);
+ }
++EXPORT_SYMBOL_GPL(ufshcd_force_error_recovery);
+ 
+ static void ufshcd_clk_scaling_allow(struct ufs_hba *hba, bool allow)
+ {
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 055b24758ca3d..6bdbbee1f0708 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1646,7 +1646,7 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ {
+ 	int ret;
+ 
+@@ -1657,8 +1657,16 @@ static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ 	ufs_mtk_wait_idle_state(hba, 5);
+ 
+ 	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret)
++	if (ret) {
+ 		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
+ }
+ 
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+@@ -1669,7 +1677,7 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 
+ 	if (status == PRE_CHANGE) {
+ 		if (ufshcd_is_auto_hibern8_supported(hba))
+-			ufs_mtk_auto_hibern8_disable(hba);
++			return ufs_mtk_auto_hibern8_disable(hba);
+ 		return 0;
+ 	}
+ 
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index a3fa98540d184..a4eb5bde46e88 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -1511,5 +1511,6 @@ int __ufshcd_write_ee_control(struct ufs_hba *hba, u32 ee_ctrl_mask);
+ int ufshcd_write_ee_control(struct ufs_hba *hba);
+ int ufshcd_update_ee_control(struct ufs_hba *hba, u16 *mask,
+ 			     const u16 *other_mask, u16 set, u16 clr);
++void ufshcd_force_error_recovery(struct ufs_hba *hba);
+ 
+ #endif /* End of Header */
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch b/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
new file mode 100644
index 0000000000..8804b70000
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
@@ -0,0 +1,50 @@
+From 8eb86af0754a468a43f2ba6b220a050c9d489bd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:38 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on resume failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
+
+Improve the recovery process for failed resume operations. Log the
+device's power status and return 0 if both resume and recovery fail to
+prevent I/O hang.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index bb0be6bed1bca..188f90e468c41 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1727,8 +1727,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ 	}
+ 
+ 	return 0;
++
+ fail:
+-	return ufshcd_link_recovery(hba);
++	/*
++	 * Check if the platform (parent) device has resumed, and ensure that
++	 * power, clock, and MTCMOS are all turned on.
++	 */
++	err = ufshcd_link_recovery(hba);
++	if (err) {
++		dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n",
++			hba->dev->power.request,
++			hba->dev->power.runtime_status,
++			hba->dev->power.runtime_error);
++	}
++
++	return 0; /* Cannot return a failure, otherwise, the I/O will hang. */
+ }
+ 
+ static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba)
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-fix-adapt-issue-after-pa_init.patch b/queue-6.17/scsi-ufs-host-mediatek-fix-adapt-issue-after-pa_init.patch
new file mode 100644
index 0000000000..00c0e01406
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-fix-adapt-issue-after-pa_init.patch
@@ -0,0 +1,50 @@
+From 9c227881b35015c307e6cf3c3a1f6c1eaed5e4ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:44 +0800
+Subject: scsi: ufs: host: mediatek: Fix adapt issue after PA_Init
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit d73836cb8535b3078e4d2a57913f301baec58a33 ]
+
+Address the issue where the host does not send adapt to the device after
+PA_Init success. Ensure the adapt process is correctly initiated for
+devices with IP version MT6899 and above, resolving communication issues
+between the host and device.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 3defb5f135e33..c0acbd3f8fc36 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1503,8 +1503,19 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba)
+ 
+ 	return ret;
+ }
++
+ static void ufs_mtk_post_link(struct ufs_hba *hba)
+ {
++	struct ufs_mtk_host *host = ufshcd_get_variant(hba);
++	u32 tmp;
++
++	/* fix device PA_INIT no adapt */
++	if (host->ip_ver >= IP_VER_MT6899) {
++		ufshcd_dme_get(hba, UIC_ARG_MIB(VS_DEBUGOMC), &tmp);
++		tmp |= 0x100;
++		ufshcd_dme_set(hba, UIC_ARG_MIB(VS_DEBUGOMC), tmp);
++	}
++
+ 	/* enable unipro clock gating feature */
+ 	ufs_mtk_cfg_unipro_cg(hba, true);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch b/queue-6.17/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
new file mode 100644
index 0000000000..439a117b57
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
@@ -0,0 +1,147 @@
+From 4e3445b7cb4180014d975176129ded7b754ea66a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:18 +0800
+Subject: scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit aa86602a483ba48f51044fbaefa1ebbf6da194a4 ]
+
+Move the configuration of the Auto-Hibern8 (AHIT) timer from the
+post-link stage to the 'fixup_dev_quirks' function. This change allows
+setting the AHIT based on the vendor requirements:
+
+   (a) Samsung: 3.5 ms
+   (b) Micron: 2 ms
+   (c) Others: 1 ms
+
+Additionally, the clock gating timer is adjusted based on the AHIT
+scale, with a maximum setting of 10 ms. This ensures that the clock
+gating delay is appropriately configured to match the AHIT settings.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-3-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 86 ++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index f902ce08c95a6..8dd124835151a 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1075,6 +1075,69 @@ static void ufs_mtk_vreg_fix_vccqx(struct ufs_hba *hba)
+ 	}
+ }
+ 
++static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
++{
++	unsigned long flags;
++	u32 ah_ms = 10;
++	u32 ah_scale, ah_timer;
++	u32 scale_us[] = {1, 10, 100, 1000, 10000, 100000};
++
++	if (ufshcd_is_clkgating_allowed(hba)) {
++		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit) {
++			ah_scale = FIELD_GET(UFSHCI_AHIBERN8_SCALE_MASK,
++					  hba->ahit);
++			ah_timer = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
++					  hba->ahit);
++			if (ah_scale <= 5)
++				ah_ms = ah_timer * scale_us[ah_scale] / 1000;
++		}
++
++		spin_lock_irqsave(hba->host->host_lock, flags);
++		hba->clk_gating.delay_ms = max(ah_ms, 10U);
++		spin_unlock_irqrestore(hba->host->host_lock, flags);
++	}
++}
++
++/* Convert microseconds to Auto-Hibernate Idle Timer register value */
++static u32 ufs_mtk_us_to_ahit(unsigned int timer)
++{
++	unsigned int scale;
++
++	for (scale = 0; timer > UFSHCI_AHIBERN8_TIMER_MASK; ++scale)
++		timer /= UFSHCI_AHIBERN8_SCALE_FACTOR;
++
++	return FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, timer) |
++	       FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, scale);
++}
++
++static void ufs_mtk_fix_ahit(struct ufs_hba *hba)
++{
++	unsigned int us;
++
++	if (ufshcd_is_auto_hibern8_supported(hba)) {
++		switch (hba->dev_info.wmanufacturerid) {
++		case UFS_VENDOR_SAMSUNG:
++			/* configure auto-hibern8 timer to 3.5 ms */
++			us = 3500;
++			break;
++
++		case UFS_VENDOR_MICRON:
++			/* configure auto-hibern8 timer to 2 ms */
++			us = 2000;
++			break;
++
++		default:
++			/* configure auto-hibern8 timer to 1 ms */
++			us = 1000;
++			break;
++		}
++
++		hba->ahit = ufs_mtk_us_to_ahit(us);
++	}
++
++	ufs_mtk_setup_clk_gating(hba);
++}
++
+ static void ufs_mtk_init_mcq_irq(struct ufs_hba *hba)
+ {
+ 	struct ufs_mtk_host *host = ufshcd_get_variant(hba);
+@@ -1369,32 +1432,10 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba)
+ 
+ 	return ret;
+ }
+-
+-static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
+-{
+-	u32 ah_ms;
+-
+-	if (ufshcd_is_clkgating_allowed(hba)) {
+-		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit)
+-			ah_ms = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
+-					  hba->ahit);
+-		else
+-			ah_ms = 10;
+-		ufshcd_clkgate_delay_set(hba->dev, ah_ms + 5);
+-	}
+-}
+-
+ static void ufs_mtk_post_link(struct ufs_hba *hba)
+ {
+ 	/* enable unipro clock gating feature */
+ 	ufs_mtk_cfg_unipro_cg(hba, true);
+-
+-	/* will be configured during probe hba */
+-	if (ufshcd_is_auto_hibern8_supported(hba))
+-		hba->ahit = FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, 10) |
+-			FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, 3);
+-
+-	ufs_mtk_setup_clk_gating(hba);
+ }
+ 
+ static int ufs_mtk_link_startup_notify(struct ufs_hba *hba,
+@@ -1726,6 +1767,7 @@ static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba)
+ 
+ 	ufs_mtk_vreg_fix_vcc(hba);
+ 	ufs_mtk_vreg_fix_vccqx(hba);
++	ufs_mtk_fix_ahit(hba);
+ }
+ 
+ static void ufs_mtk_event_notify(struct ufs_hba *hba,
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch b/queue-6.17/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
new file mode 100644
index 0000000000..8d1142369a
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
@@ -0,0 +1,41 @@
+From 7b40e22fbe1b4f60f732ad4b9fe866690fa344c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:26 +0800
+Subject: scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
+
+Add a NULL check before accessing the 'vccqx' pointer to prevent invalid
+memory access. This ensures that the function safely handles cases where
+'vccq' and 'vccq2' are not initialized, improving the robustness of the
+power management code.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 82160da8ec71b..bb0be6bed1bca 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1589,6 +1589,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm)
+ {
+ 	struct ufs_vreg *vccqx = NULL;
+ 
++	if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2)
++		return;
++
+ 	if (hba->vreg_info.vccq)
+ 		vccqx = hba->vreg_info.vccq;
+ 	else
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch b/queue-6.17/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
new file mode 100644
index 0000000000..5835cc0051
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
@@ -0,0 +1,77 @@
+From 767cf5696df4da98793d62d6285778829dbce47d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:21 +0800
+Subject: scsi: ufs: host: mediatek: Fix PWM mode switch issue
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 7212d624f8638f8ea8ad1ecbb80622c7987bc7a1 ]
+
+Address a failure in switching to PWM mode by ensuring proper
+configuration of power modes and adaptation settings. The changes
+include checks for SLOW_MODE and adjustments to the desired working mode
+and adaptation configuration based on the device's power mode and
+hardware version.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-6-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 8dd124835151a..4171fa672450d 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1303,6 +1303,10 @@ static bool ufs_mtk_pmc_via_fastauto(struct ufs_hba *hba,
+ 	    dev_req_params->gear_rx < UFS_HS_G4)
+ 		return false;
+ 
++	if (dev_req_params->pwr_tx == SLOW_MODE ||
++	    dev_req_params->pwr_rx == SLOW_MODE)
++		return false;
++
+ 	return true;
+ }
+ 
+@@ -1318,6 +1322,10 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 	host_params.hs_rx_gear = UFS_HS_G5;
+ 	host_params.hs_tx_gear = UFS_HS_G5;
+ 
++	if (dev_max_params->pwr_rx == SLOW_MODE ||
++	    dev_max_params->pwr_tx == SLOW_MODE)
++		host_params.desired_working_mode = UFS_PWM_MODE;
++
+ 	ret = ufshcd_negotiate_pwr_params(&host_params, dev_max_params, dev_req_params);
+ 	if (ret) {
+ 		pr_info("%s: failed to determine capabilities\n",
+@@ -1350,10 +1358,21 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		}
+ 	}
+ 
+-	if (host->hw_ver.major >= 3) {
++	if (dev_req_params->pwr_rx == FAST_MODE ||
++	    dev_req_params->pwr_rx == FASTAUTO_MODE) {
++		if (host->hw_ver.major >= 3) {
++			ret = ufshcd_dme_configure_adapt(hba,
++						   dev_req_params->gear_tx,
++						   PA_INITIAL_ADAPT);
++		} else {
++			ret = ufshcd_dme_configure_adapt(hba,
++				   dev_req_params->gear_tx,
++				   PA_NO_ADAPT);
++		}
++	} else {
+ 		ret = ufshcd_dme_configure_adapt(hba,
+-					   dev_req_params->gear_tx,
+-					   PA_INITIAL_ADAPT);
++			   dev_req_params->gear_tx,
++			   PA_NO_ADAPT);
+ 	}
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch b/queue-6.17/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
new file mode 100644
index 0000000000..5471d32870
--- /dev/null
+++ b/queue-6.17/scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
@@ -0,0 +1,36 @@
+From 84eeadbe5c0993578f4812f659102a938c627f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:45 +0800
+Subject: scsi: ufs: host: mediatek: Fix unbalanced IRQ enable issue
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 91cad911edd1612ed28f5cfb2d4c53a8824951a5 ]
+
+Resolve the issue of unbalanced IRQ enablement by setting the
+'is_mcq_intr_enabled' flag after the first successful IRQ enablement.
+Ensure proper tracking of the IRQ state and prevent potential mismatches
+in IRQ handling.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 188f90e468c41..055b24758ca3d 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -2111,6 +2111,7 @@ static int ufs_mtk_config_mcq_irq(struct ufs_hba *hba)
+ 			return ret;
+ 		}
+ 	}
++	host->is_mcq_intr_enabled = true;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-ufs-qcom-align-programming-sequence-of-shar.patch b/queue-6.17/scsi-ufs-ufs-qcom-align-programming-sequence-of-shar.patch
new file mode 100644
index 0000000000..fd40990ba6
--- /dev/null
+++ b/queue-6.17/scsi-ufs-ufs-qcom-align-programming-sequence-of-shar.patch
@@ -0,0 +1,92 @@
+From 9c573d66fd269be3ed0b2af77e42ac73f85a45d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 09:39:05 +0530
+Subject: scsi: ufs: ufs-qcom: Align programming sequence of Shared ICE for UFS
+ controller v5
+
+From: Palash Kambar <quic_pkambar@quicinc.com>
+
+[ Upstream commit 3126b5fd02270380cce833d06f973a3ffb33a69b ]
+
+Disabling the AES core in Shared ICE is not supported during power
+collapse for UFS Host Controller v5.0, which may lead to data errors
+after Hibern8 exit. To comply with hardware programming guidelines and
+avoid this issue, issue a sync reset to ICE upon power collapse exit.
+
+Hence follow below steps to reset the ICE upon exiting power collapse
+and align with Hw programming guide.
+
+a. Assert the ICE sync reset by setting both SYNC_RST_SEL and
+   SYNC_RST_SW bits in UFS_MEM_ICE_CFG
+
+b. Deassert the reset by clearing SYNC_RST_SW in  UFS_MEM_ICE_CFG
+
+Signed-off-by: Palash Kambar <quic_pkambar@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-qcom.c | 21 +++++++++++++++++++++
+ drivers/ufs/host/ufs-qcom.h |  2 +-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
+index 9574fdc2bb0fd..3ea6b08d2b526 100644
+--- a/drivers/ufs/host/ufs-qcom.c
++++ b/drivers/ufs/host/ufs-qcom.c
+@@ -38,6 +38,9 @@
+ #define DEEMPHASIS_3_5_dB	0x04
+ #define NO_DEEMPHASIS		0x0
+ 
++#define UFS_ICE_SYNC_RST_SEL	BIT(3)
++#define UFS_ICE_SYNC_RST_SW	BIT(4)
++
+ enum {
+ 	TSTBUS_UAWM,
+ 	TSTBUS_UARM,
+@@ -751,11 +754,29 @@ static int ufs_qcom_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ {
+ 	struct ufs_qcom_host *host = ufshcd_get_variant(hba);
+ 	int err;
++	u32 reg_val;
+ 
+ 	err = ufs_qcom_enable_lane_clks(host);
+ 	if (err)
+ 		return err;
+ 
++	if ((!ufs_qcom_is_link_active(hba)) &&
++	    host->hw_ver.major == 5 &&
++	    host->hw_ver.minor == 0 &&
++	    host->hw_ver.step == 0) {
++		ufshcd_writel(hba, UFS_ICE_SYNC_RST_SEL | UFS_ICE_SYNC_RST_SW, UFS_MEM_ICE_CFG);
++		reg_val = ufshcd_readl(hba, UFS_MEM_ICE_CFG);
++		reg_val &= ~(UFS_ICE_SYNC_RST_SEL | UFS_ICE_SYNC_RST_SW);
++		/*
++		 * HW documentation doesn't recommend any delay between the
++		 * reset set and clear. But we are enforcing an arbitrary delay
++		 * to give flops enough time to settle in.
++		 */
++		usleep_range(50, 100);
++		ufshcd_writel(hba, reg_val, UFS_MEM_ICE_CFG);
++		ufshcd_readl(hba, UFS_MEM_ICE_CFG);
++	}
++
+ 	return ufs_qcom_ice_resume(host);
+ }
+ 
+diff --git a/drivers/ufs/host/ufs-qcom.h b/drivers/ufs/host/ufs-qcom.h
+index e0e129af7c16b..88e2f322d37d8 100644
+--- a/drivers/ufs/host/ufs-qcom.h
++++ b/drivers/ufs/host/ufs-qcom.h
+@@ -60,7 +60,7 @@ enum {
+ 	UFS_AH8_CFG				= 0xFC,
+ 
+ 	UFS_RD_REG_MCQ				= 0xD00,
+-
++	UFS_MEM_ICE_CFG				= 0x2600,
+ 	REG_UFS_MEM_ICE_CONFIG			= 0x260C,
+ 	REG_UFS_MEM_ICE_NUM_CORE		= 0x2664,
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/scsi-ufs-ufs-qcom-disable-lane-clocks-during-phy-hib.patch b/queue-6.17/scsi-ufs-ufs-qcom-disable-lane-clocks-during-phy-hib.patch
new file mode 100644
index 0000000000..94c2e26369
--- /dev/null
+++ b/queue-6.17/scsi-ufs-ufs-qcom-disable-lane-clocks-during-phy-hib.patch
@@ -0,0 +1,61 @@
+From 9c82eb123dc1b99fa5f8fca79efcfa6fed4331a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 11:21:49 +0530
+Subject: scsi: ufs: ufs-qcom: Disable lane clocks during phy hibern8
+
+From: Palash Kambar <quic_pkambar@quicinc.com>
+
+[ Upstream commit c1553fc105dff28f79bef90fab207235f5f2d977 ]
+
+Currently, the UFS lane clocks remain enabled even after the link enters
+the Hibern8 state and are only disabled during runtime/system
+suspend.This patch modifies the behavior to disable the lane clocks
+during ufs_qcom_setup_clocks(), which is invoked shortly after the link
+enters Hibern8 via gate work.
+
+While hibern8_notify() offers immediate control, toggling clocks on
+every transition isn't ideal due to varied contexts like clock scaling.
+Since setup_clocks() manages PHY/controller resources and is invoked
+soon after Hibern8 entry, it serves as a central and stable point for
+clock gating.
+
+Signed-off-by: Palash Kambar <quic_pkambar@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Message-ID: <20250909055149.2068737-1-quic_pkambar@quicinc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-qcom.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
+index 3ea6b08d2b526..2b6eb377eec07 100644
+--- a/drivers/ufs/host/ufs-qcom.c
++++ b/drivers/ufs/host/ufs-qcom.c
+@@ -1183,6 +1183,13 @@ static int ufs_qcom_setup_clocks(struct ufs_hba *hba, bool on,
+ 	case PRE_CHANGE:
+ 		if (on) {
+ 			ufs_qcom_icc_update_bw(host);
++			if (ufs_qcom_is_link_hibern8(hba)) {
++				err = ufs_qcom_enable_lane_clks(host);
++				if (err) {
++					dev_err(hba->dev, "enable lane clks failed, ret=%d\n", err);
++					return err;
++				}
++			}
+ 		} else {
+ 			if (!ufs_qcom_is_link_active(hba)) {
+ 				/* disable device ref_clk */
+@@ -1208,6 +1215,9 @@ static int ufs_qcom_setup_clocks(struct ufs_hba *hba, bool on,
+ 			if (ufshcd_is_hs_mode(&hba->pwr_info))
+ 				ufs_qcom_dev_ref_clk_ctrl(host, true);
+ 		} else {
++			if (ufs_qcom_is_link_hibern8(hba))
++				ufs_qcom_disable_lane_clks(host);
++
+ 			ufs_qcom_icc_set_bw(host, ufs_qcom_bw_table[MODE_MIN][0][0].mem_bw,
+ 					    ufs_qcom_bw_table[MODE_MIN][0][0].cfg_bw);
+ 		}
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftest-net-fix-error-message-if-empty-variable.patch b/queue-6.17/selftest-net-fix-error-message-if-empty-variable.patch
new file mode 100644
index 0000000000..32411f165d
--- /dev/null
+++ b/queue-6.17/selftest-net-fix-error-message-if-empty-variable.patch
@@ -0,0 +1,45 @@
+From 66306a6a65489d6eaac2e498eb86a7f74ec85ba3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 15:28:23 +0200
+Subject: selftest: net: Fix error message if empty variable
+
+From: Alessandro Zanni <alessandro.zanni87@gmail.com>
+
+[ Upstream commit 81dcfdd21dbd7067068c7c341ee448c3f0d6f115 ]
+
+Fix to avoid cases where the `res` shell variable is
+empty in script comparisons.
+The comparison has been modified into string comparison to
+handle other possible values the variable could assume.
+
+The issue can be reproduced with the command:
+make kselftest TARGETS=net
+
+It solves the error:
+./tfo_passive.sh: line 98: [: -eq: unary operator expected
+
+Signed-off-by: Alessandro Zanni <alessandro.zanni87@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250925132832.9828-1-alessandro.zanni87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/tfo_passive.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/tfo_passive.sh b/tools/testing/selftests/net/tfo_passive.sh
+index 80bf11fdc0462..a4550511830a9 100755
+--- a/tools/testing/selftests/net/tfo_passive.sh
++++ b/tools/testing/selftests/net/tfo_passive.sh
+@@ -95,7 +95,7 @@ wait
+ res=$(cat $out_file)
+ rm $out_file
+ 
+-if [ $res -eq 0 ]; then
++if [ "$res" = "0" ]; then
+ 	echo "got invalid NAPI ID from passive TFO socket"
+ 	cleanup_ns
+ 	exit 1
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-6.17/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..6fa5d2f838
--- /dev/null
+++ b/queue-6.17/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From 2673047b2eacb6725691e40386085355a259ef1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index f0fb114764b24..cf535c23a959a 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -424,6 +424,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-devmem-add-correct-the-ipv6-suppor.patch b/queue-6.17/selftests-drv-net-devmem-add-correct-the-ipv6-suppor.patch
new file mode 100644
index 0000000000..0aaffab971
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-devmem-add-correct-the-ipv6-suppor.patch
@@ -0,0 +1,37 @@
+From a8a64c395dc1f2d1b372ea87ad77512b5d41ae49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 16:13:32 -0700
+Subject: selftests: drv-net: devmem: add / correct the IPv6 support
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 424e96de30230aac2061f941961be645cf0070d5 ]
+
+We need to use bracketed IPv6 addresses for socat.
+
+Reviewed-by: Joe Damato <joe@dama.to>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250811231334.561137-4-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/devmem.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/devmem.py b/tools/testing/selftests/drivers/net/hw/devmem.py
+index baa2f24240ba5..0a2533a3d6d60 100755
+--- a/tools/testing/selftests/drivers/net/hw/devmem.py
++++ b/tools/testing/selftests/drivers/net/hw/devmem.py
+@@ -24,7 +24,7 @@ def check_rx(cfg) -> None:
+     require_devmem(cfg)
+ 
+     port = rand_port()
+-    socat = f"socat -u - TCP{cfg.addr_ipver}:{cfg.addr}:{port},bind={cfg.remote_addr}:{port}"
++    socat = f"socat -u - TCP{cfg.addr_ipver}:{cfg.baddr}:{port},bind={cfg.remote_baddr}:{port}"
+     listen_cmd = f"{cfg.bin_local} -l -f {cfg.ifname} -s {cfg.addr} -p {port} -c {cfg.remote_addr} -v 7"
+ 
+     with bkg(listen_cmd, exit_wait=True) as ncdevmem:
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-devmem-flip-the-direction-of-tx-te.patch b/queue-6.17/selftests-drv-net-devmem-flip-the-direction-of-tx-te.patch
new file mode 100644
index 0000000000..c5f2517ccb
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-devmem-flip-the-direction-of-tx-te.patch
@@ -0,0 +1,59 @@
+From b934ad8019805c9481456119ab64de97ca7c5024 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 16:13:34 -0700
+Subject: selftests: drv-net: devmem: flip the direction of Tx tests
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit c378c497f3fe8dc8f08b487fce49c3d96e4cada8 ]
+
+The Device Under Test should always be the local system.
+While the Rx test gets this right the Tx test is sending
+from remote to local. So Tx of DMABUF memory happens on remote.
+
+These tests never run in NIPA since we don't have a compatible
+device so we haven't caught this.
+
+Reviewed-by: Joe Damato <joe@dama.to>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://patch.msgid.link/20250811231334.561137-6-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/devmem.py | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/devmem.py b/tools/testing/selftests/drivers/net/hw/devmem.py
+index 0a2533a3d6d60..45c2d49d55b61 100755
+--- a/tools/testing/selftests/drivers/net/hw/devmem.py
++++ b/tools/testing/selftests/drivers/net/hw/devmem.py
+@@ -42,9 +42,9 @@ def check_tx(cfg) -> None:
+     port = rand_port()
+     listen_cmd = f"socat -U - TCP{cfg.addr_ipver}-LISTEN:{port}"
+ 
+-    with bkg(listen_cmd) as socat:
+-        wait_port_listen(port)
+-        cmd(f"echo -e \"hello\\nworld\"| {cfg.bin_remote} -f {cfg.ifname} -s {cfg.addr} -p {port}", host=cfg.remote, shell=True)
++    with bkg(listen_cmd, host=cfg.remote, exit_wait=True) as socat:
++        wait_port_listen(port, host=cfg.remote)
++        cmd(f"echo -e \"hello\\nworld\"| {cfg.bin_local} -f {cfg.ifname} -s {cfg.remote_addr} -p {port}", shell=True)
+ 
+     ksft_eq(socat.stdout.strip(), "hello\nworld")
+ 
+@@ -56,9 +56,9 @@ def check_tx_chunks(cfg) -> None:
+     port = rand_port()
+     listen_cmd = f"socat -U - TCP{cfg.addr_ipver}-LISTEN:{port}"
+ 
+-    with bkg(listen_cmd, exit_wait=True) as socat:
+-        wait_port_listen(port)
+-        cmd(f"echo -e \"hello\\nworld\"| {cfg.bin_remote} -f {cfg.ifname} -s {cfg.addr} -p {port} -z 3", host=cfg.remote, shell=True)
++    with bkg(listen_cmd, host=cfg.remote, exit_wait=True) as socat:
++        wait_port_listen(port, host=cfg.remote)
++        cmd(f"echo -e \"hello\\nworld\"| {cfg.bin_local} -f {cfg.ifname} -s {cfg.remote_addr} -p {port} -z 3", shell=True)
+ 
+     ksft_eq(socat.stdout.strip(), "hello\nworld")
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-hds-restore-hds-settings.patch b/queue-6.17/selftests-drv-net-hds-restore-hds-settings.patch
new file mode 100644
index 0000000000..8ab379645c
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-hds-restore-hds-settings.patch
@@ -0,0 +1,123 @@
+From 1071ecd4a52dba2bcc58267bc33242cb61f18c91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 10:59:39 -0700
+Subject: selftests: drv-net: hds: restore hds settings
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit ee3ae27721fb994ac0b4705b5806ce68a5a74c73 ]
+
+The test currently modifies the HDS settings and doesn't restore them.
+This may cause subsequent tests to fail (or pass when they should not).
+Add defer()ed reset handling.
+
+Link: https://patch.msgid.link/20250825175939.2249165-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hds.py | 39 ++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/tools/testing/selftests/drivers/net/hds.py b/tools/testing/selftests/drivers/net/hds.py
+index 7c90a040ce45a..a2011474e6255 100755
+--- a/tools/testing/selftests/drivers/net/hds.py
++++ b/tools/testing/selftests/drivers/net/hds.py
+@@ -3,6 +3,7 @@
+ 
+ import errno
+ import os
++from typing import Union
+ from lib.py import ksft_run, ksft_exit, ksft_eq, ksft_raises, KsftSkipEx
+ from lib.py import CmdExitFailure, EthtoolFamily, NlError
+ from lib.py import NetDrvEnv
+@@ -58,7 +59,39 @@ def get_hds_thresh(cfg, netnl) -> None:
+     if 'hds-thresh' not in rings:
+         raise KsftSkipEx('hds-thresh not supported by device')
+ 
++
++def _hds_reset(cfg, netnl, rings) -> None:
++    cur = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
++
++    arg = {'header': {'dev-index': cfg.ifindex}}
++    if cur.get('tcp-data-split') != rings.get('tcp-data-split'):
++        # Try to reset to "unknown" first, we don't know if the setting
++        # was the default or user chose it. Default seems more likely.
++        arg['tcp-data-split'] = "unknown"
++        netnl.rings_set(arg)
++        cur = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
++        if cur['tcp-data-split'] == rings['tcp-data-split']:
++            del arg['tcp-data-split']
++        else:
++            # Try the explicit setting
++            arg['tcp-data-split'] = rings['tcp-data-split']
++    if cur.get('hds-thresh') != rings.get('hds-thresh'):
++        arg['hds-thresh'] = rings['hds-thresh']
++    if len(arg) > 1:
++        netnl.rings_set(arg)
++
++
++def _defer_reset_hds(cfg, netnl) -> Union[dict, None]:
++    try:
++        rings = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
++        if 'hds-thresh' in rings or 'tcp-data-split' in rings:
++            defer(_hds_reset, cfg, netnl, rings)
++    except NlError as e:
++        pass
++
++
+ def set_hds_enable(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         netnl.rings_set({'header': {'dev-index': cfg.ifindex}, 'tcp-data-split': 'enabled'})
+     except NlError as e:
+@@ -76,6 +109,7 @@ def set_hds_enable(cfg, netnl) -> None:
+     ksft_eq('enabled', rings['tcp-data-split'])
+ 
+ def set_hds_disable(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         netnl.rings_set({'header': {'dev-index': cfg.ifindex}, 'tcp-data-split': 'disabled'})
+     except NlError as e:
+@@ -93,6 +127,7 @@ def set_hds_disable(cfg, netnl) -> None:
+     ksft_eq('disabled', rings['tcp-data-split'])
+ 
+ def set_hds_thresh_zero(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         netnl.rings_set({'header': {'dev-index': cfg.ifindex}, 'hds-thresh': 0})
+     except NlError as e:
+@@ -110,6 +145,7 @@ def set_hds_thresh_zero(cfg, netnl) -> None:
+     ksft_eq(0, rings['hds-thresh'])
+ 
+ def set_hds_thresh_random(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         rings = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
+     except NlError as e:
+@@ -140,6 +176,7 @@ def set_hds_thresh_random(cfg, netnl) -> None:
+     ksft_eq(hds_thresh, rings['hds-thresh'])
+ 
+ def set_hds_thresh_max(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         rings = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
+     except NlError as e:
+@@ -157,6 +194,7 @@ def set_hds_thresh_max(cfg, netnl) -> None:
+     ksft_eq(rings['hds-thresh'], rings['hds-thresh-max'])
+ 
+ def set_hds_thresh_gt(cfg, netnl) -> None:
++    _defer_reset_hds(cfg, netnl)
+     try:
+         rings = netnl.rings_get({'header': {'dev-index': cfg.ifindex}})
+     except NlError as e:
+@@ -178,6 +216,7 @@ def set_xdp(cfg, netnl) -> None:
+     """
+     mode = _get_hds_mode(cfg, netnl)
+     if mode == 'enabled':
++        _defer_reset_hds(cfg, netnl)
+         netnl.rings_set({'header': {'dev-index': cfg.ifindex},
+                          'tcp-data-split': 'unknown'})
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch b/queue-6.17/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
new file mode 100644
index 0000000000..6ac5cc26cf
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
@@ -0,0 +1,47 @@
+From f7cc0947c92564f34a045070199931d746c1dc15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:35:58 -0700
+Subject: selftests: drv-net: rss_ctx: fix the queue count check
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit c158b5a570a188b990ef10ded172b8b93e737826 ]
+
+Commit 0d6ccfe6b319 ("selftests: drv-net: rss_ctx: check for all-zero keys")
+added a skip exception if NIC has fewer than 3 queues enabled,
+but it's just constructing the object, it's not actually rising
+this exception.
+
+Before:
+
+  # Exception| net.lib.py.utils.CmdExitFailure: Command failed: ethtool -X enp1s0 equal 3 hkey d1:cc:77:47:9d:ea:15:f2:b9:6c:ef:68:62:c0:45:d5:b0:99:7d:cf:29:53:40:06:3d:8e:b9:bc:d4:70:89:b8:8d:59:04:ea:a9:c2:21:b3:55:b8:ab:6b:d9:48:b4:bd:4c:ff:a5:f0:a8:c2
+  not ok 1 rss_ctx.test_rss_key_indir
+
+After:
+
+  ok 1 rss_ctx.test_rss_key_indir # SKIP Device has fewer than 3 queues (or doesn't support queue stats)
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250827173558.3259072-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/rss_ctx.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/rss_ctx.py b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+index 7bb552f8b1826..9838b8457e5a6 100755
+--- a/tools/testing/selftests/drivers/net/hw/rss_ctx.py
++++ b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+@@ -118,7 +118,7 @@ def test_rss_key_indir(cfg):
+ 
+     qcnt = len(_get_rx_cnts(cfg))
+     if qcnt < 3:
+-        KsftSkipEx("Device has fewer than 3 queues (or doesn't support queue stats)")
++        raise KsftSkipEx("Device has fewer than 3 queues (or doesn't support queue stats)")
+ 
+     data = get_rss(cfg)
+     want_keys = ['rss-hash-key', 'rss-hash-function', 'rss-indirection-table']
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch b/queue-6.17/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
new file mode 100644
index 0000000000..e93efadd5a
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
@@ -0,0 +1,45 @@
+From 4d406fd09e17c92ac955f2de9fb781e85da5cd9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 10:31:39 -0700
+Subject: selftests: drv-net: rss_ctx: make the test pass with few queues
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit e2cf2d5baa09248d3d50b73522594b778388e3bc ]
+
+rss_ctx.test_rss_key_indir implicitly expects at least 5 queues,
+as it checks that the traffic on first 2 queues is lower than
+the remaining queues when we use all queues. Special case fewer
+queues.
+
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250901173139.881070-2-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/rss_ctx.py | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/rss_ctx.py b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+index 9838b8457e5a6..4206212d03a65 100755
+--- a/tools/testing/selftests/drivers/net/hw/rss_ctx.py
++++ b/tools/testing/selftests/drivers/net/hw/rss_ctx.py
+@@ -178,8 +178,13 @@ def test_rss_key_indir(cfg):
+     cnts = _get_rx_cnts(cfg)
+     GenerateTraffic(cfg).wait_pkts_and_stop(20000)
+     cnts = _get_rx_cnts(cfg, prev=cnts)
+-    # First two queues get less traffic than all the rest
+-    ksft_lt(sum(cnts[:2]), sum(cnts[2:]), "traffic distributed: " + str(cnts))
++    if qcnt > 4:
++        # First two queues get less traffic than all the rest
++        ksft_lt(sum(cnts[:2]), sum(cnts[2:]),
++                "traffic distributed: " + str(cnts))
++    else:
++        # When queue count is low make sure third queue got significant pkts
++        ksft_ge(cnts[2], 3500, "traffic distributed: " + str(cnts))
+ 
+ 
+ def test_rss_queue_reconfigure(cfg, main_ctx=True):
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-drv-net-wait-for-carrier.patch b/queue-6.17/selftests-drv-net-wait-for-carrier.patch
new file mode 100644
index 0000000000..653e92885f
--- /dev/null
+++ b/queue-6.17/selftests-drv-net-wait-for-carrier.patch
@@ -0,0 +1,151 @@
+From a32749eaeba7f7d91d38a4b2a2c7474f8971d6b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 07:20:54 -0700
+Subject: selftests: drv-net: wait for carrier
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f09fc24dd9a5ec989dfdde7090624924ede6ddc7 ]
+
+On fast machines the tests run in quick succession so even
+when tests clean up after themselves the carrier may need
+some time to come back.
+
+Specifically in NIPA when ping.py runs right after netpoll_basic.py
+the first ping command fails.
+
+Since the context manager callbacks are now common NetDrvEpEnv
+gets an ip link up call as well.
+
+Reviewed-by: Joe Damato <joe@dama.to>
+Link: https://patch.msgid.link/20250812142054.750282-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/drivers/net/lib/py/__init__.py  |  2 +-
+ .../selftests/drivers/net/lib/py/env.py       | 41 +++++++++----------
+ tools/testing/selftests/net/lib/py/utils.py   | 18 ++++++++
+ 3 files changed, 39 insertions(+), 22 deletions(-)
+
+diff --git a/tools/testing/selftests/drivers/net/lib/py/__init__.py b/tools/testing/selftests/drivers/net/lib/py/__init__.py
+index 8711c67ad658a..a07b56a75c8a6 100644
+--- a/tools/testing/selftests/drivers/net/lib/py/__init__.py
++++ b/tools/testing/selftests/drivers/net/lib/py/__init__.py
+@@ -15,7 +15,7 @@ try:
+         NlError, RtnlFamily, DevlinkFamily
+     from net.lib.py import CmdExitFailure
+     from net.lib.py import bkg, cmd, bpftool, bpftrace, defer, ethtool, \
+-        fd_read_timeout, ip, rand_port, tool, wait_port_listen
++        fd_read_timeout, ip, rand_port, tool, wait_port_listen, wait_file
+     from net.lib.py import fd_read_timeout
+     from net.lib.py import KsftSkipEx, KsftFailEx, KsftXfailEx
+     from net.lib.py import ksft_disruptive, ksft_exit, ksft_pr, ksft_run, \
+diff --git a/tools/testing/selftests/drivers/net/lib/py/env.py b/tools/testing/selftests/drivers/net/lib/py/env.py
+index 1b8bd648048f7..c1f3b608c6d8f 100644
+--- a/tools/testing/selftests/drivers/net/lib/py/env.py
++++ b/tools/testing/selftests/drivers/net/lib/py/env.py
+@@ -4,7 +4,7 @@ import os
+ import time
+ from pathlib import Path
+ from lib.py import KsftSkipEx, KsftXfailEx
+-from lib.py import ksft_setup
++from lib.py import ksft_setup, wait_file
+ from lib.py import cmd, ethtool, ip, CmdExitFailure
+ from lib.py import NetNS, NetdevSimDev
+ from .remote import Remote
+@@ -25,6 +25,9 @@ class NetDrvEnvBase:
+ 
+         self.env = self._load_env_file()
+ 
++        # Following attrs must be set be inheriting classes
++        self.dev = None
++
+     def _load_env_file(self):
+         env = os.environ.copy()
+ 
+@@ -48,6 +51,22 @@ class NetDrvEnvBase:
+                 env[pair[0]] = pair[1]
+         return ksft_setup(env)
+ 
++    def __del__(self):
++        pass
++
++    def __enter__(self):
++        ip(f"link set dev {self.dev['ifname']} up")
++        wait_file(f"/sys/class/net/{self.dev['ifname']}/carrier",
++                  lambda x: x.strip() == "1")
++
++        return self
++
++    def __exit__(self, ex_type, ex_value, ex_tb):
++        """
++        __exit__ gets called at the end of a "with" block.
++        """
++        self.__del__()
++
+ 
+ class NetDrvEnv(NetDrvEnvBase):
+     """
+@@ -72,17 +91,6 @@ class NetDrvEnv(NetDrvEnvBase):
+         self.ifname = self.dev['ifname']
+         self.ifindex = self.dev['ifindex']
+ 
+-    def __enter__(self):
+-        ip(f"link set dev {self.dev['ifname']} up")
+-
+-        return self
+-
+-    def __exit__(self, ex_type, ex_value, ex_tb):
+-        """
+-        __exit__ gets called at the end of a "with" block.
+-        """
+-        self.__del__()
+-
+     def __del__(self):
+         if self._ns:
+             self._ns.remove()
+@@ -219,15 +227,6 @@ class NetDrvEpEnv(NetDrvEnvBase):
+             raise Exception("Can't resolve remote interface name, multiple interfaces match")
+         return v6[0]["ifname"] if v6 else v4[0]["ifname"]
+ 
+-    def __enter__(self):
+-        return self
+-
+-    def __exit__(self, ex_type, ex_value, ex_tb):
+-        """
+-        __exit__ gets called at the end of a "with" block.
+-        """
+-        self.__del__()
+-
+     def __del__(self):
+         if self._ns:
+             self._ns.remove()
+diff --git a/tools/testing/selftests/net/lib/py/utils.py b/tools/testing/selftests/net/lib/py/utils.py
+index f395c90fb0f19..c42bffea0d879 100644
+--- a/tools/testing/selftests/net/lib/py/utils.py
++++ b/tools/testing/selftests/net/lib/py/utils.py
+@@ -249,3 +249,21 @@ def wait_port_listen(port, proto="tcp", ns=None, host=None, sleep=0.005, deadlin
+         if time.monotonic() > end:
+             raise Exception("Waiting for port listen timed out")
+         time.sleep(sleep)
++
++
++def wait_file(fname, test_fn, sleep=0.005, deadline=5, encoding='utf-8'):
++    """
++    Wait for file contents on the local system to satisfy a condition.
++    test_fn() should take one argument (file contents) and return whether
++    condition is met.
++    """
++    end = time.monotonic() + deadline
++
++    with open(fname, "r", encoding=encoding) as fp:
++        while True:
++            if test_fn(fp.read()):
++                break
++            fp.seek(0)
++            if time.monotonic() > end:
++                raise TimeoutError("Wait for file contents failed", fname)
++            time.sleep(sleep)
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch b/queue-6.17/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
new file mode 100644
index 0000000000..f7e37b8ff5
--- /dev/null
+++ b/queue-6.17/selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
@@ -0,0 +1,171 @@
+From d8641449122a709a1ae852f99cb0399caf4f3a81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Sep 2025 13:35:33 +0800
+Subject: selftests: forwarding: Reorder (ar)ping arguments to obey POSIX
+ getopt
+
+From: David Yang <mmyangfl@gmail.com>
+
+[ Upstream commit 50d51cef555ee42fe47dd51b71366a77895e5f0b ]
+
+Quoted from musl wiki:
+
+  GNU getopt permutes argv to pull options to the front, ahead of
+  non-option arguments. musl and the POSIX standard getopt stop
+  processing options at the first non-option argument with no
+  permutation.
+
+Thus these scripts stop working on musl since non-option arguments for
+tools using getopt() (in this case, (ar)ping) do not always come last.
+Fix it by reordering arguments.
+
+Signed-off-by: David Yang <mmyangfl@gmail.com>
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250919053538.1106753-1-mmyangfl@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/custom_multipath_hash.sh     | 2 +-
+ .../selftests/net/forwarding/gre_custom_multipath_hash.sh | 2 +-
+ .../selftests/net/forwarding/ip6_forward_instats_vrf.sh   | 6 +++---
+ .../net/forwarding/ip6gre_custom_multipath_hash.sh        | 2 +-
+ tools/testing/selftests/net/forwarding/lib.sh             | 8 ++++----
+ .../selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh  | 2 +-
+ .../selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh | 4 ++--
+ 7 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
+index 7d531f7091e6f..5dbfab0e23e3d 100755
+--- a/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/custom_multipath_hash.sh
+@@ -226,7 +226,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:4::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:4::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
+index dda11a4a9450a..b4f17a5bbc614 100755
+--- a/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/gre_custom_multipath_hash.sh
+@@ -321,7 +321,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:2::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:2::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+index 49fa94b53a1ca..25036e38043c8 100755
+--- a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
++++ b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
+@@ -95,7 +95,7 @@ ipv6_in_too_big_err()
+ 
+ 	# Send too big packets
+ 	ip vrf exec $vrf_name \
+-		$PING6 -s 1300 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -s 1300 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
+ 	test "$((t1 - t0))" -ne 0
+@@ -131,7 +131,7 @@ ipv6_in_addr_err()
+ 	# Disable forwarding temporary while sending the packet
+ 	sysctl -qw net.ipv6.conf.all.forwarding=0
+ 	ip vrf exec $vrf_name \
+-		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 	sysctl -qw net.ipv6.conf.all.forwarding=1
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
+@@ -150,7 +150,7 @@ ipv6_in_discard()
+ 	# Add a policy to discard
+ 	ip xfrm policy add dst 2001:1:2::2/128 dir fwd action block
+ 	ip vrf exec $vrf_name \
+-		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
++		$PING6 -c 1 -w $PING_TIMEOUT 2001:1:2::2 &> /dev/null
+ 	ip xfrm policy del dst 2001:1:2::2/128 dir fwd
+ 
+ 	local t1=$(ipv6_stats_get $rtr1 Ip6InDiscards)
+diff --git a/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh b/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
+index e28b4a079e525..b24acfa52a3a7 100755
+--- a/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
++++ b/tools/testing/selftests/net/forwarding/ip6gre_custom_multipath_hash.sh
+@@ -323,7 +323,7 @@ send_flowlabel()
+ 	# Generate 16384 echo requests, each with a random flow label.
+ 	ip vrf exec v$h1 sh -c \
+ 		"for _ in {1..16384}; do \
+-			$PING6 2001:db8:2::2 -F 0 -c 1 -q >/dev/null 2>&1; \
++			$PING6 -F 0 -c 1 -q 2001:db8:2::2 >/dev/null 2>&1; \
+ 		done"
+ }
+ 
+diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
+index 890b3374dacda..593077cf05937 100644
+--- a/tools/testing/selftests/net/forwarding/lib.sh
++++ b/tools/testing/selftests/net/forwarding/lib.sh
+@@ -1291,8 +1291,8 @@ ping_do()
+ 
+ 	vrf_name=$(master_name_get $if_name)
+ 	ip vrf exec $vrf_name \
+-		$PING $args $dip -c $PING_COUNT -i 0.1 \
+-		-w $PING_TIMEOUT &> /dev/null
++		$PING $args -c $PING_COUNT -i 0.1 \
++		-w $PING_TIMEOUT $dip &> /dev/null
+ }
+ 
+ ping_test()
+@@ -1322,8 +1322,8 @@ ping6_do()
+ 
+ 	vrf_name=$(master_name_get $if_name)
+ 	ip vrf exec $vrf_name \
+-		$PING6 $args $dip -c $PING_COUNT -i 0.1 \
+-		-w $PING_TIMEOUT &> /dev/null
++		$PING6 $args -c $PING_COUNT -i 0.1 \
++		-w $PING_TIMEOUT $dip &> /dev/null
+ }
+ 
+ ping6_test()
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
+index a20d22d1df362..8d4ae6c952a1f 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q_lag.sh
+@@ -238,7 +238,7 @@ test_lag_slave()
+ 	ip neigh flush dev br1
+ 	setup_wait_dev $up_dev
+ 	setup_wait_dev $host_dev
+-	$ARPING -I br1 192.0.2.130 -qfc 1
++	$ARPING -I br1 -qfc 1 192.0.2.130
+ 	sleep 2
+ 	mirror_test vrf-h1 192.0.2.1 192.0.2.18 $host_dev 1 ">= 10"
+ 
+diff --git a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+index 1b902cc579f62..a21c771908b33 100755
+--- a/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
++++ b/tools/testing/selftests/net/forwarding/mirror_gre_vlan_bridge_1q.sh
+@@ -196,7 +196,7 @@ test_span_gre_forbidden_egress()
+ 
+ 	bridge vlan add dev $swp3 vid 555
+ 	# Re-prime FDB
+-	$ARPING -I br1.555 192.0.2.130 -fqc 1
++	$ARPING -I br1.555 -fqc 1 192.0.2.130
+ 	sleep 1
+ 	quick_test_span_gre_dir $tundev
+ 
+@@ -290,7 +290,7 @@ test_span_gre_fdb_roaming()
+ 
+ 	bridge fdb del dev $swp2 $h3mac vlan 555 master 2>/dev/null
+ 	# Re-prime FDB
+-	$ARPING -I br1.555 192.0.2.130 -fqc 1
++	$ARPING -I br1.555 -fqc 1 192.0.2.130
+ 	sleep 1
+ 	quick_test_span_gre_dir $tundev
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-6.17/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..c324ebb9c7
--- /dev/null
+++ b/queue-6.17/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From 8c8822a3599d9ce6c5e57c05f52ea037336d3cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 030da61dbff3a..a2d8e1093b005 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -314,7 +314,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-mptcp-join-allow-more-time-to-send-add_add.patch b/queue-6.17/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
new file mode 100644
index 0000000000..f05d661740
--- /dev/null
+++ b/queue-6.17/selftests-mptcp-join-allow-more-time-to-send-add_add.patch
@@ -0,0 +1,52 @@
+From 2d7a024e39433a812c602f4d58f63b5e001ca5de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 17:32:44 +0200
+Subject: selftests: mptcp: join: allow more time to send ADD_ADDR
+
+From: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+
+[ Upstream commit e2cda6343bfe459c3331db5afcd675ab333112dd ]
+
+When many ADD_ADDR need to be sent, it can take some time to send each
+of them, and create new subflows. Some CIs seem to occasionally have
+issues with these tests, especially with "debug" kernels.
+
+Two subtests will now run for a slightly longer time: the last two where
+3 or more ADD_ADDR are sent during the test.
+
+Reviewed-by: Geliang Tang <geliang@kernel.org>
+Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
+Link: https://patch.msgid.link/20250907-net-next-mptcp-add_addr-retrans-adapt-v1-3-824cc805772b@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+index 5579709c36533..725f1a00bbf19 100755
+--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
+@@ -2151,7 +2151,8 @@ signal_address_tests()
+ 		pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+ 		pm_nl_add_endpoint $ns1 10.0.4.1 flags signal
+ 		pm_nl_set_limits $ns2 3 3
+-		run_tests $ns1 $ns2 10.0.1.1
++		speed=slow \
++			run_tests $ns1 $ns2 10.0.1.1
+ 		chk_join_nr 3 3 3
+ 		chk_add_nr 3 3
+ 	fi
+@@ -2163,7 +2164,8 @@ signal_address_tests()
+ 		pm_nl_add_endpoint $ns1 10.0.3.1 flags signal
+ 		pm_nl_add_endpoint $ns1 10.0.14.1 flags signal
+ 		pm_nl_set_limits $ns2 3 3
+-		run_tests $ns1 $ns2 10.0.1.1
++		speed=slow \
++			run_tests $ns1 $ns2 10.0.1.1
+ 		join_syn_tx=3 \
+ 			chk_join_nr 1 1 1
+ 		chk_add_nr 3 3
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-ncdevmem-don-t-retry-efault.patch b/queue-6.17/selftests-ncdevmem-don-t-retry-efault.patch
new file mode 100644
index 0000000000..fb02e494d7
--- /dev/null
+++ b/queue-6.17/selftests-ncdevmem-don-t-retry-efault.patch
@@ -0,0 +1,50 @@
+From 17cdfbef0a7e4571531d53b8092dcd4c9b903bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 11:27:10 -0700
+Subject: selftests: ncdevmem: don't retry EFAULT
+
+From: Stanislav Fomichev <sdf@fomichev.me>
+
+[ Upstream commit 8c0b9ed2401b9b3f164c8c94221899a1ace6e9ab ]
+
+devmem test fails on NIPA. Most likely we get skb(s) with readable
+frags (why?) but the failure manifests as an OOM. The OOM happens
+because ncdevmem spams the following message:
+
+  recvmsg ret=-1
+  recvmsg: Bad address
+
+As of today, ncdevmem can't deal with various reasons of EFAULT:
+- falling back to regular recvmsg for non-devmem skbs
+- increasing ctrl_data size (can't happen with ncdevmem's large buffer)
+
+Exit (cleanly) with error when recvmsg returns EFAULT. This should at
+least cause the test to cleanup its state.
+
+Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250904182710.1586473-1-sdf@fomichev.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/drivers/net/hw/ncdevmem.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/drivers/net/hw/ncdevmem.c b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
+index 72f828021f832..147976e55dac2 100644
+--- a/tools/testing/selftests/drivers/net/hw/ncdevmem.c
++++ b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
+@@ -631,6 +631,10 @@ static int do_server(struct memory_buffer *mem)
+ 			continue;
+ 		if (ret < 0) {
+ 			perror("recvmsg");
++			if (errno == EFAULT) {
++				pr_err("received EFAULT, won't recover");
++				goto err_close_client;
++			}
+ 			continue;
+ 		}
+ 		if (ret == 0) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-6.17/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..80c63477a5
--- /dev/null
+++ b/queue-6.17/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From b89cfb22582d92281cf14a9960593e56dd69046b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 0dd909e325d93..2938045c5cf97 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-net-lib.sh-don-t-defer-failed-commands.patch b/queue-6.17/selftests-net-lib.sh-don-t-defer-failed-commands.patch
new file mode 100644
index 0000000000..ea7baca4bc
--- /dev/null
+++ b/queue-6.17/selftests-net-lib.sh-don-t-defer-failed-commands.patch
@@ -0,0 +1,117 @@
+From b665bcf68bb98827fe4bbd408944308720135c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 19:07:26 +0200
+Subject: selftests: net: lib.sh: Don't defer failed commands
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit fa57032941d4b451c7264ebf3ad595bc98e3a9a9 ]
+
+Usually the autodefer helpers in lib.sh are expected to be run in context
+where success is the expected outcome. However when using them for feature
+detection, failure can legitimately occur. But the failed command still
+schedules a cleanup, which will likely fail again.
+
+Instead, only schedule deferred cleanup when the positive command succeeds.
+
+This way of organizing the cleanup has the added benefit that now the
+return code from these functions reflects whether the command passed.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/af10a5bb82ea11ead978cf903550089e006d7e70.1757004393.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/lib.sh | 32 +++++++++++++++---------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/tools/testing/selftests/net/lib.sh b/tools/testing/selftests/net/lib.sh
+index c7add0dc4c605..80cf1a75136cf 100644
+--- a/tools/testing/selftests/net/lib.sh
++++ b/tools/testing/selftests/net/lib.sh
+@@ -547,8 +547,8 @@ ip_link_add()
+ {
+ 	local name=$1; shift
+ 
+-	ip link add name "$name" "$@"
+-	defer ip link del dev "$name"
++	ip link add name "$name" "$@" && \
++		defer ip link del dev "$name"
+ }
+ 
+ ip_link_set_master()
+@@ -556,8 +556,8 @@ ip_link_set_master()
+ 	local member=$1; shift
+ 	local master=$1; shift
+ 
+-	ip link set dev "$member" master "$master"
+-	defer ip link set dev "$member" nomaster
++	ip link set dev "$member" master "$master" && \
++		defer ip link set dev "$member" nomaster
+ }
+ 
+ ip_link_set_addr()
+@@ -566,8 +566,8 @@ ip_link_set_addr()
+ 	local addr=$1; shift
+ 
+ 	local old_addr=$(mac_get "$name")
+-	ip link set dev "$name" address "$addr"
+-	defer ip link set dev "$name" address "$old_addr"
++	ip link set dev "$name" address "$addr" && \
++		defer ip link set dev "$name" address "$old_addr"
+ }
+ 
+ ip_link_has_flag()
+@@ -590,8 +590,8 @@ ip_link_set_up()
+ 	local name=$1; shift
+ 
+ 	if ! ip_link_is_up "$name"; then
+-		ip link set dev "$name" up
+-		defer ip link set dev "$name" down
++		ip link set dev "$name" up && \
++			defer ip link set dev "$name" down
+ 	fi
+ }
+ 
+@@ -600,8 +600,8 @@ ip_link_set_down()
+ 	local name=$1; shift
+ 
+ 	if ip_link_is_up "$name"; then
+-		ip link set dev "$name" down
+-		defer ip link set dev "$name" up
++		ip link set dev "$name" down && \
++			defer ip link set dev "$name" up
+ 	fi
+ }
+ 
+@@ -609,20 +609,20 @@ ip_addr_add()
+ {
+ 	local name=$1; shift
+ 
+-	ip addr add dev "$name" "$@"
+-	defer ip addr del dev "$name" "$@"
++	ip addr add dev "$name" "$@" && \
++		defer ip addr del dev "$name" "$@"
+ }
+ 
+ ip_route_add()
+ {
+-	ip route add "$@"
+-	defer ip route del "$@"
++	ip route add "$@" && \
++		defer ip route del "$@"
+ }
+ 
+ bridge_vlan_add()
+ {
+-	bridge vlan add "$@"
+-	defer bridge vlan del "$@"
++	bridge vlan add "$@" && \
++		defer bridge vlan del "$@"
+ }
+ 
+ wait_local_port_listen()
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-net-make-the-dump-test-less-sensitive-to-m.patch b/queue-6.17/selftests-net-make-the-dump-test-less-sensitive-to-m.patch
new file mode 100644
index 0000000000..7285af8cad
--- /dev/null
+++ b/queue-6.17/selftests-net-make-the-dump-test-less-sensitive-to-m.patch
@@ -0,0 +1,129 @@
+From 171c0a6d365ae773d0efa94b75f54c3a81456bee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 14:13:50 -0700
+Subject: selftests: net: make the dump test less sensitive to mem accounting
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 27bc5eaf004c437309dee1b9af24806262631d57 ]
+
+Recent changes to make netlink socket memory accounting must
+have broken the implicit assumption of the netlink-dump test
+that we can fit exactly 64 dumps into the socket. Handle the
+failure mode properly, and increase the dump count to 80
+to make sure we still run into the error condition if
+the default buffer size increases in the future.
+
+Link: https://patch.msgid.link/20250906211351.3192412-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/netlink-dumps.c | 43 ++++++++++++++++-----
+ 1 file changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/netlink-dumps.c b/tools/testing/selftests/net/netlink-dumps.c
+index 07423f256f963..7618ebe528a4c 100644
+--- a/tools/testing/selftests/net/netlink-dumps.c
++++ b/tools/testing/selftests/net/netlink-dumps.c
+@@ -31,9 +31,18 @@ struct ext_ack {
+ 	const char *str;
+ };
+ 
+-/* 0: no done, 1: done found, 2: extack found, -1: error */
+-static int nl_get_extack(char *buf, size_t n, struct ext_ack *ea)
++enum get_ea_ret {
++	ERROR = -1,
++	NO_CTRL = 0,
++	FOUND_DONE,
++	FOUND_ERR,
++	FOUND_EXTACK,
++};
++
++static enum get_ea_ret
++nl_get_extack(char *buf, size_t n, struct ext_ack *ea)
+ {
++	enum get_ea_ret ret = NO_CTRL;
+ 	const struct nlmsghdr *nlh;
+ 	const struct nlattr *attr;
+ 	ssize_t rem;
+@@ -41,15 +50,19 @@ static int nl_get_extack(char *buf, size_t n, struct ext_ack *ea)
+ 	for (rem = n; rem > 0; NLMSG_NEXT(nlh, rem)) {
+ 		nlh = (struct nlmsghdr *)&buf[n - rem];
+ 		if (!NLMSG_OK(nlh, rem))
+-			return -1;
++			return ERROR;
+ 
+-		if (nlh->nlmsg_type != NLMSG_DONE)
++		if (nlh->nlmsg_type == NLMSG_ERROR)
++			ret = FOUND_ERR;
++		else if (nlh->nlmsg_type == NLMSG_DONE)
++			ret = FOUND_DONE;
++		else
+ 			continue;
+ 
+ 		ea->err = -*(int *)NLMSG_DATA(nlh);
+ 
+ 		if (!(nlh->nlmsg_flags & NLM_F_ACK_TLVS))
+-			return 1;
++			return ret;
+ 
+ 		ynl_attr_for_each(attr, nlh, sizeof(int)) {
+ 			switch (ynl_attr_type(attr)) {
+@@ -68,10 +81,10 @@ static int nl_get_extack(char *buf, size_t n, struct ext_ack *ea)
+ 			}
+ 		}
+ 
+-		return 2;
++		return FOUND_EXTACK;
+ 	}
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ static const struct {
+@@ -99,9 +112,9 @@ static const struct {
+ TEST(dump_extack)
+ {
+ 	int netlink_sock;
++	int i, cnt, ret;
+ 	char buf[8192];
+ 	int one = 1;
+-	int i, cnt;
+ 	ssize_t n;
+ 
+ 	netlink_sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+@@ -118,7 +131,7 @@ TEST(dump_extack)
+ 	ASSERT_EQ(n, 0);
+ 
+ 	/* Dump so many times we fill up the buffer */
+-	cnt = 64;
++	cnt = 80;
+ 	for (i = 0; i < cnt; i++) {
+ 		n = send(netlink_sock, &dump_neigh_bad,
+ 			 sizeof(dump_neigh_bad), 0);
+@@ -140,10 +153,20 @@ TEST(dump_extack)
+ 		}
+ 		ASSERT_GE(n, (ssize_t)sizeof(struct nlmsghdr));
+ 
+-		EXPECT_EQ(nl_get_extack(buf, n, &ea), 2);
++		ret = nl_get_extack(buf, n, &ea);
++		/* Once we fill the buffer we'll see one ENOBUFS followed
++		 * by a number of EBUSYs. Then the last recv() will finally
++		 * trigger and complete the dump.
++		 */
++		if (ret == FOUND_ERR && (ea.err == ENOBUFS || ea.err == EBUSY))
++			continue;
++		EXPECT_EQ(ret, FOUND_EXTACK);
++		EXPECT_EQ(ea.err, EINVAL);
+ 		EXPECT_EQ(ea.attr_offs,
+ 			  sizeof(struct nlmsghdr) + sizeof(struct ndmsg));
+ 	}
++	/* Make sure last message was a full DONE+extack */
++	EXPECT_EQ(ret, FOUND_EXTACK);
+ }
+ 
+ static const struct {
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-6.17/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..bbc4ba04ca
--- /dev/null
+++ b/queue-6.17/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From e207117cc3bf694f1d266bfe42226eb8e2b3dc6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 221270cee3eaa..0dd909e325d93 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch b/queue-6.17/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
new file mode 100644
index 0000000000..e1f0c936b8
--- /dev/null
+++ b/queue-6.17/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
@@ -0,0 +1,1849 @@
+From e3dd105eb211864df5479efa98cc664e82c4e2f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:38:37 -0700
+Subject: selftests: net: replace sleeps in fcnal-test with waits
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
+
+fcnal-test.sh already includes lib.sh, use relevant helpers
+instead of sleeping. Replace sleep after starting nettest
+as a server with wait_local_port_listen.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++-----------
+ 1 file changed, 214 insertions(+), 214 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 4fcc38907e48e..f0fb114764b24 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -875,7 +875,7 @@ ipv4_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -883,7 +883,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -891,7 +891,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -899,7 +899,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -910,7 +910,7 @@ ipv4_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -918,7 +918,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -926,7 +926,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -943,7 +943,7 @@ ipv4_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -951,7 +951,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -959,7 +959,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -967,7 +967,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -978,7 +978,7 @@ ipv4_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -986,7 +986,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -994,7 +994,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -1005,14 +1005,14 @@ ipv4_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1020,7 +1020,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1028,21 +1028,21 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1050,7 +1050,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1058,7 +1058,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -1082,14 +1082,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
+ 	log_start
+ 	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
+ 
+ 	log_start
+ 	show_hint "Binding both the socket and the key is not required but it works"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
+ }
+@@ -1103,25 +1103,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0()
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
+ 	log_start
+ 
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
+ 
+@@ -1193,7 +1193,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -1201,7 +1201,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1221,13 +1221,13 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1249,7 +1249,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1257,7 +1257,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1266,7 +1266,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1274,7 +1274,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -1283,7 +1283,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -1291,7 +1291,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 
+@@ -1323,19 +1323,19 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1352,7 +1352,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -1374,14 +1374,14 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -1396,7 +1396,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "client socket should be bound to device"
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1406,7 +1406,7 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since client is not bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -1418,13 +1418,13 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1443,7 +1443,7 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -1451,26 +1451,26 @@ ipv4_tcp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+ 	log_start
+ 	show_hint "Should fail 'No route to host' since client is out of VRF scope"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ }
+@@ -1509,7 +1509,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -1522,7 +1522,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1533,31 +1533,31 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
+ 
+@@ -1580,7 +1580,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1588,7 +1588,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1597,7 +1597,7 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1605,25 +1605,25 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1636,28 +1636,28 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 2 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1667,7 +1667,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -1709,19 +1709,19 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Fails because ingress is in a VRF and global server is disabled"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1733,7 +1733,7 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is out of scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
+ 	done
+@@ -1741,26 +1741,26 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
+ 
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1775,19 +1775,19 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1802,13 +1802,13 @@ ipv4_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "VRF client"
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -1829,31 +1829,31 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1861,7 +1861,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 	done
+@@ -1870,7 +1870,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -2093,7 +2093,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2107,7 +2107,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2120,7 +2120,7 @@ ipv4_rt()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest ${varg} -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest ${varg} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2134,7 +2134,7 @@ ipv4_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2145,7 +2145,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2161,7 +2161,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2175,7 +2175,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2189,7 +2189,7 @@ ipv4_rt()
+ 	log_start
+ 
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2200,7 +2200,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2211,7 +2211,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2561,7 +2561,7 @@ ipv6_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -2569,7 +2569,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -2577,7 +2577,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -2585,7 +2585,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -2596,7 +2596,7 @@ ipv6_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -2604,7 +2604,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -2612,7 +2612,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -2629,7 +2629,7 @@ ipv6_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -2637,7 +2637,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -2645,7 +2645,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -2653,7 +2653,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -2664,7 +2664,7 @@ ipv6_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -2672,7 +2672,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -2680,7 +2680,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -2691,14 +2691,14 @@ ipv6_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2706,7 +2706,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2714,21 +2714,21 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2736,7 +2736,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2744,7 +2744,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -2772,7 +2772,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2793,7 +2793,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Client"
+ 	done
+@@ -2802,7 +2802,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -2822,7 +2822,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -2830,7 +2830,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -2839,7 +2839,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -2847,7 +2847,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -2856,7 +2856,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -2865,7 +2865,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 	done
+@@ -2898,7 +2898,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -2907,7 +2907,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2916,7 +2916,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2924,7 +2924,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -2943,7 +2943,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -2964,7 +2964,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2973,7 +2973,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2982,13 +2982,13 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2996,7 +2996,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3016,7 +3016,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Fails 'Connection refused' since client is not in VRF"
+ 		run_cmd nettest -6 -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -3029,7 +3029,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 	done
+@@ -3038,7 +3038,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Fails since VRF device does not allow linklocal addresses"
+ 	run_cmd_nsb nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF}
+ 	log_test_addr ${a} $? 1 "Client, VRF bind"
+ 
+@@ -3046,7 +3046,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -3071,7 +3071,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -3079,7 +3079,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+@@ -3087,13 +3087,13 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail since unbound client is out of VRF scope"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+@@ -3101,7 +3101,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 	done
+@@ -3141,13 +3141,13 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3155,7 +3155,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_LO_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -3165,7 +3165,7 @@ ipv6_udp_novrf()
+ 	#log_start
+ 	#show_hint "Should fail since loopback address is out of scope"
+ 	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	#sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	#run_cmd_nsb nettest -6 -D -r ${a}
+ 	#log_test_addr ${a} $? 1 "Device server"
+ 
+@@ -3185,25 +3185,25 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
+ 
+@@ -3225,7 +3225,7 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -3233,7 +3233,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -3242,7 +3242,7 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -6 -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, local connection"
+ 	done
+@@ -3250,19 +3250,19 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
+ 
+@@ -3271,28 +3271,28 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 	done
+@@ -3300,7 +3300,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3314,7 +3314,7 @@ ipv6_udp_novrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3338,7 +3338,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -3347,7 +3347,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3356,7 +3356,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3378,7 +3378,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
+ 	done
+@@ -3387,7 +3387,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -3396,25 +3396,25 @@ ipv6_udp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server is disabled"
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 1 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -3429,7 +3429,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -3438,7 +3438,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3447,7 +3447,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3465,7 +3465,7 @@ ipv6_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
+ 	log_test $? 0 "VRF client"
+ 
+@@ -3476,7 +3476,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -3491,13 +3491,13 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	#log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3505,13 +3505,13 @@ ipv6_udp_vrf()
+ 	a=${VRF_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3527,25 +3527,25 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3557,7 +3557,7 @@ ipv6_udp_vrf()
+ 	# link local addresses
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Global server, linklocal IP"
+ 
+@@ -3568,7 +3568,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, linklocal IP"
+ 
+@@ -3579,7 +3579,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, local conn - linklocal IP"
+ 
+@@ -3592,7 +3592,7 @@ ipv6_udp_vrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3771,7 +3771,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3785,7 +3785,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3799,7 +3799,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3814,7 +3814,7 @@ ipv6_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3825,7 +3825,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3842,7 +3842,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3856,7 +3856,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3869,7 +3869,7 @@ ipv6_rt()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3880,7 +3880,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3891,7 +3891,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3950,7 +3950,7 @@ netfilter_tcp_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -3968,7 +3968,7 @@ netfilter_icmp()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${arg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4007,7 +4007,7 @@ netfilter_tcp6_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -4025,7 +4025,7 @@ netfilter_icmp6()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s ${arg} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4221,12 +4221,12 @@ use_case_snat_on_vrf()
+ 	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
+ 
+ 	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
+ 	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
+ 
+ 	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
+ 	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-pci_endpoint-skip-irq-test-if-irq-is-out-o.patch b/queue-6.17/selftests-pci_endpoint-skip-irq-test-if-irq-is-out-o.patch
new file mode 100644
index 0000000000..aa2cdb56e0
--- /dev/null
+++ b/queue-6.17/selftests-pci_endpoint-skip-irq-test-if-irq-is-out-o.patch
@@ -0,0 +1,48 @@
+From fe4898983be32ae4977962fe6a4c9095aa8fffb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 19:09:16 +0200
+Subject: selftests: pci_endpoint: Skip IRQ test if IRQ is out of range.
+
+From: Christian Bruel <christian.bruel@foss.st.com>
+
+[ Upstream commit 106fc08b30a2ece49a251b053165a83d41d50fd0 ]
+
+The pci_endpoint_test tests the entire MSI/MSI-X range, which generates
+false errors on platforms that do not support the whole range.
+
+Skip the test in such cases and report accordingly.
+
+Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
+[mani: reworded description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/20250804170916.3212221-4-christian.bruel@foss.st.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/pci_endpoint/pci_endpoint_test.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/pci_endpoint/pci_endpoint_test.c b/tools/testing/selftests/pci_endpoint/pci_endpoint_test.c
+index da0db0e7c9693..cd9075444c32a 100644
+--- a/tools/testing/selftests/pci_endpoint/pci_endpoint_test.c
++++ b/tools/testing/selftests/pci_endpoint/pci_endpoint_test.c
+@@ -121,6 +121,8 @@ TEST_F(pci_ep_basic, MSI_TEST)
+ 
+ 	for (i = 1; i <= 32; i++) {
+ 		pci_ep_ioctl(PCITEST_MSI, i);
++		if (ret == -EINVAL)
++			SKIP(return, "MSI%d is disabled", i);
+ 		EXPECT_FALSE(ret) TH_LOG("Test failed for MSI%d", i);
+ 	}
+ }
+@@ -137,6 +139,8 @@ TEST_F(pci_ep_basic, MSIX_TEST)
+ 
+ 	for (i = 1; i <= 2048; i++) {
+ 		pci_ep_ioctl(PCITEST_MSIX, i);
++		if (ret == -EINVAL)
++			SKIP(return, "MSI-X%d is disabled", i);
+ 		EXPECT_FALSE(ret) TH_LOG("Test failed for MSI-X%d", i);
+ 	}
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-replace-sleep-with-slowwait.patch b/queue-6.17/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..0810e8a255
--- /dev/null
+++ b/queue-6.17/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From 4dd3f1a56c3313b57be28fd4782a51cf42808e61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index cf535c23a959a..dfd368371fb3c 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -189,7 +189,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ set_ping_group()
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-traceroute-return-correct-value-on-failure.patch b/queue-6.17/selftests-traceroute-return-correct-value-on-failure.patch
new file mode 100644
index 0000000000..be1d7f349c
--- /dev/null
+++ b/queue-6.17/selftests-traceroute-return-correct-value-on-failure.patch
@@ -0,0 +1,124 @@
+From a07d2bba7de4a53b46f52a48abe57244f0e1fcd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:34 +0300
+Subject: selftests: traceroute: Return correct value on failure
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit c068ba9d3ded56cb1ba4d5135ee84bf8039bd563 ]
+
+The test always returns success even if some tests were modified to
+fail. Fix by converting the test to use the appropriate library
+functions instead of using its own functions.
+
+Before:
+
+ # ./traceroute.sh
+ TEST: IPV6 traceroute                                               [FAIL]
+ TEST: IPV4 traceroute                                               [ OK ]
+
+ Tests passed:   1
+ Tests failed:   1
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: IPv6 traceroute                                               [FAIL]
+         traceroute6 did not return 2000:102::2
+ TEST: IPv4 traceroute                                               [ OK ]
+ $ echo $?
+ 1
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-5-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 38 ++++++-----------------
+ 1 file changed, 9 insertions(+), 29 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index b50e52afa4f49..1ac91eebd16f5 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -10,28 +10,6 @@ PAUSE_ON_FAIL=no
+ 
+ ################################################################################
+ #
+-log_test()
+-{
+-	local rc=$1
+-	local expected=$2
+-	local msg="$3"
+-
+-	if [ ${rc} -eq ${expected} ]; then
+-		printf "TEST: %-60s  [ OK ]\n" "${msg}"
+-		nsuccess=$((nsuccess+1))
+-	else
+-		ret=1
+-		nfail=$((nfail+1))
+-		printf "TEST: %-60s  [FAIL]\n" "${msg}"
+-		if [ "${PAUSE_ON_FAIL}" = "yes" ]; then
+-			echo
+-			echo "hit enter to continue, 'q' to quit"
+-			read a
+-			[ "$a" = "q" ] && exit 1
+-		fi
+-	fi
+-}
+-
+ run_cmd()
+ {
+ 	local ns
+@@ -205,9 +183,12 @@ run_traceroute6()
+ {
+ 	setup_traceroute6
+ 
++	RET=0
++
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+ 	run_cmd $h1 "traceroute6 2000:103::4 | grep -q 2000:102::2"
+-	log_test $? 0 "IPV6 traceroute"
++	check_err $? "traceroute6 did not return 2000:102::2"
++	log_test "IPv6 traceroute"
+ 
+ 	cleanup_traceroute6
+ }
+@@ -265,9 +246,12 @@ run_traceroute()
+ {
+ 	setup_traceroute
+ 
++	RET=0
++
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+ 	run_cmd $h1 "traceroute 1.0.2.4 | grep -q 1.0.1.1"
+-	log_test $? 0 "IPV4 traceroute"
++	check_err $? "traceroute did not return 1.0.1.1"
++	log_test "IPv4 traceroute"
+ 
+ 	cleanup_traceroute
+ }
+@@ -284,9 +268,6 @@ run_tests()
+ ################################################################################
+ # main
+ 
+-declare -i nfail=0
+-declare -i nsuccess=0
+-
+ while getopts :pv o
+ do
+ 	case $o in
+@@ -301,5 +282,4 @@ require_command traceroute
+ 
+ run_tests
+ 
+-printf "\nTests passed: %3d\n" ${nsuccess}
+-printf "Tests failed: %3d\n"   ${nfail}
++exit "${EXIT_STATUS}"
+-- 
+2.51.0
+
diff --git a/queue-6.17/selftests-traceroute-use-require_command.patch b/queue-6.17/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..38618a4bdd
--- /dev/null
+++ b/queue-6.17/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From ba06998065dd0cef4f05a06741e3976aede004a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index 282f14760940d..b50e52afa4f49 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -203,11 +203,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -268,11 +263,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -306,6 +296,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-6.17/serdev-drop-dev_pm_domain_detach-call.patch b/queue-6.17/serdev-drop-dev_pm_domain_detach-call.patch
new file mode 100644
index 0000000000..6eb36bbfea
--- /dev/null
+++ b/queue-6.17/serdev-drop-dev_pm_domain_detach-call.patch
@@ -0,0 +1,65 @@
+From 36fa19afcf170cf2d3cb15607d637ea9bce6250d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 13:17:47 +0300
+Subject: serdev: Drop dev_pm_domain_detach() call
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit e3fa89f3a768a9c61cf1bfe86b939ab5f36a9744 ]
+
+Starting with commit f99508074e78 ("PM: domains: Detach on
+device_unbind_cleanup()"), there is no longer a need to call
+dev_pm_domain_detach() in the bus remove function. The
+device_unbind_cleanup() function now handles this to avoid
+invoking devres cleanup handlers while the PM domain is
+powered off, which could otherwise lead to failures as
+described in the above-mentioned commit.
+
+Drop the explicit dev_pm_domain_detach() call and rely instead
+on the flags passed to dev_pm_domain_attach() to power off the
+domain.
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Link: https://lore.kernel.org/r/20250827101747.928265-1-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serdev/core.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
+index d16c207a1a9b2..b33e708cb2455 100644
+--- a/drivers/tty/serdev/core.c
++++ b/drivers/tty/serdev/core.c
+@@ -399,15 +399,12 @@ static int serdev_drv_probe(struct device *dev)
+ 	const struct serdev_device_driver *sdrv = to_serdev_device_driver(dev->driver);
+ 	int ret;
+ 
+-	ret = dev_pm_domain_attach(dev, PD_FLAG_ATTACH_POWER_ON);
++	ret = dev_pm_domain_attach(dev, PD_FLAG_ATTACH_POWER_ON |
++					PD_FLAG_DETACH_POWER_OFF);
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = sdrv->probe(to_serdev_device(dev));
+-	if (ret)
+-		dev_pm_domain_detach(dev, true);
+-
+-	return ret;
++	return sdrv->probe(to_serdev_device(dev));
+ }
+ 
+ static void serdev_drv_remove(struct device *dev)
+@@ -415,8 +412,6 @@ static void serdev_drv_remove(struct device *dev)
+ 	const struct serdev_device_driver *sdrv = to_serdev_device_driver(dev->driver);
+ 	if (sdrv->remove)
+ 		sdrv->remove(to_serdev_device(dev));
+-
+-	dev_pm_domain_detach(dev, true);
+ }
+ 
+ static const struct bus_type serdev_bus_type = {
+-- 
+2.51.0
+
diff --git a/queue-6.17/serial-qcom-geni-add-dfs-clock-mode-support-to-geni-.patch b/queue-6.17/serial-qcom-geni-add-dfs-clock-mode-support-to-geni-.patch
new file mode 100644
index 0000000000..571fb7fdc0
--- /dev/null
+++ b/queue-6.17/serial-qcom-geni-add-dfs-clock-mode-support-to-geni-.patch
@@ -0,0 +1,166 @@
+From 94f4e72797881d5b2a05894d470173e6f9451fc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 12:01:36 +0530
+Subject: serial: qcom-geni: Add DFS clock mode support to GENI UART driver
+
+From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
+
+[ Upstream commit fc6a5b540c02d1ec624e4599f45a17f2941a5c00 ]
+
+GENI UART driver currently supports only non-DFS (Dynamic Frequency
+Scaling) mode for source frequency selection. However, to operate correctly
+in DFS mode, the GENI SCLK register must be programmed with the appropriate
+DFS index. Failing to do so can result in incorrect frequency selection
+
+Add support for Dynamic Frequency Scaling (DFS) mode in the GENI UART
+driver by configuring the GENI_CLK_SEL register with the appropriate DFS
+index. This ensures correct frequency selection when operating in DFS mode.
+
+Replace the UART driver-specific logic for clock selection with the GENI
+common driver function to obtain the desired frequency and corresponding
+clock index. This improves maintainability and consistency across
+GENI-based drivers.
+
+Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250903063136.3015237-1-viken.dadhaniya@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 92 ++++++---------------------
+ 1 file changed, 21 insertions(+), 71 deletions(-)
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 81f385d900d06..ff401e331f1bb 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1,5 +1,8 @@
+ // SPDX-License-Identifier: GPL-2.0
+-// Copyright (c) 2017-2018, The Linux foundation. All rights reserved.
++/*
++ * Copyright (c) 2017-2018, The Linux foundation. All rights reserved.
++ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
++ */
+ 
+ /* Disable MMIO tracing to prevent excessive logging of unwanted MMIO traces */
+ #define __DISABLE_TRACE_MMIO__
+@@ -1253,75 +1256,15 @@ static int qcom_geni_serial_startup(struct uart_port *uport)
+ 	return 0;
+ }
+ 
+-static unsigned long find_clk_rate_in_tol(struct clk *clk, unsigned int desired_clk,
+-			unsigned int *clk_div, unsigned int percent_tol)
+-{
+-	unsigned long freq;
+-	unsigned long div, maxdiv;
+-	u64 mult;
+-	unsigned long offset, abs_tol, achieved;
+-
+-	abs_tol = div_u64((u64)desired_clk * percent_tol, 100);
+-	maxdiv = CLK_DIV_MSK >> CLK_DIV_SHFT;
+-	div = 1;
+-	while (div <= maxdiv) {
+-		mult = (u64)div * desired_clk;
+-		if (mult != (unsigned long)mult)
+-			break;
+-
+-		offset = div * abs_tol;
+-		freq = clk_round_rate(clk, mult - offset);
+-
+-		/* Can only get lower if we're done */
+-		if (freq < mult - offset)
+-			break;
+-
+-		/*
+-		 * Re-calculate div in case rounding skipped rates but we
+-		 * ended up at a good one, then check for a match.
+-		 */
+-		div = DIV_ROUND_CLOSEST(freq, desired_clk);
+-		achieved = DIV_ROUND_CLOSEST(freq, div);
+-		if (achieved <= desired_clk + abs_tol &&
+-		    achieved >= desired_clk - abs_tol) {
+-			*clk_div = div;
+-			return freq;
+-		}
+-
+-		div = DIV_ROUND_UP(freq, desired_clk);
+-	}
+-
+-	return 0;
+-}
+-
+-static unsigned long get_clk_div_rate(struct clk *clk, unsigned int baud,
+-			unsigned int sampling_rate, unsigned int *clk_div)
+-{
+-	unsigned long ser_clk;
+-	unsigned long desired_clk;
+-
+-	desired_clk = baud * sampling_rate;
+-	if (!desired_clk)
+-		return 0;
+-
+-	/*
+-	 * try to find a clock rate within 2% tolerance, then within 5%
+-	 */
+-	ser_clk = find_clk_rate_in_tol(clk, desired_clk, clk_div, 2);
+-	if (!ser_clk)
+-		ser_clk = find_clk_rate_in_tol(clk, desired_clk, clk_div, 5);
+-
+-	return ser_clk;
+-}
+-
+ static int geni_serial_set_rate(struct uart_port *uport, unsigned int baud)
+ {
+ 	struct qcom_geni_serial_port *port = to_dev_port(uport);
+ 	unsigned long clk_rate;
+-	unsigned int avg_bw_core;
++	unsigned int avg_bw_core, clk_idx;
+ 	unsigned int clk_div;
+ 	u32 ver, sampling_rate;
+ 	u32 ser_clk_cfg;
++	int ret;
+ 
+ 	sampling_rate = UART_OVERSAMPLING;
+ 	/* Sampling rate is halved for IP versions >= 2.5 */
+@@ -1329,17 +1272,22 @@ static int geni_serial_set_rate(struct uart_port *uport, unsigned int baud)
+ 	if (ver >= QUP_SE_VERSION_2_5)
+ 		sampling_rate /= 2;
+ 
+-	clk_rate = get_clk_div_rate(port->se.clk, baud,
+-		sampling_rate, &clk_div);
+-	if (!clk_rate) {
+-		dev_err(port->se.dev,
+-			"Couldn't find suitable clock rate for %u\n",
+-			baud * sampling_rate);
++	ret = geni_se_clk_freq_match(&port->se, baud * sampling_rate, &clk_idx, &clk_rate, false);
++	if (ret) {
++		dev_err(port->se.dev, "Failed to find src clk for baud rate: %d ret: %d\n",
++			baud, ret);
++		return ret;
++	}
++
++	clk_div = DIV_ROUND_UP(clk_rate, baud * sampling_rate);
++	/* Check if calculated divider exceeds maximum allowed value */
++	if (clk_div > (CLK_DIV_MSK >> CLK_DIV_SHFT)) {
++		dev_err(port->se.dev, "Calculated clock divider %u exceeds maximum\n", clk_div);
+ 		return -EINVAL;
+ 	}
+ 
+-	dev_dbg(port->se.dev, "desired_rate = %u, clk_rate = %lu, clk_div = %u\n",
+-			baud * sampling_rate, clk_rate, clk_div);
++	dev_dbg(port->se.dev, "desired_rate = %u, clk_rate = %lu, clk_div = %u\n, clk_idx = %u\n",
++		baud * sampling_rate, clk_rate, clk_div, clk_idx);
+ 
+ 	uport->uartclk = clk_rate;
+ 	port->clk_rate = clk_rate;
+@@ -1359,6 +1307,8 @@ static int geni_serial_set_rate(struct uart_port *uport, unsigned int baud)
+ 
+ 	writel(ser_clk_cfg, uport->membase + GENI_SER_M_CLK_CFG);
+ 	writel(ser_clk_cfg, uport->membase + GENI_SER_S_CLK_CFG);
++	/* Configure clock selection register with the selected clock index */
++	writel(clk_idx & CLK_SEL_MSK, uport->membase + SE_GENI_CLK_SEL);
+ 	return 0;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/series b/queue-6.17/series
index 10196f94fc..ebd525993f 100644
--- a/queue-6.17/series
+++ b/queue-6.17/series
@@ -225,3 +225,460 @@ mfd-macsmc-add-apple-t8103-smc-compatible.patch
 mfd-core-increment-of_node-s-refcount-before-linking.patch
 mfd-cs42l43-move-irq-enable-disable-to-encompass-for.patch
 mfd-intel-lpss-add-intel-wildcat-lake-lpss-pci-ids.patch
+drm-xe-ptl-apply-wa_16026007364.patch
+drm-xe-configfs-enforce-canonical-device-names.patch
+drm-amd-display-update-tiled-to-tiled-copy-command.patch
+drm-amd-display-fix-condition-for-setting-timing_adj.patch
+drm-amd-display-ensure-committing-streams-is-seamles.patch
+drm-amdgpu-add-range-check-for-ras-bad-page-address.patch
+drm-amdgpu-check-vcn-sram-load-return-value.patch
+drm-amd-display-remove-check-dpia-hpd-status-for-bw-.patch
+drm-amd-display-move-setup_stream_attribute.patch
+drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
+drm-amd-display-fix-dmub_cmd-header-alignment.patch
+drm-amd-display-cache-streams-targeting-link-when-pe.patch
+drm-xe-guc-add-more-guc-load-error-status-codes.patch
+drm-xe-fix-oops-in-xe_gem_fault-when-running-core_ho.patch
+drm-xe-pf-don-t-resume-device-from-restart-worker.patch
+drm-amdgpu-fix-build-error-when-config_suspend-is-di.patch
+drm-amdgpu-update-ipid-value-for-bad-page-threshold-.patch
+drm-amdgpu-avoid-rma-causes-gpu-duplicate-reset.patch
+drm-amdgpu-effective-health-check-before-reset.patch
+drm-amd-amdgpu-release-xcp-drm-memory-after-unplug.patch
+drm-amdgpu-fix-vcn-v5.0.1-poison-irq-call-trace.patch
+drm-xe-extend-wa_13012615864-to-additional-xe2-and-x.patch
+drm-amdgpu-skip-poison-aca-bank-from-ue-channel.patch
+drm-amd-display-add-more-cyan-skillfish-devices.patch
+drm-amdgpu-initialize-jpeg-v5_0_1-ras-function.patch
+drm-amdgpu-skip-mgpu-fan-boost-for-multi-vf.patch
+drm-amd-display-fix-dmub-access-race-condition.patch
+drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
+drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+accel-amdxdna-unify-pm-and-rpm-suspend-and-resume-ca.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-xe-pf-program-lmtt-directory-pointer-on-all-gts-.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+asoc-tas2781-add-keyword-init-in-profile-section.patch
+asoc-mediatek-use-snd_jack_avout-for-hdmi-dp-jacks.patch
+drm-amd-display-reset-apply_eamless_boot_optimizatio.patch
+drm-amdgpu-add-to-custom-amdgpu_drm_release-drm_dev_.patch
+drm-amd-display-wait-until-otg-enable-state-is-clear.patch
+drm-xe-rework-pde-pat-index-selection.patch
+docs-kernel-doc-avoid-script-crash-on-ancient-python.patch
+drm-sharp-memory-do-not-access-gem-dma-vaddr-directl.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+drm-nouveau-always-set-rmdevidcheckignore-for-gsp-rm.patch
+drm-panel-edp-add-shp-lq134z1-panel-for-dell-xps-934.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
+wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
+wifi-rtw89-add-dummy-c2h-handlers-for-bcn-resend-and.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+selftests-drv-net-devmem-add-correct-the-ipv6-suppor.patch
+selftests-drv-net-devmem-flip-the-direction-of-tx-te.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
+drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
+drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
+drm-tidss-remove-early-fb.patch
+rdma-mana_ib-drain-send-wrs-of-gsi-qp.patch
+media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
+pci-err-update-device-error_state-already-after-rese.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+ice-don-t-use-pk-through-printk-or-tracepoints.patch
+thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
+tty-serial-ip22zilog-use-platform-device-for-probing.patch
+asoc-es8323-enable-dapm-power-widgets-for-playback-d.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+selftests-drv-net-wait-for-carrier.patch
+net-phy-mscc-report-and-configure-in-band-auto-negot.patch
+scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
+scsi-ufs-host-mediatek-fix-pwm-mode-switch-issue.patch
+scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
+scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
+scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
+gpu-nova-core-register-allow-fields-named-offset.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-panthor-serialize-gpu-cache-flush-operations.patch
+hid-pidff-use-direction-fix-only-for-conditional-eff.patch
+hid-pidff-permissive_control-quirk-autodetection.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+drm-amdgpu-fix-nullptr-err-of-vm_handle_moved.patch
+drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
+drm-amdgpu-refactor-bad_page_work-for-corner-case-ha.patch
+hwrng-timeriomem-use-us_to_ktime-where-appropriate.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
+iio-light-isl29125-use-iio_push_to_buffers_with_ts-t.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+asoc-es8323-remove-dac-enablement-write-from-es8323_.patch
+asoc-es8323-add-proper-left-right-mixer-controls-via.patch
+asoc-intel-avs-do-not-share-the-name-pointer-between.patch
+asoc-codecs-wsa883x-handle-shared-reset-gpio-for-wsa.patch
+drm-xe-make-page-size-consistent-in-loop.patch
+wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
+wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
+wifi-rtw89-8851b-rfk-update-iqk-tia-setting.patch
+dm-error-mark-as-dm_target_passes_integrity.patch
+char-misc-make-misc_register-reentry-for-miscdevice-.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+dmaengine-idxd-add-a-new-iaa-device-id-for-wildcat-l.patch
+f2fs-fix-to-detect-potential-corrupted-nid-in-free_n.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+bnxt_en-add-hyper-v-vf-id.patch
+tty-serial-modify-the-use-of-dev_err_probe.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+octeontx2-af-broadcast-xon-on-all-channels.patch
+idpf-do-not-linearize-big-tso-packets.patch
+drm-xe-pcode-initialize-data0-for-pcode-read-routine.patch
+drm-panel-ilitek-ili9881c-turn-off-power-supply-when.patch
+drm-panel-ilitek-ili9881c-move-display_on-_off-dcs-c.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+net-wangxun-limit-tx_max_coalesced_frames_irq.patch
+iio-imu-bmi270-match-pnp-id-found-on-newer-gpd-firmw.patch
+media-ipu6-isys-set-embedded-data-type-correctly-for.patch
+rpmsg-char-export-alias-for-rpmsg-id-rpmsg-raw-from-.patch
+net-ipv4-allow-directed-broadcast-routes-to-use-dst-.patch
+scsi-mpi3mr-fix-device-loss-during-enclosure-reboot-.patch
+wifi-rtw89-coex-limit-wi-fi-scan-slot-cost-to-avoid-.patch
+scsi-mpi3mr-fix-i-o-failures-during-controller-reset.patch
+scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+extcon-fsa9480-fix-wakeup-source-leaks-on-device-unb.patch
+extcon-axp288-fix-wakeup-source-leaks-on-device-unbi.patch
+drm-xe-set-gt-as-wedged-before-sending-wedged-uevent.patch
+remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
+drm-xe-wcl-extend-l3bank-mask-workaround.patch
+net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
+selftests-drv-net-hds-restore-hds-settings.patch
+fuse-zero-initialize-inode-private-data.patch
+virtio_fs-fix-the-hash-table-using-in-virtio_fs_enqu.patch
+selftests-pci_endpoint-skip-irq-test-if-irq-is-out-o.patch
+drm-xe-ensure-gt-is-in-c0-during-resumes.patch
+misc-pci_endpoint_test-skip-irq-tests-if-irq-is-out-.patch
+drm-amdgpu-correct-the-loss-of-aca-bank-reg-info.patch
+drm-amdgpu-correct-the-counts-of-nr_banks-and-nr_err.patch
+drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
+drm-amd-display-support-hw-cursor-180-rot-for-any-nu.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+drm-amd-display-wait-for-otg-update-pending-latch-be.patch
+drm-amd-display-consider-sink-max-slice-width-limita.patch
+drm-amdgpu-vpe-cancel-delayed-work-in-hw_fini.patch
+drm-xe-cancel-pending-tlb-inval-workers-on-teardown.patch
+net-prevent-rps-table-overwrite-of-active-flows.patch
+eth-fbnic-reset-hw-stats-upon-pci-error.patch
+wifi-iwlwifi-mld-trigger-mlo-scan-only-when-not-in-e.patch
+platform-x86-intel-uncore-freq-fix-warning-in-partit.patch
+drm-msm-dpu-filter-modes-based-on-adjusted-mode-cloc.patch
+drm-msm-use-of_reserved_mem_region_to_resource-for-m.patch
+selftests-drv-net-rss_ctx-fix-the-queue-count-check.patch
+media-fix-uninitialized-symbol-warnings.patch
+media-pci-mgb4-fix-timings-comparison-in-vidioc_s_dv.patch
+asoc-sof-ipc4-pcm-add-fixup-for-channels.patch
+drm-amdgpu-notify-pmfw-bad-page-threshold-exceeded.patch
+drm-amd-display-increase-minimum-clock-for-tmds-420-.patch
+drm-amdgpu-avoid-jpeg-v5.0.1-poison-irq-call-trace-o.patch
+drm-amd-display-incorrect-conditions-for-failing-dto.patch
+drm-amdgpu-avoid-vcn-v5.0.1-poison-irq-call-trace-on.patch
+drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-model-to-easy50712-dts.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
+inet_diag-annotate-data-races-in-inet_diag_bc_sk.patch
+microchip-lan865x-add-ndo_eth_ioctl-handler-to-enabl.patch
+tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
+crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+iio-adc-ad7124-do-not-require-mclk.patch
+scsi-ufs-exynos-fsd-gate-ref_clk-and-put-ufs-device-.patch
+media-imx-mipi-csis-only-set-clock-rate-when-specifi.patch
+media-nxp-imx8-isi-fix-streaming-cleanup-on-release.patch
+wifi-iwlwifi-pcie-remember-when-interrupts-are-disab.patch
+drm-st7571-i2c-add-support-for-inverted-pixel-format.patch
+ptp-limit-time-setting-of-ptp-clocks.patch
+drm-xe-guc-add-devm-release-action-to-safely-tear-do.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+netfilter-nf_tables-all-transaction-allocations-can-.patch
+drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
+drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
+drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
+drm-xe-guc-increase-guc-crash-dump-buffer-size.patch
+drm-amd-pm-increase-smc-timeout-on-si-and-warn-v3.patch
+move_mount-2-take-sanity-checks-in-beneath-case-into.patch
+selftests-drv-net-rss_ctx-make-the-test-pass-with-fe.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+drm-xe-extend-wa_22021007897-to-xe3-platforms.patch
+wifi-mac80211-count-reg-connection-element-in-the-si.patch
+drm-panthor-check-bo-offset-alignment-in-vm-bind.patch
+drm-panel-backlight-quirks-make-edid-match-optional.patch
+ixgbe-reduce-number-of-reads-when-getting-orom-data.patch
+netlink-specs-fou-change-local-v6-peer-v6-check.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+media-adv7180-add-missing-lock-in-suspend-callback.patch
+media-adv7180-do-not-write-format-to-device-in-set_f.patch
+media-adv7180-only-validate-format-in-querystd.patch
+media-verisilicon-explicitly-disable-selection-api-i.patch
+wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
+platform-x86-think-lmi-add-extra-tc-bios-error-messa.patch
+platform-x86-intel-uncore-freq-present-unique-domain.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+pci-imx6-enable-the-vaux-supply-if-available.patch
+drm-xe-guc-set-upper-limit-of-h2g-retries-over-ctb.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
+drm-gpusvm-fix-hmm_pfn_to_map_order-usage.patch
+drm-xe-improve-dma-resv-handling-for-backup-object.patch
+iommu-amd-add-support-to-remap-unmap-iommu-buffers-f.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+iommu-amd-reuse-device-table-for-kdump.patch
+crypto-ccp-skip-sev-and-snp-init-for-kdump-boot.patch
+iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
+bus-mhi-host-pci_generic-add-support-for-all-foxconn.patch
+drm-amdgpu-correct-info-field-of-bad-page-threshold-.patch
+drm-amd-add-more-cyan-skillfish-pci-ids.patch
+drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
+drm-amd-display-fix-pbn_div-calculation-error.patch
+drm-amd-display-dont-wait-for-pipe-update-during-med.patch
+drm-amd-pm-refine-amdgpu-pm-sysfs-node-error-code.patch
+drm-amd-display-indicate-when-custom-brightness-curv.patch
+selftests-ncdevmem-don-t-retry-efault.patch
+net-dsa-felix-support-phy-mode-10g-qxgmii.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+usb-cdns3-gadget-use-after-free-during-failed-initia.patch
+serial-qcom-geni-add-dfs-clock-mode-support-to-geni-.patch
+serdev-drop-dev_pm_domain_detach-call.patch
+tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
+eeprom-at25-support-cypress-frams-without-device-id.patch
+drm-msm-adreno-add-speedbins-for-a663-gpu.patch
+drm-msm-fix-32b-size-truncation.patch
+dt-bindings-display-msm-gmu-update-adreno-623-bindin.patch
+drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
+char-use-list_del_init-in-misc_deregister-to-reiniti.patch
+drm-msm-adreno-add-speedbin-data-for-a623-gpu.patch
+drm-msm-adreno-add-fenced-regwrite-support.patch
+drm-msm-a6xx-switch-to-gmu-ao-counter.patch
+idpf-link-napis-to-queues.patch
+selftests-net-make-the-dump-test-less-sensitive-to-m.patch
+pci-endpoint-pci-epf-test-limit-pcie-bar-size-for-fi.patch
+wifi-rtw89-add-usb-id-2001-332a-for-d-link-ax9u-rev..patch
+wifi-rtw89-add-usb-id-2001-3327-for-d-link-ax18u-rev.patch
+wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
+drm-xe-i2c-enable-bus-mastering.patch
+media-ov08x40-fix-the-horizontal-flip-control.patch
+media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
+media-qcom-camss-csiphy-3ph-add-csiphy-2ph-dphy-v2.0.patch
+drm-bridge-write-full-audio-infoframe.patch
+drm-xe-guc-always-add-ct-disable-action-during-secon.patch
+f2fs-fix-wrong-layout-information-on-16kb-page.patch
+drm-amdgpu-validate-userq-input-args.patch
+selftests-mptcp-join-allow-more-time-to-send-add_add.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
+scsi-ufs-ufs-qcom-align-programming-sequence-of-shar.patch
+scsi-ufs-host-mediatek-fix-unbalanced-irq-enable-iss.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+scsi-ufs-host-mediatek-correct-system-pm-flow.patch
+scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
+scsi-ufs-host-mediatek-fix-adapt-issue-after-pa_init.patch
+ntfs3-pretend-extend-records-as-regular-files.patch
+wifi-cfg80211-update-the-time-stamps-in-hidden-ssid.patch
+wifi-mac80211-fix-he-capabilities-element-check.patch
+fbcon-use-screen-info-to-find-primary-device.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+fix-access-to-video_is_primary_device-when-compiled-.patch
+phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
+phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
+drm-msm-registers-generate-_hi-lo-builders-for-reg64.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+platform-x86-amd-pmf-fix-the-custom-bios-input-handl.patch
+selftests-traceroute-use-require_command.patch
+selftests-traceroute-return-correct-value-on-failure.patch
+openrisc-add-r_or1k_32_pcrel-relocation-type-module-.patch
+netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+x86-virt-tdx-use-precalculated-tdvpr-page-physical-a.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+pci-aer-fix-null-pointer-access-by-aer_info.patch
+selftests-replace-sleep-with-slowwait.patch
+net-devmem-expose-tcp_recvmsg_locked-errors.patch
+selftests-net-lib.sh-don-t-defer-failed-commands.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
+watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
+crypto-sun8i-ce-remove-channel-timeout-field.patch
+pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
+crypto-ccp-fix-incorrect-payload-size-calculation-in.patch
+crypto-caam-double-the-entropy-delay-interval-for-re.patch
+can-rcar_canfd-update-bit-rate-constants-for-rz-g3e-.patch
+net-mana-reduce-waiting-time-if-hwc-not-responding.patch
+ionic-use-int-type-for-err-in-ionic_get_module_eepro.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
+wifi-mt76-mt7925-add-pci-restore-for-hibernate.patch
+wifi-mt76-mt7996-fix-mt7996_reverse_frag0_hdr_trans-.patch
+wifi-mt76-mt7996-set-def_wcid-pointer-in-mt7996_mac_.patch
+wifi-mt76-mt7996-temporarily-disable-epcs.patch
+wifi-mt76-mt7996-support-writing-mac-txd-for-addba-r.patch
+wifi-mt76-mt76_eeprom_override-to-int.patch
+alsa-serial-generic-remove-shared-static-buffer.patch
+wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
+wifi-mt76-mt7996-disable-promiscuous-mode-by-default.patch
+wifi-mt76-use-altx-queue-for-offchannel-tx-on-connac.patch
+wifi-mt76-improve-phy-reset-on-hw-restart.patch
+drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
+drm-amdgpu-validate-userq-buffer-virtual-address-and.patch
+drm-amdgpu-release-hive-reference-properly.patch
+drm-amd-display-fix-dmcub-loading-sequence-for-dcn3..patch
+drm-amd-display-set-up-pixel-encoding-for-ycbcr422.patch
+drm-amd-display-fix-dml-ms-order-of-operations.patch
+drm-amd-avoid-evicting-resources-at-s5.patch
+drm-amd-display-don-t-use-non-registered-vupdate-on-.patch
+drm-amd-display-keep-pll0-running-on-dce-6.0-and-6.4.patch
+drm-amd-display-fix-dvi-d-hdmi-adapters.patch
+drm-amd-display-disable-vrr-on-dce-6.patch
+drm-amd-display-dml2-guard-dml21_map_dc_state_into_d.patch
+net-phy-clear-eee-runtime-state-in-phy_halted-phy_er.patch
+page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
+ethernet-extend-device_get_mac_address-to-use-nvmem.patch
+scsi-ufs-ufs-qcom-disable-lane-clocks-during-phy-hib.patch
+hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
+hinic3-queue-pair-endianness-improvements.patch
+hinic3-fix-missing-napi-dev-in-netif_queue_set_napi.patch
+tools-ynl-gen-validate-nested-arrays.patch
+drm-xe-guc-return-an-error-code-if-the-guc-load-fail.patch
+drm-amdgpu-reject-gang-submissions-under-sriov.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-ufs-core-disable-timestamp-functionality-if-not.patch
+scsi-lpfc-clean-up-allocated-queues-when-queue-setup.patch
+scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-ex.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+scsi-lpfc-ensure-plogi_acc-is-sent-prior-to-prli-in-.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
+wifi-rtw89-disable-rtw89_physts_ie09_ftr_0-for-ppdu-.patch
+wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
+wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
+usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
+ipv6-np-rxpmtu-race-annotation.patch
+rdma-irdma-update-kconfig.patch
+ib-ipoib-ignore-l3-master-device.patch
+bnxt_en-add-fw-log-trace-support-for-5731x-5741x-chi.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+mei-make-a-local-copy-of-client-uuid-in-connect.patch
+drm-amdgpu-atom-check-kcalloc-for-ws-buffer-in-amdgp.patch
+asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
+net-phy-clear-link-parameters-on-admin-link-down.patch
+net-ethernet-microchip-sparx5-make-it-selectable-for.patch
+bus-mhi-core-improve-mhi_sync_power_up-handling-for-.patch
+iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+iommu-vt-d-remove-lpig-from-page-group-response-desc.patch
+wifi-mac80211-get-the-correct-interface-for-non-netd.patch
+wifi-mac80211-track-nan-interface-start-stop.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+sparc64-fix-prototypes-of-reads-bwl.patch
+vfio-return-enotty-for-unsupported-device-feature.patch
+ptp_ocp-make-ptp_ocp-driver-compatible-with-ptp_extt.patch
+crypto-hisilicon-qm-invalidate-queues-in-use.patch
+crypto-hisilicon-qm-clear-all-vf-configurations-in-t.patch
+asoc-ops-improve-snd_soc_get_volsw.patch
+pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
+selftests-forwarding-reorder-ar-ping-arguments-to-ob.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
+net-dsa-microchip-set-spi-as-bus-interface-during-re.patch
+bng_en-make-bnge_alloc_ring-self-unwind-on-failure.patch
+alsa-usb-audio-don-t-apply-interface-quirk-to-preson.patch
+tcp-update-bind-bucket-state-on-port-release.patch
+ovl-make-sure-that-ovl_create_real-returns-a-hashed-.patch
+drm-amd-display-add-missing-post-flip-calls.patch
+drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
+drm-amd-display-add-fast-sync-field-in-ultra-sleep-m.patch
+drm-amd-display-init-dispclk-from-bootup-clock-for-d.patch
+drm-amd-display-fix-for-test-crash-due-to-power-gati.patch
+drm-amd-display-change-dc-stream-color-settings-only.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
+net-phy-dp83640-improve-phydev-and-driver-removal-ha.patch
+scsi-ufs-core-change-mcq-interrupt-enable-flow.patch
+scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
+accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
+scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
+accel-habanalabs-return-enomem-if-less-than-requeste.patch
+accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
+accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
+asoc-renesas-msiof-add-.symmetric_xxx-on-snd_soc_dai.patch
+asoc-renesas-msiof-use-reset-controller.patch
+asoc-renesas-msiof-tidyup-dmac-stop-timing.patch
+asoc-renesas-msiof-set-sifctr-register.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+ext4-increase-io-priority-of-fastcommit.patch
+amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
+drm-amdgpu-add-fallback-to-pipe-reset-if-kcq-ring-re.patch
+drm-amdgpu-fix-fence-signaling-race-condition-in-use.patch
+asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
+amd-amdkfd-enhance-kfd-process-check-in-switch-parti.patch
+asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
+acpi-scan-update-honor-list-for-rpmi-system-msi.patch
+platform-x86-x86-android-tablets-stop-using-eprobe_d.patch
+vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
+vfio-nvgrace-gpu-add-gb300-sku-to-the-devid-table.patch
+selftest-net-fix-error-message-if-empty-variable.patch
+net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
+bluetooth-btintel-add-support-for-blazariw-core.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-btusb-add-new-vid-pid-13d3-3627-for-mt7925.patch
+bluetooth-btintel_pcie-define-hdev-wakeup-callback.patch
+bluetooth-iso-don-t-initiate-cis-connections-if-ther.patch
+bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
+bluetooth-iso-use-sk_sndtimeo-as-conn_timeout.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-btusb-add-new-vid-pid-13d3-3633-for-mt7922.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+net-stmmac-est-drop-frames-causing-hlbs-error.patch
+exfat-limit-log-print-for-io-error.patch
+exfat-validate-cluster-allocation-bits-of-the-alloca.patch
+6pack-drop-redundant-locking-and-refcounting.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+ftrace-fix-softlockup-in-ftrace_module_enable.patch
+net-mlx5e-prevent-entering-switchdev-mode-with-incon.patch
+ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
+smb-client-update-cfid-last_access_time-in-open_cach.patch
+smb-client-transport-avoid-reconnects-triggered-by-p.patch
+ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
+usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
+drm-amd-display-add-fallback-path-for-ycbcr422.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-6.17/smb-client-transport-avoid-reconnects-triggered-by-p.patch b/queue-6.17/smb-client-transport-avoid-reconnects-triggered-by-p.patch
new file mode 100644
index 0000000000..ded489cd21
--- /dev/null
+++ b/queue-6.17/smb-client-transport-avoid-reconnects-triggered-by-p.patch
@@ -0,0 +1,70 @@
+From 1fd1f8502abc3e503cf709f53d6a383fd64b5c72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:39 +0200
+Subject: smb: client: transport: avoid reconnects triggered by pending task
+ work
+
+From: Fiona Ebner <f.ebner@proxmox.com>
+
+[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
+
+When io_uring is used in the same task as CIFS, there might be
+unnecessary reconnects, causing issues in user-space applications
+like QEMU with a log like:
+
+> CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
+
+Certain io_uring completions might be added to task_work with
+notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for
+the task.
+
+In __smb_send_rqst(), signals are masked before calling
+smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
+
+If sk_stream_wait_memory() is reached via sock_sendmsg() while
+TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to
+true there, and -EINTR will be propagated all the way from
+sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec().
+Afterwards, __smb_send_rqst() will see that not everything was written
+and reconnect.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/transport.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
+index a61ba7f3fb86b..940e901071343 100644
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -22,6 +22,7 @@
+ #include <linux/mempool.h>
+ #include <linux/sched/signal.h>
+ #include <linux/task_io_accounting_ops.h>
++#include <linux/task_work.h>
+ #include "cifspdu.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+@@ -173,9 +174,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+ 		 * send a packet.  In most cases if we fail to send
+ 		 * after the retries we will kill the socket and
+ 		 * reconnect which may clear the network problem.
++		 *
++		 * Even if regular signals are masked, EINTR might be
++		 * propagated from sk_stream_wait_memory() to here when
++		 * TIF_NOTIFY_SIGNAL is used for task work. For example,
++		 * certain io_uring completions will use that. Treat
++		 * having EINTR with pending task work the same as EAGAIN
++		 * to avoid unnecessary reconnects.
+ 		 */
+ 		rc = sock_sendmsg(ssocket, smb_msg);
+-		if (rc == -EAGAIN) {
++		if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
+ 			retries++;
+ 			if (retries >= 14 ||
+ 			    (!server->noblocksnd && (retries > 2))) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/smb-client-update-cfid-last_access_time-in-open_cach.patch b/queue-6.17/smb-client-update-cfid-last_access_time-in-open_cach.patch
new file mode 100644
index 0000000000..4cd9821b4b
--- /dev/null
+++ b/queue-6.17/smb-client-update-cfid-last_access_time-in-open_cach.patch
@@ -0,0 +1,39 @@
+From 00de011101e382d5e6b9b86f5988fb465b188777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 22:41:58 -0300
+Subject: smb: client: update cfid->last_access_time in
+ open_cached_dir_by_dentry()
+
+From: Henrique Carvalho <henrique.carvalho@suse.com>
+
+[ Upstream commit 5676398315b73f21d6a4e2d36606ce94e8afc79e ]
+
+open_cached_dir_by_dentry() was missing an update of
+cfid->last_access_time to jiffies, similar to what open_cached_dir()
+has.
+
+Add it to the function.
+
+Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
+Reviewed-by: Enzo Matsumiya <ematsumiya@suse.de>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/cached_dir.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/smb/client/cached_dir.c b/fs/smb/client/cached_dir.c
+index b69daeb1301b3..cc857a030a778 100644
+--- a/fs/smb/client/cached_dir.c
++++ b/fs/smb/client/cached_dir.c
+@@ -423,6 +423,7 @@ int open_cached_dir_by_dentry(struct cifs_tcon *tcon,
+ 			cifs_dbg(FYI, "found a cached file handle by dentry\n");
+ 			kref_get(&cfid->refcount);
+ 			*ret_cfid = cfid;
++			cfid->last_access_time = jiffies;
+ 			spin_unlock(&cfids->cfid_list_lock);
+ 			return 0;
+ 		}
+-- 
+2.51.0
+
diff --git a/queue-6.17/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch b/queue-6.17/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
new file mode 100644
index 0000000000..f56a3d6295
--- /dev/null
+++ b/queue-6.17/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
@@ -0,0 +1,55 @@
+From e23a40b155d9cb18128358b387b92db2e719a9f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:26:10 -0500
+Subject: smsc911x: add second read of EEPROM mac when possible corruption seen
+
+From: Colin Foster <colin.foster@in-advantage.com>
+
+[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
+
+When the EEPROM MAC is read by way of ADDRH, it can return all 0s the
+first time. Subsequent reads succeed.
+
+This is fully reproduceable on the Phytec PCM049 SOM.
+
+Re-read the ADDRH when this behaviour is observed, in an attempt to
+correctly apply the EEPROM MAC address.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index 6ca290f7c0dfb..3ebd0664c697f 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2162,10 +2162,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {
+ static void smsc911x_read_mac_address(struct net_device *dev)
+ {
+ 	struct smsc911x_data *pdata = netdev_priv(dev);
+-	u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+-	u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++	u32 mac_high16, mac_low32;
+ 	u8 addr[ETH_ALEN];
+ 
++	mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++
++	/* The first mac_read in some setups can incorrectly read 0. Re-read it
++	 * to get the full MAC if this is observed.
++	 */
++	if (mac_high16 == 0) {
++		SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n");
++		mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	}
++
+ 	addr[0] = (u8)(mac_low32);
+ 	addr[1] = (u8)(mac_low32 >> 8);
+ 	addr[2] = (u8)(mac_low32 >> 16);
+-- 
+2.51.0
+
diff --git a/queue-6.17/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-6.17/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..80ddb05873
--- /dev/null
+++ b/queue-6.17/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From 322212599476e2e30d957941538c368f8c1f102a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 8fb09eec8c3e7..694ed081cf8d9 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -58,6 +58,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index b8c51cc23d969..6e3d4dde4f9ab 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -87,6 +87,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-6.17/sparc64-fix-prototypes-of-reads-bwl.patch b/queue-6.17/sparc64-fix-prototypes-of-reads-bwl.patch
new file mode 100644
index 0000000000..abbb754197
--- /dev/null
+++ b/queue-6.17/sparc64-fix-prototypes-of-reads-bwl.patch
@@ -0,0 +1,51 @@
+From 4616b0cf340098b74a093014033acebbd3f60406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:42:08 +0100
+Subject: sparc64: fix prototypes of reads[bwl]()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
+
+Conventions for readsl() are the same as for readl() - any __iomem
+pointer is acceptable, both const and volatile ones being OK.  Same
+for readsb() and readsw().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com> # Making sparc64 subject prefix
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/io_64.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
+index c9528e4719cd2..d8ed296624afd 100644
+--- a/arch/sparc/include/asm/io_64.h
++++ b/arch/sparc/include/asm/io_64.h
+@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);
+ #define insw insw
+ #define insl insl
+ 
+-static inline void readsb(void __iomem *port, void *buf, unsigned long count)
++static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insb((unsigned long __force)port, buf, count);
+ }
+ #define readsb readsb
+ 
+-static inline void readsw(void __iomem *port, void *buf, unsigned long count)
++static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insw((unsigned long __force)port, buf, count);
+ }
+ #define readsw readsw
+ 
+-static inline void readsl(void __iomem *port, void *buf, unsigned long count)
++static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insl((unsigned long __force)port, buf, count);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/tcp-update-bind-bucket-state-on-port-release.patch b/queue-6.17/tcp-update-bind-bucket-state-on-port-release.patch
new file mode 100644
index 0000000000..2f5ebdfa9b
--- /dev/null
+++ b/queue-6.17/tcp-update-bind-bucket-state-on-port-release.patch
@@ -0,0 +1,279 @@
+From 4922b428be87734b9ece9bb9b88f10495f06c9f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 15:22:04 +0200
+Subject: tcp: Update bind bucket state on port release
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit d57f4b874946e997be52f5ebb5e0e1dad368c16f ]
+
+Today, once an inet_bind_bucket enters a state where fastreuse >= 0 or
+fastreuseport >= 0 after a socket is explicitly bound to a port, it remains
+in that state until all sockets are removed and the bucket is destroyed.
+
+In this state, the bucket is skipped during ephemeral port selection in
+connect(). For applications using a reduced ephemeral port
+range (IP_LOCAL_PORT_RANGE socket option), this can cause faster port
+exhaustion since blocked buckets are excluded from reuse.
+
+The reason the bucket state isn't updated on port release is unclear.
+Possibly a performance trade-off to avoid scanning bucket owners, or just
+an oversight.
+
+Fix it by recalculating the bucket state when a socket releases a port. To
+limit overhead, each inet_bind2_bucket stores its own (fastreuse,
+fastreuseport) state. On port release, only the relevant port-addr bucket
+is scanned, and the overall state is derived from these.
+
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250917-update-bind-bucket-state-on-unhash-v5-1-57168b661b47@cloudflare.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/inet_connection_sock.h |  5 ++--
+ include/net/inet_hashtables.h      |  2 ++
+ include/net/inet_timewait_sock.h   |  3 +-
+ include/net/sock.h                 |  4 +++
+ net/ipv4/inet_connection_sock.c    | 12 +++++---
+ net/ipv4/inet_hashtables.c         | 44 +++++++++++++++++++++++++++++-
+ net/ipv4/inet_timewait_sock.c      |  1 +
+ 7 files changed, 63 insertions(+), 8 deletions(-)
+
+diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
+index 1735db332aab5..072347f164830 100644
+--- a/include/net/inet_connection_sock.h
++++ b/include/net/inet_connection_sock.h
+@@ -322,8 +322,9 @@ int inet_csk_listen_start(struct sock *sk);
+ void inet_csk_listen_stop(struct sock *sk);
+ 
+ /* update the fast reuse flag when adding a socket */
+-void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
+-			       struct sock *sk);
++void inet_csk_update_fastreuse(const struct sock *sk,
++			       struct inet_bind_bucket *tb,
++			       struct inet_bind2_bucket *tb2);
+ 
+ struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu);
+ 
+diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
+index 19dbd9081d5a5..d6676746dabfe 100644
+--- a/include/net/inet_hashtables.h
++++ b/include/net/inet_hashtables.h
+@@ -108,6 +108,8 @@ struct inet_bind2_bucket {
+ 	struct hlist_node	bhash_node;
+ 	/* List of sockets hashed to this bucket */
+ 	struct hlist_head	owners;
++	signed char		fastreuse;
++	signed char		fastreuseport;
+ };
+ 
+ static inline struct net *ib_net(const struct inet_bind_bucket *ib)
+diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
+index 67a3135757809..baafef24318e0 100644
+--- a/include/net/inet_timewait_sock.h
++++ b/include/net/inet_timewait_sock.h
+@@ -70,7 +70,8 @@ struct inet_timewait_sock {
+ 	unsigned int		tw_transparent  : 1,
+ 				tw_flowlabel	: 20,
+ 				tw_usec_ts	: 1,
+-				tw_pad		: 2,	/* 2 bits hole */
++				tw_connect_bind	: 1,
++				tw_pad		: 1,	/* 1 bit hole */
+ 				tw_tos		: 8;
+ 	u32			tw_txhash;
+ 	u32			tw_priority;
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 2e14283c5be1a..57c0df29ee964 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1488,6 +1488,10 @@ static inline int __sk_prot_rehash(struct sock *sk)
+ 
+ #define SOCK_BINDADDR_LOCK	4
+ #define SOCK_BINDPORT_LOCK	8
++/**
++ * define SOCK_CONNECT_BIND - &sock->sk_userlocks flag for auto-bind at connect() time
++ */
++#define SOCK_CONNECT_BIND	16
+ 
+ struct socket_alloc {
+ 	struct socket socket;
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index 1e2df51427fed..0076c67d9bd41 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -423,7 +423,7 @@ inet_csk_find_open_port(const struct sock *sk, struct inet_bind_bucket **tb_ret,
+ }
+ 
+ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+-				     struct sock *sk)
++				     const struct sock *sk)
+ {
+ 	if (tb->fastreuseport <= 0)
+ 		return 0;
+@@ -453,8 +453,9 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb,
+ 				    ipv6_only_sock(sk), true, false);
+ }
+ 
+-void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
+-			       struct sock *sk)
++void inet_csk_update_fastreuse(const struct sock *sk,
++			       struct inet_bind_bucket *tb,
++			       struct inet_bind2_bucket *tb2)
+ {
+ 	bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN;
+ 
+@@ -501,6 +502,9 @@ void inet_csk_update_fastreuse(struct inet_bind_bucket *tb,
+ 			tb->fastreuseport = 0;
+ 		}
+ 	}
++
++	tb2->fastreuse = tb->fastreuse;
++	tb2->fastreuseport = tb->fastreuseport;
+ }
+ 
+ /* Obtain a reference to a local port for the given sock,
+@@ -582,7 +586,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
+ 	}
+ 
+ success:
+-	inet_csk_update_fastreuse(tb, sk);
++	inet_csk_update_fastreuse(sk, tb, tb2);
+ 
+ 	if (!inet_csk(sk)->icsk_bind_hash)
+ 		inet_bind_hash(sk, tb, tb2, port);
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index ceeeec9b7290a..4316c127f7896 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -58,6 +58,14 @@ static u32 sk_ehashfn(const struct sock *sk)
+ 			    sk->sk_daddr, sk->sk_dport);
+ }
+ 
++static bool sk_is_connect_bind(const struct sock *sk)
++{
++	if (sk->sk_state == TCP_TIME_WAIT)
++		return inet_twsk(sk)->tw_connect_bind;
++	else
++		return sk->sk_userlocks & SOCK_CONNECT_BIND;
++}
++
+ /*
+  * Allocate and initialize a new local port bind bucket.
+  * The bindhash mutex for snum's hash chain must be held here.
+@@ -87,10 +95,22 @@ struct inet_bind_bucket *inet_bind_bucket_create(struct kmem_cache *cachep,
+  */
+ void inet_bind_bucket_destroy(struct inet_bind_bucket *tb)
+ {
++	const struct inet_bind2_bucket *tb2;
++
+ 	if (hlist_empty(&tb->bhash2)) {
+ 		hlist_del_rcu(&tb->node);
+ 		kfree_rcu(tb, rcu);
++		return;
++	}
++
++	if (tb->fastreuse == -1 && tb->fastreuseport == -1)
++		return;
++	hlist_for_each_entry(tb2, &tb->bhash2, bhash_node) {
++		if (tb2->fastreuse != -1 || tb2->fastreuseport != -1)
++			return;
+ 	}
++	tb->fastreuse = -1;
++	tb->fastreuseport = -1;
+ }
+ 
+ bool inet_bind_bucket_match(const struct inet_bind_bucket *tb, const struct net *net,
+@@ -121,6 +141,8 @@ static void inet_bind2_bucket_init(struct inet_bind2_bucket *tb2,
+ #else
+ 	tb2->rcv_saddr = sk->sk_rcv_saddr;
+ #endif
++	tb2->fastreuse = 0;
++	tb2->fastreuseport = 0;
+ 	INIT_HLIST_HEAD(&tb2->owners);
+ 	hlist_add_head(&tb2->node, &head->chain);
+ 	hlist_add_head(&tb2->bhash_node, &tb->bhash2);
+@@ -143,11 +165,23 @@ struct inet_bind2_bucket *inet_bind2_bucket_create(struct kmem_cache *cachep,
+ /* Caller must hold hashbucket lock for this tb with local BH disabled */
+ void inet_bind2_bucket_destroy(struct kmem_cache *cachep, struct inet_bind2_bucket *tb)
+ {
++	const struct sock *sk;
++
+ 	if (hlist_empty(&tb->owners)) {
+ 		__hlist_del(&tb->node);
+ 		__hlist_del(&tb->bhash_node);
+ 		kmem_cache_free(cachep, tb);
++		return;
+ 	}
++
++	if (tb->fastreuse == -1 && tb->fastreuseport == -1)
++		return;
++	sk_for_each_bound(sk, &tb->owners) {
++		if (!sk_is_connect_bind(sk))
++			return;
++	}
++	tb->fastreuse = -1;
++	tb->fastreuseport = -1;
+ }
+ 
+ static bool inet_bind2_bucket_addr_match(const struct inet_bind2_bucket *tb2,
+@@ -191,6 +225,7 @@ static void __inet_put_port(struct sock *sk)
+ 	tb = inet_csk(sk)->icsk_bind_hash;
+ 	inet_csk(sk)->icsk_bind_hash = NULL;
+ 	inet_sk(sk)->inet_num = 0;
++	sk->sk_userlocks &= ~SOCK_CONNECT_BIND;
+ 
+ 	spin_lock(&head2->lock);
+ 	if (inet_csk(sk)->icsk_bind2_hash) {
+@@ -277,7 +312,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child)
+ 		}
+ 	}
+ 	if (update_fastreuse)
+-		inet_csk_update_fastreuse(tb, child);
++		inet_csk_update_fastreuse(child, tb, tb2);
+ 	inet_bind_hash(child, tb, tb2, port);
+ 	spin_unlock(&head2->lock);
+ 	spin_unlock(&head->lock);
+@@ -966,6 +1001,10 @@ static int __inet_bhash2_update_saddr(struct sock *sk, void *saddr, int family,
+ 	if (!tb2) {
+ 		tb2 = new_tb2;
+ 		inet_bind2_bucket_init(tb2, net, head2, inet_csk(sk)->icsk_bind_hash, sk);
++		if (sk_is_connect_bind(sk)) {
++			tb2->fastreuse = -1;
++			tb2->fastreuseport = -1;
++		}
+ 	}
+ 	inet_csk(sk)->icsk_bind2_hash = tb2;
+ 	sk_add_bind_node(sk, &tb2->owners);
+@@ -1136,6 +1175,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ 					       head2, tb, sk);
+ 		if (!tb2)
+ 			goto error;
++		tb2->fastreuse = -1;
++		tb2->fastreuseport = -1;
+ 	}
+ 
+ 	/* Here we want to add a little bit of randomness to the next source
+@@ -1148,6 +1189,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+ 
+ 	/* Head lock still held and bh's disabled */
+ 	inet_bind_hash(sk, tb, tb2, port);
++	sk->sk_userlocks |= SOCK_CONNECT_BIND;
+ 
+ 	if (sk_unhashed(sk)) {
+ 		inet_sk(sk)->inet_sport = htons(port);
+diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
+index 875ff923a8ed0..6fb9efdbee27a 100644
+--- a/net/ipv4/inet_timewait_sock.c
++++ b/net/ipv4/inet_timewait_sock.c
+@@ -206,6 +206,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk,
+ 		tw->tw_hash	    = sk->sk_hash;
+ 		tw->tw_ipv6only	    = 0;
+ 		tw->tw_transparent  = inet_test_bit(TRANSPARENT, sk);
++		tw->tw_connect_bind = !!(sk->sk_userlocks & SOCK_CONNECT_BIND);
+ 		tw->tw_prot	    = sk->sk_prot_creator;
+ 		atomic64_set(&tw->tw_cookie, atomic64_read(&sk->sk_cookie));
+ 		twsk_net_set(tw, sock_net(sk));
+-- 
+2.51.0
+
diff --git a/queue-6.17/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch b/queue-6.17/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
new file mode 100644
index 0000000000..f7870a2364
--- /dev/null
+++ b/queue-6.17/tcp-use-dst_dev_rcu-in-tcp_fastopen_active_disable_o.patch
@@ -0,0 +1,44 @@
+From 056ed69c755a3694985db1109d869f6f72bcc11b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 19:58:22 +0000
+Subject: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b62a59c18b692f892dcb8109c1c2e653b2abc95c ]
+
+Use RCU to avoid a pair of atomic operations and a potential
+UAF on dst_dev()->flags.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250828195823.3958522-8-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_fastopen.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
+index f1884f0c9e523..7d945a527daf0 100644
+--- a/net/ipv4/tcp_fastopen.c
++++ b/net/ipv4/tcp_fastopen.c
+@@ -576,11 +576,12 @@ void tcp_fastopen_active_disable_ofo_check(struct sock *sk)
+ 		}
+ 	} else if (tp->syn_fastopen_ch &&
+ 		   atomic_read(&sock_net(sk)->ipv4.tfo_active_disable_times)) {
+-		dst = sk_dst_get(sk);
+-		dev = dst ? dst_dev(dst) : NULL;
++		rcu_read_lock();
++		dst = __sk_dst_get(sk);
++		dev = dst ? dst_dev_rcu(dst) : NULL;
+ 		if (!(dev && (dev->flags & IFF_LOOPBACK)))
+ 			atomic_set(&sock_net(sk)->ipv4.tfo_active_disable_times, 0);
+-		dst_release(dst);
++		rcu_read_unlock();
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch b/queue-6.17/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
new file mode 100644
index 0000000000..af2dcde854
--- /dev/null
+++ b/queue-6.17/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,63 @@
+From d1bf313070708765315751674373afa9509ac40a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:42:29 +0200
+Subject: thunderbolt: Use is_pciehp instead of is_hotplug_bridge
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
+
+The thunderbolt driver sets up device link dependencies from hotplug ports
+to the Host Router (aka Native Host Interface, NHI).  When resuming from
+system sleep, this allows the Host Router to re-establish tunnels to
+attached Thunderbolt devices before the hotplug ports resume.
+
+To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
+flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
+
+Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
+more apt to identify them with the is_pciehp flag.
+
+Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
+support and are quirked to use legacy INTx interrupts instead.  The quirk
+identifies them with is_hotplug_bridge, even though all affected ports are
+also matched by is_pciehp.  So use is_pciehp here as well.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c     | 2 +-
+ drivers/thunderbolt/tb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 6eb3d20386e95..214ed060ca1b3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3830,7 +3830,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+  */
+ static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
+ {
+-	if (pdev->is_hotplug_bridge &&
++	if (pdev->is_pciehp &&
+ 	    (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
+ 	     pdev->revision <= 1))
+ 		pdev->no_msi = 1;
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index c14ab1fbeeafd..83a33fc1486ab 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -3336,7 +3336,7 @@ static bool tb_apple_add_links(struct tb_nhi *nhi)
+ 		if (!pci_is_pcie(pdev))
+ 			continue;
+ 		if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
+-		    !pdev->is_hotplug_bridge)
++		    !pdev->is_pciehp)
+ 			continue;
+ 
+ 		link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+-- 
+2.51.0
+
diff --git a/queue-6.17/tools-ynl-gen-validate-nested-arrays.patch b/queue-6.17/tools-ynl-gen-validate-nested-arrays.patch
new file mode 100644
index 0000000000..e94b314c7a
--- /dev/null
+++ b/queue-6.17/tools-ynl-gen-validate-nested-arrays.patch
@@ -0,0 +1,139 @@
+From 1461fe383f00ae5a82421ca75dfeb598b0323bf7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:42:51 +0000
+Subject: tools: ynl-gen: validate nested arrays
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+
+[ Upstream commit 1d99aa4ed707c5630a7a7f067c8818e19167e3a1 ]
+
+In nested arrays don't require that the intermediate attribute
+type should be a valid attribute type, it might just be zero
+or an incrementing index, it is often not even used.
+
+See include/net/netlink.h about NLA_NESTED_ARRAY:
+> The difference to NLA_NESTED is the structure:
+> NLA_NESTED has the nested attributes directly inside
+> while an array has the nested attributes at another
+> level down and the attribute types directly in the
+> nesting don't matter.
+
+Example based on include/uapi/linux/wireguard.h:
+ > WGDEVICE_A_PEERS: NLA_NESTED
+ >   0: NLA_NESTED
+ >     WGPEER_A_PUBLIC_KEY: NLA_EXACT_LEN, len WG_KEY_LEN
+ >     [..]
+ >   0: NLA_NESTED
+ >     ...
+ >   ...
+
+Previous the check required that the nested type was valid
+in the parent attribute set, which in this case resolves to
+WGDEVICE_A_UNSPEC, which is YNL_PT_REJECT, and it took the
+early exit and returned YNL_PARSE_CB_ERROR.
+
+This patch renames the old nl_attr_validate() to
+__nl_attr_validate(), and creates a new inline function
+nl_attr_validate() to mimic the old one.
+
+The new __nl_attr_validate() takes the attribute type as an
+argument, so we can use it to validate attributes of a
+nested attribute, in the context of the parents attribute
+type, which in the above case is generated as:
+[WGDEVICE_A_PEERS] = {
+  .name = "peers",
+  .type = YNL_PT_NEST,
+  .nest = &wireguard_wgpeer_nest,
+},
+
+__nl_attr_validate() only checks if the attribute length
+is plausible for a given attribute type, so the .nest in
+the above example is not used.
+
+As the new inline function needs to be defined after
+ynl_attr_type(), then the definitions are moved down,
+so we avoid a forward declaration of ynl_attr_type().
+
+Some other examples are NL80211_BAND_ATTR_FREQS (nest) and
+NL80211_ATTR_SUPPORTED_COMMANDS (u32) both in nl80211-user.c
+$ make -C tools/net/ynl/generated nl80211-user.c
+
+Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://patch.msgid.link/20250915144301.725949-7-ast@fiberby.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/net/ynl/lib/ynl-priv.h     | 10 +++++++++-
+ tools/net/ynl/lib/ynl.c          |  6 +++---
+ tools/net/ynl/pyynl/ynl_gen_c.py |  2 +-
+ 3 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/tools/net/ynl/lib/ynl-priv.h b/tools/net/ynl/lib/ynl-priv.h
+index fca519d7ec9a7..ced7dce44efb4 100644
+--- a/tools/net/ynl/lib/ynl-priv.h
++++ b/tools/net/ynl/lib/ynl-priv.h
+@@ -106,7 +106,6 @@ ynl_gemsg_start_req(struct ynl_sock *ys, __u32 id, __u8 cmd, __u8 version);
+ struct nlmsghdr *
+ ynl_gemsg_start_dump(struct ynl_sock *ys, __u32 id, __u8 cmd, __u8 version);
+ 
+-int ynl_attr_validate(struct ynl_parse_arg *yarg, const struct nlattr *attr);
+ int ynl_submsg_failed(struct ynl_parse_arg *yarg, const char *field_name,
+ 		      const char *sel_name);
+ 
+@@ -467,4 +466,13 @@ ynl_attr_put_sint(struct nlmsghdr *nlh, __u16 type, __s64 data)
+ 	else
+ 		ynl_attr_put_s64(nlh, type, data);
+ }
++
++int __ynl_attr_validate(struct ynl_parse_arg *yarg, const struct nlattr *attr,
++			unsigned int type);
++
++static inline int ynl_attr_validate(struct ynl_parse_arg *yarg,
++				    const struct nlattr *attr)
++{
++	return __ynl_attr_validate(yarg, attr, ynl_attr_type(attr));
++}
+ #endif
+diff --git a/tools/net/ynl/lib/ynl.c b/tools/net/ynl/lib/ynl.c
+index 2a169c3c07979..2bcd781111d74 100644
+--- a/tools/net/ynl/lib/ynl.c
++++ b/tools/net/ynl/lib/ynl.c
+@@ -360,15 +360,15 @@ static int ynl_cb_done(const struct nlmsghdr *nlh, struct ynl_parse_arg *yarg)
+ 
+ /* Attribute validation */
+ 
+-int ynl_attr_validate(struct ynl_parse_arg *yarg, const struct nlattr *attr)
++int __ynl_attr_validate(struct ynl_parse_arg *yarg, const struct nlattr *attr,
++			unsigned int type)
+ {
+ 	const struct ynl_policy_attr *policy;
+-	unsigned int type, len;
+ 	unsigned char *data;
++	unsigned int len;
+ 
+ 	data = ynl_attr_data(attr);
+ 	len = ynl_attr_data_len(attr);
+-	type = ynl_attr_type(attr);
+ 	if (type > yarg->rsp_policy->max_attr) {
+ 		yerr(yarg->ys, YNL_ERROR_INTERNAL,
+ 		     "Internal error, validating unknown attribute");
+diff --git a/tools/net/ynl/pyynl/ynl_gen_c.py b/tools/net/ynl/pyynl/ynl_gen_c.py
+index eb295756c3bf7..6e3e52a5caaff 100755
+--- a/tools/net/ynl/pyynl/ynl_gen_c.py
++++ b/tools/net/ynl/pyynl/ynl_gen_c.py
+@@ -828,7 +828,7 @@ class TypeArrayNest(Type):
+         local_vars = ['const struct nlattr *attr2;']
+         get_lines = [f'attr_{self.c_name} = attr;',
+                      'ynl_attr_for_each_nested(attr2, attr) {',
+-                     '\tif (ynl_attr_validate(yarg, attr2))',
++                     '\tif (__ynl_attr_validate(yarg, attr2, type))',
+                      '\t\treturn YNL_PARSE_CB_ERROR;',
+                      f'\tn_{self.c_name}++;',
+                      '}']
+-- 
+2.51.0
+
diff --git a/queue-6.17/tty-serial-ip22zilog-use-platform-device-for-probing.patch b/queue-6.17/tty-serial-ip22zilog-use-platform-device-for-probing.patch
new file mode 100644
index 0000000000..68392437a0
--- /dev/null
+++ b/queue-6.17/tty-serial-ip22zilog-use-platform-device-for-probing.patch
@@ -0,0 +1,534 @@
+From bb9f771d811c174c8cf9c2bd887028acc5c4d09b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jul 2025 15:40:17 +0200
+Subject: tty: serial: ip22zilog: Use platform device for probing
+
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+
+[ Upstream commit 3fc36ae6abd263a5cbf93b2f5539eccc1fc753f7 ]
+
+After commit 84a9582fd203 ("serial: core: Start managing serial controllers
+to enable runtime PM") serial drivers need to provide a device in
+struct uart_port.dev otherwise an oops happens. To fix this issue
+for ip22zilog driver switch driver to a platform driver and setup
+the serial device in sgi-ip22 code.
+
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Link: https://lore.kernel.org/r/20250725134018.136113-1-tsbogend@alpha.franken.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/sgi-ip22/ip22-platform.c |  32 +++
+ drivers/tty/serial/ip22zilog.c     | 352 ++++++++++++-----------------
+ 2 files changed, 175 insertions(+), 209 deletions(-)
+
+diff --git a/arch/mips/sgi-ip22/ip22-platform.c b/arch/mips/sgi-ip22/ip22-platform.c
+index 0b2002e02a477..3a53690b4b333 100644
+--- a/arch/mips/sgi-ip22/ip22-platform.c
++++ b/arch/mips/sgi-ip22/ip22-platform.c
+@@ -221,3 +221,35 @@ static int __init sgi_ds1286_devinit(void)
+ }
+ 
+ device_initcall(sgi_ds1286_devinit);
++
++#define SGI_ZILOG_BASE	(HPC3_CHIP0_BASE + \
++			 offsetof(struct hpc3_regs, pbus_extregs[6]) + \
++			 offsetof(struct sgioc_regs, uart))
++
++static struct resource sgi_zilog_resources[] = {
++	{
++		.start	= SGI_ZILOG_BASE,
++		.end	= SGI_ZILOG_BASE + 15,
++		.flags	= IORESOURCE_MEM
++	},
++	{
++		.start	= SGI_SERIAL_IRQ,
++		.end	= SGI_SERIAL_IRQ,
++		.flags	= IORESOURCE_IRQ
++	}
++};
++
++static struct platform_device zilog_device = {
++	.name		= "ip22zilog",
++	.id		= 0,
++	.num_resources	= ARRAY_SIZE(sgi_zilog_resources),
++	.resource	= sgi_zilog_resources,
++};
++
++
++static int __init sgi_zilog_devinit(void)
++{
++	return platform_device_register(&zilog_device);
++}
++
++device_initcall(sgi_zilog_devinit);
+diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
+index c2cae50f06f33..6e19c6713849a 100644
+--- a/drivers/tty/serial/ip22zilog.c
++++ b/drivers/tty/serial/ip22zilog.c
+@@ -30,6 +30,7 @@
+ #include <linux/console.h>
+ #include <linux/spinlock.h>
+ #include <linux/init.h>
++#include <linux/platform_device.h>
+ 
+ #include <linux/io.h>
+ #include <asm/irq.h>
+@@ -50,8 +51,9 @@
+ #define ZSDELAY_LONG()		udelay(20)
+ #define ZS_WSYNC(channel)	do { } while (0)
+ 
+-#define NUM_IP22ZILOG		1
+-#define NUM_CHANNELS		(NUM_IP22ZILOG * 2)
++#define NUM_CHANNELS		2
++#define CHANNEL_B		0
++#define CHANNEL_A		1
+ 
+ #define ZS_CLOCK		3672000	/* Zilog input clock rate. */
+ #define ZS_CLOCK_DIVISOR	16      /* Divisor this driver uses. */
+@@ -62,9 +64,6 @@
+ struct uart_ip22zilog_port {
+ 	struct uart_port		port;
+ 
+-	/* IRQ servicing chain.  */
+-	struct uart_ip22zilog_port	*next;
+-
+ 	/* Current values of Zilog write registers.  */
+ 	unsigned char			curregs[NUM_ZSREGS];
+ 
+@@ -72,7 +71,6 @@ struct uart_ip22zilog_port {
+ #define IP22ZILOG_FLAG_IS_CONS		0x00000004
+ #define IP22ZILOG_FLAG_IS_KGDB		0x00000008
+ #define IP22ZILOG_FLAG_MODEM_STATUS	0x00000010
+-#define IP22ZILOG_FLAG_IS_CHANNEL_A	0x00000020
+ #define IP22ZILOG_FLAG_REGS_HELD	0x00000040
+ #define IP22ZILOG_FLAG_TX_STOPPED	0x00000080
+ #define IP22ZILOG_FLAG_TX_ACTIVE	0x00000100
+@@ -84,6 +82,8 @@ struct uart_ip22zilog_port {
+ 	unsigned char			prev_status;
+ };
+ 
++static struct uart_ip22zilog_port ip22zilog_port_table[NUM_CHANNELS];
++
+ #define ZILOG_CHANNEL_FROM_PORT(PORT)	((struct zilog_channel *)((PORT)->membase))
+ #define UART_ZILOG(PORT)		((struct uart_ip22zilog_port *)(PORT))
+ #define IP22ZILOG_GET_CURR_REG(PORT, REGNUM)		\
+@@ -93,7 +93,6 @@ struct uart_ip22zilog_port {
+ #define ZS_IS_CONS(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_CONS)
+ #define ZS_IS_KGDB(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_KGDB)
+ #define ZS_WANTS_MODEM_STATUS(UP)	((UP)->flags & IP22ZILOG_FLAG_MODEM_STATUS)
+-#define ZS_IS_CHANNEL_A(UP)	((UP)->flags & IP22ZILOG_FLAG_IS_CHANNEL_A)
+ #define ZS_REGS_HELD(UP)	((UP)->flags & IP22ZILOG_FLAG_REGS_HELD)
+ #define ZS_TX_STOPPED(UP)	((UP)->flags & IP22ZILOG_FLAG_TX_STOPPED)
+ #define ZS_TX_ACTIVE(UP)	((UP)->flags & IP22ZILOG_FLAG_TX_ACTIVE)
+@@ -423,60 +422,57 @@ static void ip22zilog_transmit_chars(struct uart_ip22zilog_port *up,
+ 
+ static irqreturn_t ip22zilog_interrupt(int irq, void *dev_id)
+ {
+-	struct uart_ip22zilog_port *up = dev_id;
+-
+-	while (up) {
+-		struct zilog_channel *channel
+-			= ZILOG_CHANNEL_FROM_PORT(&up->port);
+-		unsigned char r3;
+-		bool push = false;
+-
+-		uart_port_lock(&up->port);
+-		r3 = read_zsreg(channel, R3);
++	struct uart_ip22zilog_port *up;
++	struct zilog_channel *channel;
++	unsigned char r3;
++	bool push = false;
+ 
+-		/* Channel A */
+-		if (r3 & (CHAEXT | CHATxIP | CHARxIP)) {
+-			writeb(RES_H_IUS, &channel->control);
+-			ZSDELAY();
+-			ZS_WSYNC(channel);
++	up = &ip22zilog_port_table[CHANNEL_A];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+ 
+-			if (r3 & CHARxIP)
+-				push = ip22zilog_receive_chars(up, channel);
+-			if (r3 & CHAEXT)
+-				ip22zilog_status_handle(up, channel);
+-			if (r3 & CHATxIP)
+-				ip22zilog_transmit_chars(up, channel);
+-		}
+-		uart_port_unlock(&up->port);
++	uart_port_lock(&up->port);
++	r3 = read_zsreg(channel, R3);
+ 
+-		if (push)
+-			tty_flip_buffer_push(&up->port.state->port);
++	/* Channel A */
++	if (r3 & (CHAEXT | CHATxIP | CHARxIP)) {
++		writeb(RES_H_IUS, &channel->control);
++		ZSDELAY();
++		ZS_WSYNC(channel);
+ 
+-		/* Channel B */
+-		up = up->next;
+-		channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+-		push = false;
++		if (r3 & CHARxIP)
++			push = ip22zilog_receive_chars(up, channel);
++		if (r3 & CHAEXT)
++			ip22zilog_status_handle(up, channel);
++		if (r3 & CHATxIP)
++			ip22zilog_transmit_chars(up, channel);
++	}
++	uart_port_unlock(&up->port);
+ 
+-		uart_port_lock(&up->port);
+-		if (r3 & (CHBEXT | CHBTxIP | CHBRxIP)) {
+-			writeb(RES_H_IUS, &channel->control);
+-			ZSDELAY();
+-			ZS_WSYNC(channel);
++	if (push)
++		tty_flip_buffer_push(&up->port.state->port);
+ 
+-			if (r3 & CHBRxIP)
+-				push = ip22zilog_receive_chars(up, channel);
+-			if (r3 & CHBEXT)
+-				ip22zilog_status_handle(up, channel);
+-			if (r3 & CHBTxIP)
+-				ip22zilog_transmit_chars(up, channel);
+-		}
+-		uart_port_unlock(&up->port);
++	/* Channel B */
++	up = &ip22zilog_port_table[CHANNEL_B];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
++	push = false;
+ 
+-		if (push)
+-			tty_flip_buffer_push(&up->port.state->port);
++	uart_port_lock(&up->port);
++	if (r3 & (CHBEXT | CHBTxIP | CHBRxIP)) {
++		writeb(RES_H_IUS, &channel->control);
++		ZSDELAY();
++		ZS_WSYNC(channel);
+ 
+-		up = up->next;
++		if (r3 & CHBRxIP)
++			push = ip22zilog_receive_chars(up, channel);
++		if (r3 & CHBEXT)
++			ip22zilog_status_handle(up, channel);
++		if (r3 & CHBTxIP)
++			ip22zilog_transmit_chars(up, channel);
+ 	}
++	uart_port_unlock(&up->port);
++
++	if (push)
++		tty_flip_buffer_push(&up->port.state->port);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -692,16 +688,16 @@ static void __ip22zilog_reset(struct uart_ip22zilog_port *up)
+ 		udelay(100);
+ 	}
+ 
+-	if (!ZS_IS_CHANNEL_A(up)) {
+-		up++;
+-		channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
+-	}
++	up = &ip22zilog_port_table[CHANNEL_A];
++	channel = ZILOG_CHANNEL_FROM_PORT(&up->port);
++
+ 	write_zsreg(channel, R9, FHWRES);
+ 	ZSDELAY_LONG();
+ 	(void) read_zsreg(channel, R0);
+ 
+ 	up->flags |= IP22ZILOG_FLAG_RESET_DONE;
+-	up->next->flags |= IP22ZILOG_FLAG_RESET_DONE;
++	up = &ip22zilog_port_table[CHANNEL_B];
++	up->flags |= IP22ZILOG_FLAG_RESET_DONE;
+ }
+ 
+ static void __ip22zilog_startup(struct uart_ip22zilog_port *up)
+@@ -942,47 +938,6 @@ static const struct uart_ops ip22zilog_pops = {
+ 	.verify_port	=	ip22zilog_verify_port,
+ };
+ 
+-static struct uart_ip22zilog_port *ip22zilog_port_table;
+-static struct zilog_layout **ip22zilog_chip_regs;
+-
+-static struct uart_ip22zilog_port *ip22zilog_irq_chain;
+-static int zilog_irq = -1;
+-
+-static void * __init alloc_one_table(unsigned long size)
+-{
+-	return kzalloc(size, GFP_KERNEL);
+-}
+-
+-static void __init ip22zilog_alloc_tables(void)
+-{
+-	ip22zilog_port_table = (struct uart_ip22zilog_port *)
+-		alloc_one_table(NUM_CHANNELS * sizeof(struct uart_ip22zilog_port));
+-	ip22zilog_chip_regs = (struct zilog_layout **)
+-		alloc_one_table(NUM_IP22ZILOG * sizeof(struct zilog_layout *));
+-
+-	if (ip22zilog_port_table == NULL || ip22zilog_chip_regs == NULL) {
+-		panic("IP22-Zilog: Cannot allocate IP22-Zilog tables.");
+-	}
+-}
+-
+-/* Get the address of the registers for IP22-Zilog instance CHIP.  */
+-static struct zilog_layout * __init get_zs(int chip)
+-{
+-	unsigned long base;
+-
+-	if (chip < 0 || chip >= NUM_IP22ZILOG) {
+-		panic("IP22-Zilog: Illegal chip number %d in get_zs.", chip);
+-	}
+-
+-	/* Not probe-able, hard code it. */
+-	base = (unsigned long) &sgioc->uart;
+-
+-	zilog_irq = SGI_SERIAL_IRQ;
+-	request_mem_region(base, 8, "IP22-Zilog");
+-
+-	return (struct zilog_layout *) base;
+-}
+-
+ #define ZS_PUT_CHAR_MAX_DELAY	2000	/* 10 ms */
+ 
+ #ifdef CONFIG_SERIAL_IP22_ZILOG_CONSOLE
+@@ -1070,144 +1025,123 @@ static struct uart_driver ip22zilog_reg = {
+ #endif
+ };
+ 
+-static void __init ip22zilog_prepare(void)
++static void __init ip22zilog_prepare(struct uart_ip22zilog_port *up)
+ {
+ 	unsigned char sysrq_on = IS_ENABLED(CONFIG_SERIAL_IP22_ZILOG_CONSOLE);
++	int brg;
++
++	spin_lock_init(&up->port.lock);
++
++	up->port.iotype = UPIO_MEM;
++	up->port.uartclk = ZS_CLOCK;
++	up->port.fifosize = 1;
++	up->port.has_sysrq = sysrq_on;
++	up->port.ops = &ip22zilog_pops;
++	up->port.type = PORT_IP22ZILOG;
++
++	/* Normal serial TTY. */
++	up->parity_mask = 0xff;
++	up->curregs[R1] = EXT_INT_ENAB | INT_ALL_Rx | TxINT_ENAB;
++	up->curregs[R4] = PAR_EVEN | X16CLK | SB1;
++	up->curregs[R3] = RxENAB | Rx8;
++	up->curregs[R5] = TxENAB | Tx8;
++	up->curregs[R9] = NV | MIE;
++	up->curregs[R10] = NRZ;
++	up->curregs[R11] = TCBR | RCBR;
++	brg = BPS_TO_BRG(9600, ZS_CLOCK / ZS_CLOCK_DIVISOR);
++	up->curregs[R12] = (brg & 0xff);
++	up->curregs[R13] = (brg >> 8) & 0xff;
++	up->curregs[R14] = BRENAB;
++}
++
++static int ip22zilog_probe(struct platform_device *pdev)
++{
+ 	struct uart_ip22zilog_port *up;
+-	struct zilog_layout *rp;
+-	int channel, chip;
++	char __iomem *membase;
++	struct resource *res;
++	int irq;
++	int i;
+ 
+-	/*
+-	 * Temporary fix.
+-	 */
+-	for (channel = 0; channel < NUM_CHANNELS; channel++)
+-		spin_lock_init(&ip22zilog_port_table[channel].port.lock);
+-
+-	ip22zilog_irq_chain = &ip22zilog_port_table[NUM_CHANNELS - 1];
+-        up = &ip22zilog_port_table[0];
+-	for (channel = NUM_CHANNELS - 1 ; channel > 0; channel--)
+-		up[channel].next = &up[channel - 1];
+-	up[channel].next = NULL;
+-
+-	for (chip = 0; chip < NUM_IP22ZILOG; chip++) {
+-		if (!ip22zilog_chip_regs[chip]) {
+-			ip22zilog_chip_regs[chip] = rp = get_zs(chip);
+-
+-			up[(chip * 2) + 0].port.membase = (char *) &rp->channelB;
+-			up[(chip * 2) + 1].port.membase = (char *) &rp->channelA;
+-
+-			/* In theory mapbase is the physical address ...  */
+-			up[(chip * 2) + 0].port.mapbase =
+-				(unsigned long) ioremap((unsigned long) &rp->channelB, 8);
+-			up[(chip * 2) + 1].port.mapbase =
+-				(unsigned long) ioremap((unsigned long) &rp->channelA, 8);
+-		}
++	up = &ip22zilog_port_table[CHANNEL_B];
++	if (up->port.dev)
++		return -ENOSPC;
+ 
+-		/* Channel A */
+-		up[(chip * 2) + 0].port.iotype = UPIO_MEM;
+-		up[(chip * 2) + 0].port.irq = zilog_irq;
+-		up[(chip * 2) + 0].port.uartclk = ZS_CLOCK;
+-		up[(chip * 2) + 0].port.fifosize = 1;
+-		up[(chip * 2) + 0].port.has_sysrq = sysrq_on;
+-		up[(chip * 2) + 0].port.ops = &ip22zilog_pops;
+-		up[(chip * 2) + 0].port.type = PORT_IP22ZILOG;
+-		up[(chip * 2) + 0].port.flags = 0;
+-		up[(chip * 2) + 0].port.line = (chip * 2) + 0;
+-		up[(chip * 2) + 0].flags = 0;
+-
+-		/* Channel B */
+-		up[(chip * 2) + 1].port.iotype = UPIO_MEM;
+-		up[(chip * 2) + 1].port.irq = zilog_irq;
+-		up[(chip * 2) + 1].port.uartclk = ZS_CLOCK;
+-		up[(chip * 2) + 1].port.fifosize = 1;
+-		up[(chip * 2) + 1].port.has_sysrq = sysrq_on;
+-		up[(chip * 2) + 1].port.ops = &ip22zilog_pops;
+-		up[(chip * 2) + 1].port.type = PORT_IP22ZILOG;
+-		up[(chip * 2) + 1].port.line = (chip * 2) + 1;
+-		up[(chip * 2) + 1].flags |= IP22ZILOG_FLAG_IS_CHANNEL_A;
+-	}
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
+ 
+-	for (channel = 0; channel < NUM_CHANNELS; channel++) {
+-		struct uart_ip22zilog_port *up = &ip22zilog_port_table[channel];
+-		int brg;
++	membase = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
++	if (IS_ERR(membase))
++		return PTR_ERR(membase);
+ 
+-		/* Normal serial TTY. */
+-		up->parity_mask = 0xff;
+-		up->curregs[R1] = EXT_INT_ENAB | INT_ALL_Rx | TxINT_ENAB;
+-		up->curregs[R4] = PAR_EVEN | X16CLK | SB1;
+-		up->curregs[R3] = RxENAB | Rx8;
+-		up->curregs[R5] = TxENAB | Tx8;
+-		up->curregs[R9] = NV | MIE;
+-		up->curregs[R10] = NRZ;
+-		up->curregs[R11] = TCBR | RCBR;
+-		brg = BPS_TO_BRG(9600, ZS_CLOCK / ZS_CLOCK_DIVISOR);
+-		up->curregs[R12] = (brg & 0xff);
+-		up->curregs[R13] = (brg >> 8) & 0xff;
+-		up->curregs[R14] = BRENAB;
+-	}
+-}
++	ip22zilog_prepare(up);
+ 
+-static int __init ip22zilog_ports_init(void)
+-{
+-	int ret;
++	up->port.mapbase = res->start + offsetof(struct zilog_layout, channelB);
++	up->port.membase = membase + offsetof(struct zilog_layout, channelB);
++	up->port.line = 0;
++	up->port.dev = &pdev->dev;
++	up->port.irq = irq;
+ 
+-	printk(KERN_INFO "Serial: IP22 Zilog driver (%d chips).\n", NUM_IP22ZILOG);
++	up = &ip22zilog_port_table[CHANNEL_A];
++	ip22zilog_prepare(up);
+ 
+-	ip22zilog_prepare();
++	up->port.mapbase = res->start + offsetof(struct zilog_layout, channelA);
++	up->port.membase = membase + offsetof(struct zilog_layout, channelA);
++	up->port.line = 1;
++	up->port.dev = &pdev->dev;
++	up->port.irq = irq;
+ 
+-	if (request_irq(zilog_irq, ip22zilog_interrupt, 0,
+-			"IP22-Zilog", ip22zilog_irq_chain)) {
++	if (request_irq(irq, ip22zilog_interrupt, 0,
++			"IP22-Zilog", NULL)) {
+ 		panic("IP22-Zilog: Unable to register zs interrupt handler.\n");
+ 	}
+ 
+-	ret = uart_register_driver(&ip22zilog_reg);
+-	if (ret == 0) {
+-		int i;
+-
+-		for (i = 0; i < NUM_CHANNELS; i++) {
+-			struct uart_ip22zilog_port *up = &ip22zilog_port_table[i];
+-
+-			uart_add_one_port(&ip22zilog_reg, &up->port);
+-		}
+-	}
+-
+-	return ret;
+-}
+-
+-static int __init ip22zilog_init(void)
+-{
+-	/* IP22 Zilog setup is hard coded, no probing to do.  */
+-	ip22zilog_alloc_tables();
+-	ip22zilog_ports_init();
++	for (i = 0; i < NUM_CHANNELS; i++)
++		uart_add_one_port(&ip22zilog_reg,
++				  &ip22zilog_port_table[i].port);
+ 
+ 	return 0;
+ }
+ 
+-static void __exit ip22zilog_exit(void)
++static void ip22zilog_remove(struct platform_device *pdev)
+ {
+ 	int i;
+-	struct uart_ip22zilog_port *up;
+ 
+ 	for (i = 0; i < NUM_CHANNELS; i++) {
+-		up = &ip22zilog_port_table[i];
+-
+-		uart_remove_one_port(&ip22zilog_reg, &up->port);
++		uart_remove_one_port(&ip22zilog_reg,
++				     &ip22zilog_port_table[i].port);
++		ip22zilog_port_table[i].port.dev = NULL;
+ 	}
++}
+ 
+-	/* Free IO mem */
+-	up = &ip22zilog_port_table[0];
+-	for (i = 0; i < NUM_IP22ZILOG; i++) {
+-		if (up[(i * 2) + 0].port.mapbase) {
+-		   iounmap((void*)up[(i * 2) + 0].port.mapbase);
+-		   up[(i * 2) + 0].port.mapbase = 0;
+-		}
+-		if (up[(i * 2) + 1].port.mapbase) {
+-			iounmap((void*)up[(i * 2) + 1].port.mapbase);
+-			up[(i * 2) + 1].port.mapbase = 0;
+-		}
++static struct platform_driver ip22zilog_driver = {
++	.probe	= ip22zilog_probe,
++	.remove	= ip22zilog_remove,
++	.driver	= {
++		.name = "ip22zilog"
+ 	}
++};
++
++static int __init ip22zilog_init(void)
++{
++	int ret;
++
++	ret = uart_register_driver(&ip22zilog_reg);
++	if (ret)
++		return ret;
++
++	ret = platform_driver_register(&ip22zilog_driver);
++	if (ret)
++		uart_unregister_driver(&ip22zilog_reg);
+ 
++	return ret;
++
++}
++
++static void __exit ip22zilog_exit(void)
++{
+ 	uart_unregister_driver(&ip22zilog_reg);
++	platform_driver_unregister(&ip22zilog_driver);
+ }
+ 
+ module_init(ip22zilog_init);
+-- 
+2.51.0
+
diff --git a/queue-6.17/tty-serial-modify-the-use-of-dev_err_probe.patch b/queue-6.17/tty-serial-modify-the-use-of-dev_err_probe.patch
new file mode 100644
index 0000000000..6bc63e8c88
--- /dev/null
+++ b/queue-6.17/tty-serial-modify-the-use-of-dev_err_probe.patch
@@ -0,0 +1,54 @@
+From 3207fd64309b08d6e5ca6f060af73964963b9d82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 20:09:27 +0800
+Subject: tty: serial: Modify the use of dev_err_probe()
+
+From: Xichao Zhao <zhao.xichao@vivo.com>
+
+[ Upstream commit 706c3c02eecd41dc675e9102b3719661cd3e30e2 ]
+
+The dev_err_probe() doesn't do anything when error is '-ENOMEM'.
+Make the following two changes:
+(1) Replace -ENOMEM with -ENOSPC in max3100_probe().
+(2) Just return -ENOMEM instead in max310x_probe().
+
+Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250819120927.607744-1-zhao.xichao@vivo.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max3100.c | 2 +-
+ drivers/tty/serial/max310x.c | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c
+index 67d80f8f801e9..3faa1b6aa3eed 100644
+--- a/drivers/tty/serial/max3100.c
++++ b/drivers/tty/serial/max3100.c
+@@ -705,7 +705,7 @@ static int max3100_probe(struct spi_device *spi)
+ 			break;
+ 	if (i == MAX_MAX3100) {
+ 		mutex_unlock(&max3100s_lock);
+-		return dev_err_probe(dev, -ENOMEM, "too many MAX3100 chips\n");
++		return dev_err_probe(dev, -ENOSPC, "too many MAX3100 chips\n");
+ 	}
+ 
+ 	max3100s[i] = kzalloc(sizeof(struct max3100_port), GFP_KERNEL);
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index d9a0100b92d2b..e8749b8629703 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1269,8 +1269,7 @@ static int max310x_probe(struct device *dev, const struct max310x_devtype *devty
+ 	/* Alloc port structure */
+ 	s = devm_kzalloc(dev, struct_size(s, p, devtype->nr), GFP_KERNEL);
+ 	if (!s)
+-		return dev_err_probe(dev, -ENOMEM,
+-				     "Error allocating port structure\n");
++		return -ENOMEM;
+ 
+ 	/* Always ask for fixed clock rate from a property. */
+ 	device_property_read_u32(dev, "clock-frequency", &uartclk);
+-- 
+2.51.0
+
diff --git a/queue-6.17/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch b/queue-6.17/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
new file mode 100644
index 0000000000..a83f3da5d9
--- /dev/null
+++ b/queue-6.17/tty-vt-add-missing-return-value-for-vt_resize-in-vt_.patch
@@ -0,0 +1,39 @@
+From 3de2ba518c87631710619e9b6cbd36ec7471677b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 10:39:55 +0800
+Subject: tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()
+
+From: Zizhi Wo <wozizhi@huaweicloud.com>
+
+[ Upstream commit da7e8b3823962b13e713d4891e136a261ed8e6a2 ]
+
+In vt_ioctl(), the handler for VT_RESIZE always returns 0, which prevents
+users from detecting errors. Add the missing return value so that errors
+can be properly reported to users like vt_resizex().
+
+Signed-off-by: Zizhi Wo <wozizhi@huaweicloud.com>
+Link: https://lore.kernel.org/r/20250904023955.3892120-1-wozizhi@huaweicloud.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/vt/vt_ioctl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 61342e06970a0..eddb25bec996e 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -923,7 +923,9 @@ int vt_ioctl(struct tty_struct *tty,
+ 
+ 			if (vc) {
+ 				/* FIXME: review v tty lock */
+-				__vc_resize(vc_cons[i].d, cc, ll, true);
++				ret = __vc_resize(vc_cons[i].d, cc, ll, true);
++				if (ret)
++					return ret;
+ 			}
+ 		}
+ 		console_unlock();
+-- 
+2.51.0
+
diff --git a/queue-6.17/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-6.17/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..b49ef9b3ce
--- /dev/null
+++ b/queue-6.17/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 3f9feba79e3bfcd9f5ad7f50728b2ba083511697 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index ff66db48453cf..944b3cf25468e 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -930,7 +930,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-cdns3-gadget-use-after-free-during-failed-initia.patch b/queue-6.17/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
new file mode 100644
index 0000000000..b89fb29a8e
--- /dev/null
+++ b/queue-6.17/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
@@ -0,0 +1,62 @@
+From 73f803355d9362398d56940aec78aa1e83569454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:48:42 +0800
+Subject: usb: cdns3: gadget: Use-after-free during failed initialization and
+ exit of cdnsp gadget
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
+
+In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
+structure (pdev->gadget) was freed before its endpoints.
+The endpoints are linked via the ep_list in the gadget structure.
+Freeing the gadget first leaves dangling pointers in the endpoint list.
+When the endpoints are subsequently freed, this results in a use-after-free.
+
+Fix:
+By separating the usb_del_gadget_udc() operation into distinct "del" and
+"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
+final release of the gadget structure with usb_put_gadget().
+
+A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
+ only after freeing endpoints").
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index 55f95f41b3b4d..0252560cbc80b 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1976,7 +1976,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
+ 	return 0;
+ 
+ del_gadget:
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
++	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
++	goto halt_pdev;
+ free_endpoints:
+ 	cdnsp_gadget_free_endpoints(pdev);
+ halt_pdev:
+@@ -1998,8 +2001,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
+ 	devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
+ 	pm_runtime_mark_last_busy(cdns->dev);
+ 	pm_runtime_put_autosuspend(cdns->dev);
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
+ 	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
+ 	cdnsp_mem_cleanup(pdev);
+ 	kfree(pdev);
+ 	cdns->gadget_dev = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-6.17/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..f9637e14c5
--- /dev/null
+++ b/queue-6.17/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From 8c9a53d8811455c7800bfccabc307d756af153e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 08a251df20c43..04058261cdd03 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -2407,7 +2407,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -2431,6 +2436,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-6.17/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..2be7371ed2
--- /dev/null
+++ b/queue-6.17/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From c10e155a68fcd9f621d6fa546e37c7e7d68f6467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 8e1d1e8840503..307ea563af95e 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -511,7 +511,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -967,7 +967,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-6.17/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..f522d1d583
--- /dev/null
+++ b/queue-6.17/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From b8dce7b5e3a9a6a89e5cbb20b81bd8142ae46d1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 0148d60926dcf..0e38330271d5a 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1465,6 +1465,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us))
+@@ -1759,7 +1761,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-6.17/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..4bdf7c25af
--- /dev/null
+++ b/queue-6.17/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From aa1d74695844fdd3c4387c85bcbae3ebac19a9d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index c93b43f5bc461..e713fc5964b18 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch b/queue-6.17/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
new file mode 100644
index 0000000000..3ab17b0b52
--- /dev/null
+++ b/queue-6.17/usb-xhci-pci-add-support-for-hosts-with-zero-usb3-po.patch
@@ -0,0 +1,97 @@
+From ebf0cf2103bf9952455af7a36e6a03b3ce41b4ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 00:07:22 +0300
+Subject: usb: xhci-pci: add support for hosts with zero USB3 ports
+
+From: Niklas Neronin <niklas.neronin@linux.intel.com>
+
+[ Upstream commit 719de070f764e079cdcb4ddeeb5b19b3ddddf9c1 ]
+
+Add xhci support for PCI hosts that have zero USB3 ports.
+Avoid creating a shared Host Controller Driver (HCD) when there is only
+one root hub. Additionally, all references to 'xhci->shared_hcd' are now
+checked before use.
+
+Only xhci-pci.c requires modification to accommodate this change, as the
+xhci core already supports configurations with zero USB3 ports. This
+capability was introduced when xHCI Platform and MediaTek added support
+for zero USB3 ports.
+
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220181
+Tested-by: Nick Nielsen <nick.kainielsen@free.fr>
+Tested-by: grm1 <grm1@mailbox.org>
+Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20250917210726.97100-4-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 42 +++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 00fac8b233d2a..5c8ab519f497d 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -610,7 +610,7 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ {
+ 	int retval;
+ 	struct xhci_hcd *xhci;
+-	struct usb_hcd *hcd;
++	struct usb_hcd *hcd, *usb3_hcd;
+ 	struct reset_control *reset;
+ 
+ 	reset = devm_reset_control_get_optional_exclusive(&dev->dev, NULL);
+@@ -636,26 +636,32 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	hcd = dev_get_drvdata(&dev->dev);
+ 	xhci = hcd_to_xhci(hcd);
+ 	xhci->reset = reset;
+-	xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
+-						 pci_name(dev), hcd);
+-	if (!xhci->shared_hcd) {
+-		retval = -ENOMEM;
+-		goto dealloc_usb2_hcd;
+-	}
+ 
+-	retval = xhci_ext_cap_init(xhci);
+-	if (retval)
+-		goto put_usb3_hcd;
++	xhci->allow_single_roothub = 1;
++	if (!xhci_has_one_roothub(xhci)) {
++		xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
++							 pci_name(dev), hcd);
++		if (!xhci->shared_hcd) {
++			retval = -ENOMEM;
++			goto dealloc_usb2_hcd;
++		}
+ 
+-	retval = usb_add_hcd(xhci->shared_hcd, dev->irq,
+-			IRQF_SHARED);
+-	if (retval)
+-		goto put_usb3_hcd;
+-	/* Roothub already marked as USB 3.0 speed */
++		retval = xhci_ext_cap_init(xhci);
++		if (retval)
++			goto put_usb3_hcd;
++
++		retval = usb_add_hcd(xhci->shared_hcd, dev->irq, IRQF_SHARED);
++		if (retval)
++			goto put_usb3_hcd;
++	} else {
++		retval = xhci_ext_cap_init(xhci);
++		if (retval)
++			goto dealloc_usb2_hcd;
++	}
+ 
+-	if (!(xhci->quirks & XHCI_BROKEN_STREAMS) &&
+-			HCC_MAX_PSA(xhci->hcc_params) >= 4)
+-		xhci->shared_hcd->can_do_streams = 1;
++	usb3_hcd = xhci_get_usb3_hcd(xhci);
++	if (usb3_hcd && !(xhci->quirks & XHCI_BROKEN_STREAMS) && HCC_MAX_PSA(xhci->hcc_params) >= 4)
++		usb3_hcd->can_do_streams = 1;
+ 
+ 	/* USB-2 and USB-3 roothubs initialized, allow runtime pm suspend */
+ 	pm_runtime_put_noidle(&dev->dev);
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch b/queue-6.17/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
new file mode 100644
index 0000000000..083b457ba5
--- /dev/null
+++ b/queue-6.17/usb-xhci-pci-fix-usb2-only-root-hub-registration.patch
@@ -0,0 +1,61 @@
+From 3a1b1b2442d4fafd790714b064f67905a0f08dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Oct 2025 01:55:40 +0300
+Subject: usb: xhci-pci: Fix USB2-only root hub registration
+
+From: Michal Pecio <michal.pecio@gmail.com>
+
+[ Upstream commit 8607edcd1748503f4f58e66ca0216170f260c79b ]
+
+A recent change to hide USB3 root hubs of USB2-only controllers broke
+registration of USB2 root hubs - allow_single_roothub is set too late,
+and by this time xhci_run() has already deferred root hub registration
+until after the shared HCD is added, which will never happen.
+
+This makes such controllers unusable, but testers didn't notice since
+they were only bothered by warnings about empty USB3 root hubs. The bug
+causes problems to other people who actually use such HCs and I was
+able to confirm it on an ordinary HC by patching to ignore USB3 ports.
+
+Setting allow_single_roothub during early setup fixes things.
+
+Reported-by: Arisa Snowbell <arisa.snowbell@gmail.com>
+Closes: https://lore.kernel.org/linux-usb/CABpa4MA9unucCoKtSdzJyOLjHNVy+Cwgz5AnAxPkKw6vuox1Nw@mail.gmail.com/
+Reported-by: Michal Kubecek <mkubecek@suse.cz>
+Closes: https://lore.kernel.org/linux-usb/lnb5bum7dnzkn3fc7gq6hwigslebo7o4ccflcvsc3lvdgnu7el@fvqpobbdoapl/
+Fixes: 719de070f764 ("usb: xhci-pci: add support for hosts with zero USB3 ports")
+Tested-by: Arisa Snowbell <arisa.snowbell@gmail.com>
+Tested-by: Michal Kubecek <mkubecek@suse.cz>
+Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 5c8ab519f497d..f67a4d9562046 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -582,6 +582,8 @@ static int xhci_pci_setup(struct usb_hcd *hcd)
+ 	if (!usb_hcd_is_primary_hcd(hcd))
+ 		return 0;
+ 
++	xhci->allow_single_roothub = 1;
++
+ 	if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
+ 		xhci_pme_acpi_rtd3_enable(pdev);
+ 
+@@ -637,7 +639,6 @@ int xhci_pci_common_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 	xhci = hcd_to_xhci(hcd);
+ 	xhci->reset = reset;
+ 
+-	xhci->allow_single_roothub = 1;
+ 	if (!xhci_has_one_roothub(xhci)) {
+ 		xhci->shared_hcd = usb_create_shared_hcd(&xhci_pci_hc_driver, &dev->dev,
+ 							 pci_name(dev), hcd);
+-- 
+2.51.0
+
diff --git a/queue-6.17/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-6.17/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..a601ebdbe6
--- /dev/null
+++ b/queue-6.17/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From b32769a2a2d3809e18e7b632b6b094bc6697798a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 5eb51797de326..dd57ffedcaa2f 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -171,6 +171,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
+ 		return ret;
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/vfio-nvgrace-gpu-add-gb300-sku-to-the-devid-table.patch b/queue-6.17/vfio-nvgrace-gpu-add-gb300-sku-to-the-devid-table.patch
new file mode 100644
index 0000000000..9f1f819468
--- /dev/null
+++ b/queue-6.17/vfio-nvgrace-gpu-add-gb300-sku-to-the-devid-table.patch
@@ -0,0 +1,38 @@
+From 957d41ee2b36e86e4ec234280aa3ceecc7905d84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 12:09:35 -0500
+Subject: vfio/nvgrace-gpu: Add GB300 SKU to the devid table
+
+From: Tushar Dave <tdave@nvidia.com>
+
+[ Upstream commit 407aa63018d15c35a34938633868e61174d2ef6e ]
+
+GB300 is NVIDIA's Grace Blackwell Ultra Superchip.
+
+Add the GB300 SKU device-id to nvgrace_gpu_vfio_pci_table.
+
+Signed-off-by: Tushar Dave <tdave@nvidia.com>
+Reviewed-by: Ankit Agrawal <ankita@nvidia.com>
+Link: https://lore.kernel.org/r/20250925170935.121587-1-tdave@nvidia.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/nvgrace-gpu/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/vfio/pci/nvgrace-gpu/main.c b/drivers/vfio/pci/nvgrace-gpu/main.c
+index d95761dcdd58c..36b79713fd5a5 100644
+--- a/drivers/vfio/pci/nvgrace-gpu/main.c
++++ b/drivers/vfio/pci/nvgrace-gpu/main.c
+@@ -995,6 +995,8 @@ static const struct pci_device_id nvgrace_gpu_vfio_pci_table[] = {
+ 	{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_NVIDIA, 0x2348) },
+ 	/* GB200 SKU */
+ 	{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_NVIDIA, 0x2941) },
++	/* GB300 SKU */
++	{ PCI_DRIVER_OVERRIDE_DEVICE_VFIO(PCI_VENDOR_ID_NVIDIA, 0x31C2) },
+ 	{}
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch b/queue-6.17/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
new file mode 100644
index 0000000000..0d52c4a928
--- /dev/null
+++ b/queue-6.17/vfio-pci-fix-intx-handling-on-legacy-non-pci-2.3-dev.patch
@@ -0,0 +1,77 @@
+From 6d2453c6ea60c668558eb9e2cb5d8208f7b4214c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 12:04:33 -0500
+Subject: vfio/pci: Fix INTx handling on legacy non-PCI 2.3 devices
+
+From: Timothy Pearson <tpearson@raptorengineering.com>
+
+[ Upstream commit 8b9f128947dd72e0fcf256088a673abac9b720bf ]
+
+PCI devices prior to PCI 2.3 both use level interrupts and do not support
+interrupt masking, leading to a failure when passed through to a KVM guest on
+at least the ppc64 platform. This failure manifests as receiving and
+acknowledging a single interrupt in the guest, while the device continues to
+assert the level interrupt indicating a need for further servicing.
+
+When lazy IRQ masking is used on DisINTx- (non-PCI 2.3) hardware, the following
+sequence occurs:
+
+ * Level IRQ assertion on device
+ * IRQ marked disabled in kernel
+ * Host interrupt handler exits without clearing the interrupt on the device
+ * Eventfd is delivered to userspace
+ * Guest processes IRQ and clears device interrupt
+ * Device de-asserts INTx, then re-asserts INTx while the interrupt is masked
+ * Newly asserted interrupt acknowledged by kernel VMM without being handled
+ * Software mask removed by VFIO driver
+ * Device INTx still asserted, host controller does not see new edge after EOI
+
+The behavior is now platform-dependent.  Some platforms (amd64) will continue
+to spew IRQs for as long as the INTX line remains asserted, therefore the IRQ
+will be handled by the host as soon as the mask is dropped.  Others (ppc64) will
+only send the one request, and if it is not handled no further interrupts will
+be sent.  The former behavior theoretically leaves the system vulnerable to
+interrupt storm, and the latter will result in the device stalling after
+receiving exactly one interrupt in the guest.
+
+Work around this by disabling lazy IRQ masking for DisINTx- INTx devices.
+
+Signed-off-by: Timothy Pearson <tpearson@raptorengineering.com>
+Link: https://lore.kernel.org/r/333803015.1744464.1758647073336.JavaMail.zimbra@raptorengineeringinc.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_intrs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
+index 123298a4dc8f5..61d29f6b3730c 100644
+--- a/drivers/vfio/pci/vfio_pci_intrs.c
++++ b/drivers/vfio/pci/vfio_pci_intrs.c
+@@ -304,9 +304,14 @@ static int vfio_intx_enable(struct vfio_pci_core_device *vdev,
+ 
+ 	vdev->irq_type = VFIO_PCI_INTX_IRQ_INDEX;
+ 
++	if (!vdev->pci_2_3)
++		irq_set_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
++
+ 	ret = request_irq(pdev->irq, vfio_intx_handler,
+ 			  irqflags, ctx->name, ctx);
+ 	if (ret) {
++		if (!vdev->pci_2_3)
++			irq_clear_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
+ 		vdev->irq_type = VFIO_PCI_NUM_IRQS;
+ 		kfree(name);
+ 		vfio_irq_ctx_free(vdev, ctx, 0);
+@@ -352,6 +357,8 @@ static void vfio_intx_disable(struct vfio_pci_core_device *vdev)
+ 		vfio_virqfd_disable(&ctx->unmask);
+ 		vfio_virqfd_disable(&ctx->mask);
+ 		free_irq(pdev->irq, ctx);
++		if (!vdev->pci_2_3)
++			irq_clear_status_flags(pdev->irq, IRQ_DISABLE_UNLAZY);
+ 		if (ctx->trigger)
+ 			eventfd_ctx_put(ctx->trigger);
+ 		kfree(ctx->name);
+-- 
+2.51.0
+
diff --git a/queue-6.17/vfio-return-enotty-for-unsupported-device-feature.patch b/queue-6.17/vfio-return-enotty-for-unsupported-device-feature.patch
new file mode 100644
index 0000000000..d335967b91
--- /dev/null
+++ b/queue-6.17/vfio-return-enotty-for-unsupported-device-feature.patch
@@ -0,0 +1,40 @@
+From 6262aee8e2a1e82ee77f4adb62a9b147d4a3b70e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 08:58:40 -0700
+Subject: vfio: return -ENOTTY for unsupported device feature
+
+From: Alex Mastro <amastro@fb.com>
+
+[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
+
+The two implementers of vfio_device_ops.device_feature,
+vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return
+-ENOTTY in the fallthrough case when the feature is unsupported. For
+consistency, the base case, vfio_ioctl_device_feature, should do the
+same when device_feature == NULL, indicating an implementation has no
+feature extensions.
+
+Signed-off-by: Alex Mastro <amastro@fb.com>
+Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
+index 5046cae052224..715368076a1fe 100644
+--- a/drivers/vfio/vfio_main.c
++++ b/drivers/vfio/vfio_main.c
+@@ -1251,7 +1251,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device,
+ 			feature.argsz - minsz);
+ 	default:
+ 		if (unlikely(!device->ops->device_feature))
+-			return -EINVAL;
++			return -ENOTTY;
+ 		return device->ops->device_feature(device, feature.flags,
+ 						   arg->data,
+ 						   feature.argsz - minsz);
+-- 
+2.51.0
+
diff --git a/queue-6.17/virtio_fs-fix-the-hash-table-using-in-virtio_fs_enqu.patch b/queue-6.17/virtio_fs-fix-the-hash-table-using-in-virtio_fs_enqu.patch
new file mode 100644
index 0000000000..6a66cec015
--- /dev/null
+++ b/queue-6.17/virtio_fs-fix-the-hash-table-using-in-virtio_fs_enqu.patch
@@ -0,0 +1,73 @@
+From 5fa9a483ac957ccddfbed255beb57f9313a416e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 14:47:38 +0800
+Subject: virtio_fs: fix the hash table using in virtio_fs_enqueue_req()
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 7dbe6442487743ad492d9143f1f404c1f4a05e0e ]
+
+The original commit be2ff42c5d6e ("fuse: Use hash table to link
+processing request") converted fuse_pqueue->processing to a hash table,
+but virtio_fs_enqueue_req() was not updated to use it correctly.
+So use fuse_pqueue->processing as a hash table, this make the code
+more coherent
+
+Co-developed-by: Fushuai Wang <wangfushuai@baidu.com>
+Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/dev.c       | 1 +
+ fs/fuse/virtio_fs.c | 6 ++++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index dbf53c7bc8535..612d4da6d7d91 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -322,6 +322,7 @@ unsigned int fuse_req_hash(u64 unique)
+ {
+ 	return hash_long(unique & ~FUSE_INT_REQ_BIT, FUSE_PQ_HASH_BITS);
+ }
++EXPORT_SYMBOL_GPL(fuse_req_hash);
+ 
+ /*
+  * A new request is available, wake fiq->waitq
+diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c
+index 76c8fd0bfc75d..1751cd6e3d42b 100644
+--- a/fs/fuse/virtio_fs.c
++++ b/fs/fuse/virtio_fs.c
+@@ -20,6 +20,7 @@
+ #include <linux/cleanup.h>
+ #include <linux/uio.h>
+ #include "fuse_i.h"
++#include "fuse_dev_i.h"
+ 
+ /* Used to help calculate the FUSE connection's max_pages limit for a request's
+  * size. Parts of the struct fuse_req are sliced into scattergather lists in
+@@ -1384,7 +1385,7 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
+ 	unsigned int out_sgs = 0;
+ 	unsigned int in_sgs = 0;
+ 	unsigned int total_sgs;
+-	unsigned int i;
++	unsigned int i, hash;
+ 	int ret;
+ 	bool notify;
+ 	struct fuse_pqueue *fpq;
+@@ -1444,8 +1445,9 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq,
+ 
+ 	/* Request successfully sent. */
+ 	fpq = &fsvq->fud->pq;
++	hash = fuse_req_hash(req->in.h.unique);
+ 	spin_lock(&fpq->lock);
+-	list_add_tail(&req->list, fpq->processing);
++	list_add_tail(&req->list, &fpq->processing[hash]);
+ 	spin_unlock(&fpq->lock);
+ 	set_bit(FR_SENT, &req->flags);
+ 	/* matches barrier in request_wait_answer() */
+-- 
+2.51.0
+
diff --git a/queue-6.17/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch b/queue-6.17/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
new file mode 100644
index 0000000000..91448f3386
--- /dev/null
+++ b/queue-6.17/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
@@ -0,0 +1,59 @@
+From aca62361aa4c28ac340345d6896232d143c08808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:18:23 +0900
+Subject: watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
+
+From: Sangwook Shin <sw617.shin@samsung.com>
+
+[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
+
+Fix the issue of max_timeout being calculated larger than actual value.
+The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) /
+S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder
+is discarded during the calculation process. This leads to a larger
+calculated value for max_timeout compared to the actual settable value.
+To resolve this issue, the order of calculations in the computation process
+has been adjusted.
+
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Signed-off-by: Sangwook Shin <sw617.shin@samsung.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/s3c2410_wdt.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
+index 40901bdac4261..6df7d526c52fb 100644
+--- a/drivers/watchdog/s3c2410_wdt.c
++++ b/drivers/watchdog/s3c2410_wdt.c
+@@ -27,6 +27,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
+ #include <linux/delay.h>
++#include <linux/math64.h>
+ 
+ #define S3C2410_WTCON		0x00
+ #define S3C2410_WTDAT		0x04
+@@ -410,9 +411,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)
+ static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt)
+ {
+ 	const unsigned long freq = s3c2410wdt_get_freq(wdt);
++	const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) *
++			S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT;
++	u64 t_max = div64_ul(n_max, freq);
+ 
+-	return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1)
+-				       / S3C2410_WTCON_MAXDIV);
++	if (t_max > UINT_MAX)
++		t_max = UINT_MAX;
++
++	return t_max;
+ }
+ 
+ static int s3c2410wdt_disable_wdt_reset(struct s3c2410_wdt *wdt, bool mask)
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-6.17/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..c050df0ac5
--- /dev/null
+++ b/queue-6.17/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From 4c215692186784922352f369282542acaf65dc1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 24dd794e31ea2..154ac7a709824 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -16,6 +16,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -290,8 +291,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch b/queue-6.17/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
new file mode 100644
index 0000000000..ff345e6484
--- /dev/null
+++ b/queue-6.17/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
@@ -0,0 +1,41 @@
+From b58900d739306831bd8d36aa60c8dc3ce33ef1aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:47:44 +0530
+Subject: wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
+
+From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+
+[ Upstream commit 82993345aef6987a916337ebd2fca3ff4a6250a7 ]
+
+Increase DP_REO_CMD_RING_SIZE from 128 to 256 to avoid
+queuing failures observed during stress test scenarios.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250806111750.3214584-2-nithyanantham.paramasivam@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
+index 7baa48b86f7ad..10093b4515882 100644
+--- a/drivers/net/wireless/ath/ath12k/dp.h
++++ b/drivers/net/wireless/ath/ath12k/dp.h
+@@ -184,7 +184,7 @@ struct ath12k_pdev_dp {
+ #define DP_REO_REINJECT_RING_SIZE	32
+ #define DP_RX_RELEASE_RING_SIZE		1024
+ #define DP_REO_EXCEPTION_RING_SIZE	128
+-#define DP_REO_CMD_RING_SIZE		128
++#define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RX_MAC_BUF_RING_SIZE		2048
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-cfg80211-update-the-time-stamps-in-hidden-ssid.patch b/queue-6.17/wifi-cfg80211-update-the-time-stamps-in-hidden-ssid.patch
new file mode 100644
index 0000000000..8ebc69ae20
--- /dev/null
+++ b/queue-6.17/wifi-cfg80211-update-the-time-stamps-in-hidden-ssid.patch
@@ -0,0 +1,63 @@
+From ad90d313c5038bc9a56572caf8dda37469650f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 11:51:43 +0300
+Subject: wifi: cfg80211: update the time stamps in hidden ssid
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 185cc2352cb1ef2178fe4e9a220a73c94007b8bb ]
+
+In hidden SSID we have separate BSS entries for the beacon and for the
+probe response(s).
+The BSS entry time stamps represent the age of the BSS;
+when was the last time we heard the BSS.
+When we receive a beacon of a hidden SSID it means that we heard that
+BSS, so it makes sense to indicate that in the probe response entries.
+Do that.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250907115135.712745e498c0.I38186abf5d20dec6f6f2d42d2e1cdb50c6bfea25@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 6c7b7c3828a41..90a9187a6b135 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1816,6 +1816,9 @@ static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
+ 		WARN_ON(ies != old_ies);
+ 
+ 		rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
++
++		bss->ts = known->ts;
++		bss->pub.ts_boottime = known->pub.ts_boottime;
+ 	}
+ }
+ 
+@@ -1882,6 +1885,10 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
+ {
+ 	lockdep_assert_held(&rdev->bss_lock);
+ 
++	/* Update time stamps */
++	known->ts = new->ts;
++	known->pub.ts_boottime = new->pub.ts_boottime;
++
+ 	/* Update IEs */
+ 	if (rcu_access_pointer(new->pub.proberesp_ies)) {
+ 		const struct cfg80211_bss_ies *old;
+@@ -1945,8 +1952,6 @@ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
+ 	if (signal_valid)
+ 		known->pub.signal = new->pub.signal;
+ 	known->pub.capability = new->pub.capability;
+-	known->ts = new->ts;
+-	known->pub.ts_boottime = new->pub.ts_boottime;
+ 	known->parent_tsf = new->parent_tsf;
+ 	known->pub.chains = new->pub.chains;
+ 	memcpy(known->pub.chain_signal, new->pub.chain_signal,
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch b/queue-6.17/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
new file mode 100644
index 0000000000..25731adb6b
--- /dev/null
+++ b/queue-6.17/wifi-iwlwifi-fw-add-asus-to-ppag-and-tas-list.patch
@@ -0,0 +1,64 @@
+From 8715ffca68b3418aacc178df6838ffecc4a092db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 06:21:21 +0300
+Subject: wifi: iwlwifi: fw: Add ASUS to PPAG and TAS list
+
+From: Nidhish A N <nidhish.a.n@intel.com>
+
+[ Upstream commit c5318e6e1c6436ce35ba521d96975e13cc5119f7 ]
+
+Add ASUS to the list of OEMs that are allowed to use
+the PPAG and TAS feature.
+
+Signed-off-by: Nidhish A N <nidhish.a.n@intel.com>
+Reviewed-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250909061931.499af6568e89.Iafb2cb1c83ff82712c0e9d5529f76bc226ed12dd@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/regulatory.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
+index 3d6d1a85bb51b..a59f7f6b24da0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
+@@ -59,11 +59,16 @@ static const struct dmi_system_id dmi_ppag_approved_list[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
+ 		},
+ 	},
+-	{ .ident = "ASUS",
++	{ .ident = "ASUSTEK",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ 		},
+ 	},
++	{ .ident = "ASUS",
++	  .matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
++		},
++	},
+ 	{ .ident = "GOOGLE-HP",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+@@ -141,11 +146,16 @@ static const struct dmi_system_id dmi_tas_approved_list[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ 		},
+ 	},
+-	{ .ident = "ASUS",
++	{ .ident = "ASUSTEK",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ 		},
+ 	},
++	{ .ident = "ASUS",
++	  .matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUS"),
++		},
++	},
+ 	{ .ident = "GOOGLE-HP",
+ 	  .matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Google"),
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-iwlwifi-mld-trigger-mlo-scan-only-when-not-in-e.patch b/queue-6.17/wifi-iwlwifi-mld-trigger-mlo-scan-only-when-not-in-e.patch
new file mode 100644
index 0000000000..66fc6ca5bd
--- /dev/null
+++ b/queue-6.17/wifi-iwlwifi-mld-trigger-mlo-scan-only-when-not-in-e.patch
@@ -0,0 +1,67 @@
+From 20df537048ff80fe8e54132d22bd609958c4cd3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:54:51 +0300
+Subject: wifi: iwlwifi: mld: trigger mlo scan only when not in EMLSR
+
+From: Somashekhar Puttagangaiah <somashekhar.puttagangaiah@intel.com>
+
+[ Upstream commit 14a4aca568f6e78af7564c6fc5f1ecc1a5a32c33 ]
+
+When beacon loss happens or the RSSI drops, trigger MLO scan only
+if not in EMLSR. The link switch was meant to be done when we are
+not in EMLSR and we can try to switch to a better link.
+If in EMLSR, we exit first and then trigger MLO scan.
+
+Signed-off-by: Somashekhar Puttagangaiah <somashekhar.puttagangaiah@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250826184046.f6ae8e3882cf.I60901c16487371b8e62019bd0bf25c45ab23752f@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mld/link.c  |  7 +++++--
+ drivers/net/wireless/intel/iwlwifi/mld/stats.c | 11 +++++++----
+ 2 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
+index 960dcd208f005..131190977d4b0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
+@@ -573,8 +573,11 @@ void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,
+ 	if (missed_bcon_since_rx > IWL_MLD_MISSED_BEACONS_THRESHOLD) {
+ 		ieee80211_cqm_beacon_loss_notify(vif, GFP_ATOMIC);
+ 
+-		/* try to switch links, no-op if we don't have MLO */
+-		iwl_mld_int_mlo_scan(mld, vif);
++		/* Not in EMLSR and we can't hear the link.
++		 * Try to switch to a better link. EMLSR case is handled below.
++		 */
++		if (!iwl_mld_emlsr_active(vif))
++			iwl_mld_int_mlo_scan(mld, vif);
+ 	}
+ 
+ 	/* no more logic if we're not in EMLSR */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mld/stats.c b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
+index cbc64db5eab6f..7b8709716324a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mld/stats.c
++++ b/drivers/net/wireless/intel/iwlwifi/mld/stats.c
+@@ -379,11 +379,14 @@ static void iwl_mld_update_link_sig(struct ieee80211_vif *vif, int sig,
+ 
+ 	/* TODO: task=statistics handle CQM notifications */
+ 
+-	if (sig < IWL_MLD_LOW_RSSI_MLO_SCAN_THRESH)
+-		iwl_mld_int_mlo_scan(mld, vif);
+-
+-	if (!iwl_mld_emlsr_active(vif))
++	if (!iwl_mld_emlsr_active(vif)) {
++		/* We're not in EMLSR and our signal is bad,
++		 * try to switch link maybe. EMLSR will be handled below.
++		 */
++		if (sig < IWL_MLD_LOW_RSSI_MLO_SCAN_THRESH)
++			iwl_mld_int_mlo_scan(mld, vif);
+ 		return;
++	}
+ 
+ 	/* We are in EMLSR, check if we need to exit */
+ 	exit_emlsr_thresh =
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-iwlwifi-pcie-remember-when-interrupts-are-disab.patch b/queue-6.17/wifi-iwlwifi-pcie-remember-when-interrupts-are-disab.patch
new file mode 100644
index 0000000000..aa5a136c80
--- /dev/null
+++ b/queue-6.17/wifi-iwlwifi-pcie-remember-when-interrupts-are-disab.patch
@@ -0,0 +1,47 @@
+From 6f88b669c0a972cfbb43b0ae732afcb75cb1a6d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 11:25:57 +0300
+Subject: wifi: iwlwifi: pcie: remember when interrupts are disabled
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1a33efe4fc64b8135fe94e22299761cc69333404 ]
+
+trans_pcie::fh_mask and hw_mask indicates what are the interrupts are
+currently enabled (unmasked).
+When we disable all interrupts, those should be set to 0, so if, for
+some reason, we get an interrupt even though it was disabled, we will
+know to ignore.
+
+Reviewed-by: Yedidya Ben Shimol <yedidya.ben.shimol@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250828111032.e293d6a8385b.I919375e5ad7bd7e4fee4a95ce6ce6978653d6b16@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/internal.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/internal.h
+index f48aeebb151cc..86edc79ac09f8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/internal.h
+@@ -818,6 +818,8 @@ static inline void _iwl_disable_interrupts(struct iwl_trans *trans)
+ 			    trans_pcie->fh_init_mask);
+ 		iwl_write32(trans, CSR_MSIX_HW_INT_MASK_AD,
+ 			    trans_pcie->hw_init_mask);
++		trans_pcie->fh_mask = 0;
++		trans_pcie->hw_mask = 0;
+ 	}
+ 	IWL_DEBUG_ISR(trans, "Disabled interrupts\n");
+ }
+@@ -1000,6 +1002,7 @@ static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
+ 	} else {
+ 		iwl_write32(trans, CSR_MSIX_FH_INT_MASK_AD,
+ 			    trans_pcie->fh_init_mask);
++		trans_pcie->fh_mask = 0;
+ 		iwl_enable_hw_int_msk_msix(trans,
+ 					   MSIX_HW_INT_CAUSES_REG_RF_KILL);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mac80211-count-reg-connection-element-in-the-si.patch b/queue-6.17/wifi-mac80211-count-reg-connection-element-in-the-si.patch
new file mode 100644
index 0000000000..217e812ae2
--- /dev/null
+++ b/queue-6.17/wifi-mac80211-count-reg-connection-element-in-the-si.patch
@@ -0,0 +1,41 @@
+From ee96cf82070864e86741a01efb7b2ecb597a773c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 20:25:24 +0300
+Subject: wifi: mac80211: count reg connection element in the size
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 1373f94148a5adac2f42c8ba9771105624fe4af0 ]
+
+We currently don't count the reg connection length in the per-link
+capability length. Fix it.
+
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250826202512.b14fc82f736b.I03442382e8a07f6f9836bcdac2e22ce8afbe6a21@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index dd650a127a317..f38881b927d17 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2112,8 +2112,11 @@ ieee80211_link_common_elems_size(struct ieee80211_sub_if_data *sdata,
+ 		sizeof(struct ieee80211_he_mcs_nss_supp) +
+ 		IEEE80211_HE_PPE_THRES_MAX_LEN;
+ 
+-	if (sband->band == NL80211_BAND_6GHZ)
++	if (sband->band == NL80211_BAND_6GHZ) {
+ 		size += 2 + 1 + sizeof(struct ieee80211_he_6ghz_capa);
++		/* reg connection */
++		size += 4;
++	}
+ 
+ 	size += 2 + 1 + sizeof(struct ieee80211_eht_cap_elem) +
+ 		sizeof(struct ieee80211_eht_mcs_nss_supp) +
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch b/queue-6.17/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
new file mode 100644
index 0000000000..1a9c1a7d0f
--- /dev/null
+++ b/queue-6.17/wifi-mac80211-fix-6-ghz-band-capabilities-element-ad.patch
@@ -0,0 +1,66 @@
+From 1b832ec6625720744ea37742fe7ad3d0c7b7f6c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jun 2025 16:14:36 +0530
+Subject: wifi: mac80211: Fix 6 GHz Band capabilities element advertisement in
+ lower bands
+
+From: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+
+[ Upstream commit e53f8b12a21c2974b66fa8c706090182da06fff3 ]
+
+Currently, when adding the 6 GHz Band Capabilities element, the channel
+list of the wiphy is checked to determine if 6 GHz is supported for a given
+virtual interface. However, in a multi-radio wiphy (e.g., one that has
+both lower bands and 6 GHz combined), the wiphy advertises support for
+all bands. As a result, the 6 GHz Band Capabilities element is incorrectly
+included in mesh beacon and station's association request frames of
+interfaces operating in lower bands, without verifying whether the
+interface is actually operating in a 6 GHz channel.
+
+Fix this by verifying if the interface operates on 6 GHz channel
+before adding the element. Note that this check cannot be placed
+directly in ieee80211_put_he_6ghz_cap() as the same function is used to
+add probe request elements while initiating scan in which case the
+interface may not be operating in any band's channel.
+
+Signed-off-by: Ramya Gnanasekar <ramya.gnanasekar@oss.qualcomm.com>
+Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250606104436.326654-1-rameshkumar.sundaram@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh.c | 3 +++
+ net/mac80211/mlme.c | 3 ++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index a4a715f6f1c32..f37068a533f4e 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -624,6 +624,9 @@ int mesh_add_he_6ghz_cap_ie(struct ieee80211_sub_if_data *sdata,
+ 	if (!sband)
+ 		return -EINVAL;
+ 
++	if (sband->band != NL80211_BAND_6GHZ)
++		return 0;
++
+ 	iftd = ieee80211_get_sband_iftype_data(sband,
+ 					       NL80211_IFTYPE_MESH_POINT);
+ 	/* The device doesn't support HE in mesh mode or at all */
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index f38881b927d17..c1b13b3411cdb 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -1850,7 +1850,8 @@ ieee80211_add_link_elems(struct ieee80211_sub_if_data *sdata,
+ 		ieee80211_put_he_cap(skb, sdata, sband,
+ 				     &assoc_data->link[link_id].conn);
+ 		ADD_PRESENT_EXT_ELEM(WLAN_EID_EXT_HE_CAPABILITY);
+-		ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
++		if (sband->band == NL80211_BAND_6GHZ)
++			ieee80211_put_he_6ghz_cap(skb, sdata, smps_mode);
+ 	}
+ 
+ 	/*
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mac80211-fix-he-capabilities-element-check.patch b/queue-6.17/wifi-mac80211-fix-he-capabilities-element-check.patch
new file mode 100644
index 0000000000..4a731e0ab1
--- /dev/null
+++ b/queue-6.17/wifi-mac80211-fix-he-capabilities-element-check.patch
@@ -0,0 +1,37 @@
+From 846102d373bb4fd59b3c4946bbd95fda2b7ea9e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 11:51:17 +0300
+Subject: wifi: mac80211: Fix HE capabilities element check
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
+
+The element data length check did not account for the extra
+octet used for the extension ID. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index c1b13b3411cdb..24a35fccca9de 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -5733,7 +5733,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
+ 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+ 					     ies->data, ies->len);
+ 
+-	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
++	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1)
+ 		return chains;
+ 
+ 	/* skip one byte ext_tag_id */
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mac80211-get-the-correct-interface-for-non-netd.patch b/queue-6.17/wifi-mac80211-get-the-correct-interface-for-non-netd.patch
new file mode 100644
index 0000000000..565c1a5f47
--- /dev/null
+++ b/queue-6.17/wifi-mac80211-get-the-correct-interface-for-non-netd.patch
@@ -0,0 +1,136 @@
+From d6604a2389db336eadface44d8aabfcb29a83e9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:13:05 +0300
+Subject: wifi: mac80211: Get the correct interface for non-netdev skb status
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit c7b5355b37a59c927b2374e9f783acd004d00960 ]
+
+The function ieee80211_sdata_from_skb() always returned the P2P Device
+interface in case the skb was not associated with a netdev and didn't
+consider the possibility that an NAN Device interface is also enabled.
+
+To support configurations where both P2P Device and a NAN Device
+interface are active, extend the function to match the correct
+interface based on address 2 in the 802.11 MAC header.
+
+Since the 'p2p_sdata' field in struct ieee80211_local is no longer
+needed, remove it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250908140015.5252d2579a49.Id4576531c6b2ad83c9498b708dc0ade6b0214fa8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/ieee80211_i.h |  2 --
+ net/mac80211/iface.c       | 16 +---------------
+ net/mac80211/status.c      | 21 +++++++++++++++++++--
+ 3 files changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 8afa2404eaa8e..140dc7e32d4aa 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1665,8 +1665,6 @@ struct ieee80211_local {
+ 	struct idr ack_status_frames;
+ 	spinlock_t ack_status_lock;
+ 
+-	struct ieee80211_sub_if_data __rcu *p2p_sdata;
+-
+ 	/* virtual monitor interface */
+ 	struct ieee80211_sub_if_data __rcu *monitor_sdata;
+ 	struct ieee80211_chan_req monitor_chanreq;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 07ba68f7cd817..abc8cca54f4e1 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -611,10 +611,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
+ 
+ 		spin_unlock_bh(&sdata->u.nan.func_lock);
+ 		break;
+-	case NL80211_IFTYPE_P2P_DEVICE:
+-		/* relies on synchronize_rcu() below */
+-		RCU_INIT_POINTER(local->p2p_sdata, NULL);
+-		fallthrough;
+ 	default:
+ 		wiphy_work_cancel(sdata->local->hw.wiphy, &sdata->work);
+ 		/*
+@@ -1405,6 +1401,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
+ 		ieee80211_recalc_idle(local);
+ 
+ 		netif_carrier_on(dev);
++		list_add_tail_rcu(&sdata->u.mntr.list, &local->mon_list);
+ 		break;
+ 	default:
+ 		if (coming_up) {
+@@ -1468,17 +1465,6 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
+ 			sdata->vif.type != NL80211_IFTYPE_STATION);
+ 	}
+ 
+-	switch (sdata->vif.type) {
+-	case NL80211_IFTYPE_P2P_DEVICE:
+-		rcu_assign_pointer(local->p2p_sdata, sdata);
+-		break;
+-	case NL80211_IFTYPE_MONITOR:
+-		list_add_tail_rcu(&sdata->u.mntr.list, &local->mon_list);
+-		break;
+-	default:
+-		break;
+-	}
+-
+ 	/*
+ 	 * set_multicast_list will be invoked by the networking core
+ 	 * which will check whether any increments here were done in
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index a362254b310cd..4b38aa0e902a8 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -5,7 +5,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
+  * Copyright 2008-2010	Johannes Berg <johannes@sipsolutions.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+- * Copyright 2021-2024  Intel Corporation
++ * Copyright 2021-2025  Intel Corporation
+  */
+ 
+ #include <linux/export.h>
+@@ -572,6 +572,7 @@ static struct ieee80211_sub_if_data *
+ ieee80211_sdata_from_skb(struct ieee80211_local *local, struct sk_buff *skb)
+ {
+ 	struct ieee80211_sub_if_data *sdata;
++	struct ieee80211_hdr *hdr = (void *)skb->data;
+ 
+ 	if (skb->dev) {
+ 		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+@@ -585,7 +586,23 @@ ieee80211_sdata_from_skb(struct ieee80211_local *local, struct sk_buff *skb)
+ 		return NULL;
+ 	}
+ 
+-	return rcu_dereference(local->p2p_sdata);
++	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++		switch (sdata->vif.type) {
++		case NL80211_IFTYPE_P2P_DEVICE:
++			break;
++		case NL80211_IFTYPE_NAN:
++			if (sdata->u.nan.started)
++				break;
++			fallthrough;
++		default:
++			continue;
++		}
++
++		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++			return sdata;
++	}
++
++	return NULL;
+ }
+ 
+ static void ieee80211_report_ack_skb(struct ieee80211_local *local,
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mac80211-track-nan-interface-start-stop.patch b/queue-6.17/wifi-mac80211-track-nan-interface-start-stop.patch
new file mode 100644
index 0000000000..48e00977c0
--- /dev/null
+++ b/queue-6.17/wifi-mac80211-track-nan-interface-start-stop.patch
@@ -0,0 +1,124 @@
+From a256035a62c26f703c06b6f0d000e5bb1b41527f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 14:13:04 +0300
+Subject: wifi: mac80211: Track NAN interface start/stop
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 8f79d2f13dd3b0af00a5303d4ff913767dd7684e ]
+
+In case that NAN is started, mark the device as non idle,
+and set LED triggering similar to scan and ROC. Set the
+device to idle once NAN is stopped.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250908140015.2711d62fce22.I9b9f826490e50967a66788d713b0eba985879873@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/cfg.c         | 20 +++++++++++++++++---
+ net/mac80211/ieee80211_i.h |  2 ++
+ net/mac80211/iface.c       |  9 +++++++++
+ 3 files changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index e5e82e0b48ff1..4a8de319857e9 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -320,6 +320,9 @@ static int ieee80211_start_nan(struct wiphy *wiphy,
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
++	if (sdata->u.nan.started)
++		return -EALREADY;
++
+ 	ret = ieee80211_check_combinations(sdata, NULL, 0, 0, -1);
+ 	if (ret < 0)
+ 		return ret;
+@@ -329,12 +332,18 @@ static int ieee80211_start_nan(struct wiphy *wiphy,
+ 		return ret;
+ 
+ 	ret = drv_start_nan(sdata->local, sdata, conf);
+-	if (ret)
++	if (ret) {
+ 		ieee80211_sdata_stop(sdata);
++		return ret;
++	}
+ 
+-	sdata->u.nan.conf = *conf;
++	sdata->u.nan.started = true;
++	ieee80211_recalc_idle(sdata->local);
+ 
+-	return ret;
++	sdata->u.nan.conf.master_pref = conf->master_pref;
++	sdata->u.nan.conf.bands = conf->bands;
++
++	return 0;
+ }
+ 
+ static void ieee80211_stop_nan(struct wiphy *wiphy,
+@@ -342,8 +351,13 @@ static void ieee80211_stop_nan(struct wiphy *wiphy,
+ {
+ 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+ 
++	if (!sdata->u.nan.started)
++		return;
++
+ 	drv_stop_nan(sdata->local, sdata);
++	sdata->u.nan.started = false;
+ 	ieee80211_sdata_stop(sdata);
++	ieee80211_recalc_idle(sdata->local);
+ }
+ 
+ static int ieee80211_nan_change_conf(struct wiphy *wiphy,
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 140dc7e32d4aa..7d1e93f51a67b 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -977,11 +977,13 @@ struct ieee80211_if_mntr {
+  * struct ieee80211_if_nan - NAN state
+  *
+  * @conf: current NAN configuration
++ * @started: true iff NAN is started
+  * @func_lock: lock for @func_inst_ids
+  * @function_inst_ids: a bitmap of available instance_id's
+  */
+ struct ieee80211_if_nan {
+ 	struct cfg80211_nan_conf conf;
++	bool started;
+ 
+ 	/* protects function_inst_ids */
+ 	spinlock_t func_lock;
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index abc8cca54f4e1..a7873832d4fa6 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -107,6 +107,7 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
+ {
+ 	bool working, scanning, active;
+ 	unsigned int led_trig_start = 0, led_trig_stop = 0;
++	struct ieee80211_sub_if_data *iter;
+ 
+ 	lockdep_assert_wiphy(local->hw.wiphy);
+ 
+@@ -117,6 +118,14 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
+ 	working = !local->ops->remain_on_channel &&
+ 		  !list_empty(&local->roc_list);
+ 
++	list_for_each_entry(iter, &local->interfaces, list) {
++		if (iter->vif.type == NL80211_IFTYPE_NAN &&
++		    iter->u.nan.started) {
++			working = true;
++			break;
++		}
++	}
++
+ 	scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+ 		   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-improve-phy-reset-on-hw-restart.patch b/queue-6.17/wifi-mt76-improve-phy-reset-on-hw-restart.patch
new file mode 100644
index 0000000000..6da265cc8a
--- /dev/null
+++ b/queue-6.17/wifi-mt76-improve-phy-reset-on-hw-restart.patch
@@ -0,0 +1,35 @@
+From 930d87fb7117570b8f626e1a5f6913727aa78302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:59:09 +0200
+Subject: wifi: mt76: improve phy reset on hw restart
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 3f34cced88a429872d1eefc393686f9a48ec01d9 ]
+
+- fix number of station accounting for scanning code.
+- reset channel context
+
+Link: https://patch.msgid.link/20250915075910.47558-14-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mac80211.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
+index 59adf33126170..4fa045e87a81f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
++++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
+@@ -824,6 +824,8 @@ static void mt76_reset_phy(struct mt76_phy *phy)
+ 		return;
+ 
+ 	INIT_LIST_HEAD(&phy->tx_list);
++	phy->num_sta = 0;
++	phy->chanctx = NULL;
+ }
+ 
+ void mt76_reset_device(struct mt76_dev *dev)
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt76_eeprom_override-to-int.patch b/queue-6.17/wifi-mt76-mt76_eeprom_override-to-int.patch
new file mode 100644
index 0000000000..ba8c4f8b8e
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt76_eeprom_override-to-int.patch
@@ -0,0 +1,249 @@
+From e35f324a34098736aa079138111b8e5083e9b3d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 15:16:19 -0700
+Subject: wifi: mt76: mt76_eeprom_override to int
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit c7c682100cec97b699fe24b26d89278fd459cc84 ]
+
+mt76_eeprom_override has of_get_mac_address, which can return
+-EPROBE_DEFER if the nvmem driver gets loaded after mt76 for some
+reason.
+
+Make sure this gets passed to probe so that nvmem mac overrides always
+work.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://patch.msgid.link/20250911221619.16035-1-rosenp@gmail.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/eeprom.c        | 9 +++++++--
+ drivers/net/wireless/mediatek/mt76/mt76.h          | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c | 3 +--
+ drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 4 +---
+ drivers/net/wireless/mediatek/mt76/mt7615/init.c   | 5 ++++-
+ drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c | 6 +++++-
+ drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 4 +---
+ drivers/net/wireless/mediatek/mt76/mt7915/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7921/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7925/init.c   | 4 +++-
+ drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c | 3 +--
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c   | 4 +++-
+ 13 files changed, 36 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
+index 443517d06c9fa..a987c5e4eff6c 100644
+--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
+@@ -163,13 +163,16 @@ static int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int len)
+ 	return mt76_get_of_data_from_nvmem(dev, eep, "eeprom", len);
+ }
+ 
+-void
++int
+ mt76_eeprom_override(struct mt76_phy *phy)
+ {
+ 	struct mt76_dev *dev = phy->dev;
+ 	struct device_node *np = dev->dev->of_node;
++	int err;
+ 
+-	of_get_mac_address(np, phy->macaddr);
++	err = of_get_mac_address(np, phy->macaddr);
++	if (err == -EPROBE_DEFER)
++		return err;
+ 
+ 	if (!is_valid_ether_addr(phy->macaddr)) {
+ 		eth_random_addr(phy->macaddr);
+@@ -177,6 +180,8 @@ mt76_eeprom_override(struct mt76_phy *phy)
+ 			 "Invalid MAC address, using random address %pM\n",
+ 			 phy->macaddr);
+ 	}
++
++	return 0;
+ }
+ EXPORT_SYMBOL_GPL(mt76_eeprom_override);
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index 127637454c827..47c143e6a79af 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -1268,7 +1268,7 @@ void mt76_seq_puts_array(struct seq_file *file, const char *str,
+ 			 s8 *val, int len);
+ 
+ int mt76_eeprom_init(struct mt76_dev *dev, int len);
+-void mt76_eeprom_override(struct mt76_phy *phy);
++int mt76_eeprom_override(struct mt76_phy *phy);
+ int mt76_get_of_data_from_mtd(struct mt76_dev *dev, void *eep, int offset, int len);
+ int mt76_get_of_data_from_nvmem(struct mt76_dev *dev, void *eep,
+ 				const char *cell_name, int len);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
+index f5a6b03bc61d0..88382b537a33b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c
+@@ -182,7 +182,6 @@ int mt7603_eeprom_init(struct mt7603_dev *dev)
+ 		dev->mphy.antenna_mask = 1;
+ 
+ 	dev->mphy.chainmask = dev->mphy.antenna_mask;
+-	mt76_eeprom_override(&dev->mphy);
+ 
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+index ccedea7e8a50d..d4bc7e11e772b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c
+@@ -351,8 +351,6 @@ int mt7615_eeprom_init(struct mt7615_dev *dev, u32 addr)
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+ 
+-	mt76_eeprom_override(&dev->mphy);
+-
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ EXPORT_SYMBOL_GPL(mt7615_eeprom_init);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/init.c b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+index aae80005a3c17..3e7af3e58736c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/init.c
+@@ -570,7 +570,10 @@ int mt7615_register_ext_phy(struct mt7615_dev *dev)
+ 	       ETH_ALEN);
+ 	mphy->macaddr[0] |= 2;
+ 	mphy->macaddr[0] ^= BIT(7);
+-	mt76_eeprom_override(mphy);
++
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		return ret;
+ 
+ 	/* second phy can only handle 5 GHz */
+ 	mphy->cap.has_5ghz = true;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+index 4de45a56812d6..d4506b8b46fa5 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c
+@@ -332,7 +332,11 @@ int mt76x0_eeprom_init(struct mt76x02_dev *dev)
+ 
+ 	memcpy(dev->mphy.macaddr, (u8 *)dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+-	mt76_eeprom_override(&dev->mphy);
++
++	err = mt76_eeprom_override(&dev->mphy);
++	if (err)
++		return err;
++
+ 	mt76x02_mac_setaddr(dev, dev->mphy.macaddr);
+ 
+ 	mt76x0_set_chip_cap(dev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
+index 156b16c17b2b4..221805deb42fa 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/eeprom.c
+@@ -499,7 +499,9 @@ int mt76x2_eeprom_init(struct mt76x02_dev *dev)
+ 
+ 	mt76x02_eeprom_parse_hw_cap(dev);
+ 	mt76x2_eeprom_get_macaddr(dev);
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		return ret;
+ 	dev->mphy.macaddr[0] &= ~BIT(1);
+ 
+ 	return 0;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+index c0f3402d30bb7..38dfd5de365ca 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c
+@@ -284,9 +284,7 @@ int mt7915_eeprom_init(struct mt7915_dev *dev)
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR,
+ 	       ETH_ALEN);
+ 
+-	mt76_eeprom_override(&dev->mphy);
+-
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ 
+ int mt7915_eeprom_get_target_power(struct mt7915_dev *dev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/init.c b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+index 3e30ca5155d20..5ea8b46e092ef 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/init.c
+@@ -702,7 +702,9 @@ mt7915_register_ext_phy(struct mt7915_dev *dev, struct mt7915_phy *phy)
+ 		mphy->macaddr[0] |= 2;
+ 		mphy->macaddr[0] ^= BIT(7);
+ 	}
+-	mt76_eeprom_override(mphy);
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		return ret;
+ 
+ 	/* init wiphy according to mphy and phy */
+ 	mt7915_init_wiphy(phy);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+index 14e17dc902566..b9098a7331b1a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+@@ -189,7 +189,9 @@ static int __mt7921_init_hardware(struct mt792x_dev *dev)
+ 	if (ret)
+ 		goto out;
+ 
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		goto out;
+ 
+ 	ret = mt7921_mcu_set_eeprom(dev);
+ 	if (ret)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/init.c b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+index 4249bad83c930..d7d5afe365edd 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/init.c
+@@ -249,7 +249,9 @@ static int __mt7925_init_hardware(struct mt792x_dev *dev)
+ 	if (ret)
+ 		goto out;
+ 
+-	mt76_eeprom_override(&dev->mphy);
++	ret = mt76_eeprom_override(&dev->mphy);
++	if (ret)
++		goto out;
+ 
+ 	ret = mt7925_mcu_set_eeprom(dev);
+ 	if (ret)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+index 87c6192b63844..da3231c9aa119 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/eeprom.c
+@@ -334,9 +334,8 @@ int mt7996_eeprom_init(struct mt7996_dev *dev)
+ 		return ret;
+ 
+ 	memcpy(dev->mphy.macaddr, dev->mt76.eeprom.data + MT_EE_MAC_ADDR, ETH_ALEN);
+-	mt76_eeprom_override(&dev->mphy);
+ 
+-	return 0;
++	return mt76_eeprom_override(&dev->mphy);
+ }
+ 
+ int mt7996_eeprom_get_target_power(struct mt7996_dev *dev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 5a77771e3e6d6..a75b29bada141 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -667,7 +667,9 @@ static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)
+ 		if (band == MT_BAND2)
+ 			mphy->macaddr[0] ^= BIT(6);
+ 	}
+-	mt76_eeprom_override(mphy);
++	ret = mt76_eeprom_override(mphy);
++	if (ret)
++		goto error;
+ 
+ 	/* init wiphy according to mphy and phy */
+ 	mt7996_init_wiphy_band(mphy->hw, phy);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch b/queue-6.17/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
new file mode 100644
index 0000000000..f7491e42bd
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
@@ -0,0 +1,43 @@
+From 0ab1a58a3745b46a88d8fa640e71505aa643b42c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 20:39:42 +0800
+Subject: wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922
+ device
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
+
+Enable 160MHz beamformee support on mt7922 by updating HE capability
+element configuration. Previously, only 160MHz channel width was set,
+but beamformee for 160MHz was not properly advertised. This patch
+adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices
+to utilize 160MHz BW for beamforming.
+
+Tested by connecting to 160MHz-bandwidth beamforming AP and verified
+HE capability.
+
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 5881040ac1952..67383c41a3199 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -135,6 +135,8 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,
+ 			if (is_mt7922(phy->mt76->dev)) {
+ 				he_cap_elem->phy_cap_info[0] |=
+ 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++				he_cap_elem->phy_cap_info[4] |=
++					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
+ 				he_cap_elem->phy_cap_info[8] |=
+ 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+ 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7925-add-pci-restore-for-hibernate.patch b/queue-6.17/wifi-mt76-mt7925-add-pci-restore-for-hibernate.patch
new file mode 100644
index 0000000000..2d4bd9909f
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7925-add-pci-restore-for-hibernate.patch
@@ -0,0 +1,84 @@
+From 1c134b33397f3c2a76d609f8aef34f61927d8009 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 15:32:00 +0800
+Subject: wifi: mt76: mt7925: add pci restore for hibernate
+
+From: Jack Kao <jack.kao@mediatek.com>
+
+[ Upstream commit d54424fbc53b4d6be00f90a8b529cd368f20d357 ]
+
+Due to hibernation causing a power off and power on,
+this modification adds mt7925_pci_restore callback function for kernel.
+When hibernation resumes, it calls mt7925_pci_restore to reset the device,
+allowing it to return to the state it was in before the power off.
+
+Signed-off-by: Jack Kao <jack.kao@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Link: https://patch.msgid.link/20250901073200.230033-1-mingyen.hsieh@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7925/pci.c   | 26 ++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+index 89dc30f7c6b7a..8eb1fe1082d15 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+@@ -529,7 +529,7 @@ static int mt7925_pci_suspend(struct device *device)
+ 	return err;
+ }
+ 
+-static int mt7925_pci_resume(struct device *device)
++static int _mt7925_pci_resume(struct device *device, bool restore)
+ {
+ 	struct pci_dev *pdev = to_pci_dev(device);
+ 	struct mt76_dev *mdev = pci_get_drvdata(pdev);
+@@ -569,6 +569,9 @@ static int mt7925_pci_resume(struct device *device)
+ 	napi_schedule(&mdev->tx_napi);
+ 	local_bh_enable();
+ 
++	if (restore)
++		goto failed;
++
+ 	mt76_connac_mcu_set_hif_suspend(mdev, false, false);
+ 	ret = wait_event_timeout(dev->wait,
+ 				 dev->hif_resumed, 3 * HZ);
+@@ -585,7 +588,7 @@ static int mt7925_pci_resume(struct device *device)
+ failed:
+ 	pm->suspended = false;
+ 
+-	if (err < 0)
++	if (err < 0 || restore)
+ 		mt792x_reset(&dev->mt76);
+ 
+ 	return err;
+@@ -596,7 +599,24 @@ static void mt7925_pci_shutdown(struct pci_dev *pdev)
+ 	mt7925_pci_remove(pdev);
+ }
+ 
+-static DEFINE_SIMPLE_DEV_PM_OPS(mt7925_pm_ops, mt7925_pci_suspend, mt7925_pci_resume);
++static int mt7925_pci_resume(struct device *device)
++{
++	return _mt7925_pci_resume(device, false);
++}
++
++static int mt7925_pci_restore(struct device *device)
++{
++	return _mt7925_pci_resume(device, true);
++}
++
++static const struct dev_pm_ops mt7925_pm_ops = {
++	.suspend = pm_sleep_ptr(mt7925_pci_suspend),
++	.resume  = pm_sleep_ptr(mt7925_pci_resume),
++	.freeze = pm_sleep_ptr(mt7925_pci_suspend),
++	.thaw = pm_sleep_ptr(mt7925_pci_resume),
++	.poweroff = pm_sleep_ptr(mt7925_pci_suspend),
++	.restore = pm_sleep_ptr(mt7925_pci_restore),
++};
+ 
+ static struct pci_driver mt7925_pci_driver = {
+ 	.name		= KBUILD_MODNAME,
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-disable-promiscuous-mode-by-default.patch b/queue-6.17/wifi-mt76-mt7996-disable-promiscuous-mode-by-default.patch
new file mode 100644
index 0000000000..1879daa937
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-disable-promiscuous-mode-by-default.patch
@@ -0,0 +1,38 @@
+From b69130d01aa932f80aa9889ce77caecda38a48b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:59:05 +0200
+Subject: wifi: mt76: mt7996: disable promiscuous mode by default
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit a4a66cbaa20f51cb953d09a95c67cb237a088ec9 ]
+
+Set MT_WF_RFCR_DROP_OTHER_UC by default and disable this flag in
+mt7996_set_monitor only if monitor mode is enabled.
+
+Without this patch, the MT_WF_RFCR_DROP_OTHER_UC would not be set so the
+driver would receive lots of packets meant for other devices.
+
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Link: https://patch.msgid.link/20250915075910.47558-10-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index a75b29bada141..5e81edde1e283 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -383,6 +383,7 @@ mt7996_init_wiphy_band(struct ieee80211_hw *hw, struct mt7996_phy *phy)
+ 
+ 	phy->slottime = 9;
+ 	phy->beacon_rate = -1;
++	phy->rxfilter = MT_WF_RFCR_DROP_OTHER_UC;
+ 
+ 	if (phy->mt76->cap.has_2ghz) {
+ 		phy->mt76->sband_2g.sband.ht_cap.cap |=
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch b/queue-6.17/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
new file mode 100644
index 0000000000..039c21bb96
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-fix-memory-leak-on-mt7996_mcu_sta_k.patch
@@ -0,0 +1,37 @@
+From 30d90d02ec60e8fad5b325208f0459e3dbf291a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:59:00 +0200
+Subject: wifi: mt76: mt7996: fix memory leak on mt7996_mcu_sta_key_tlv error
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 7c0f63fe37a5da2c13fc35c89053b31be8ead895 ]
+
+Free the allocated skb on error
+
+Link: https://patch.msgid.link/20250915075910.47558-5-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index aad58f7831c7b..0d688ec5a8163 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -2535,8 +2535,10 @@ int mt7996_mcu_add_key(struct mt76_dev *dev, struct ieee80211_vif *vif,
+ 		return PTR_ERR(skb);
+ 
+ 	ret = mt7996_mcu_sta_key_tlv(wcid, skb, key, cmd);
+-	if (ret)
++	if (ret) {
++		dev_kfree_skb(skb);
+ 		return ret;
++	}
+ 
+ 	return mt76_mcu_skb_send_msg(dev, skb, mcu_cmd, true);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-fix-mt7996_reverse_frag0_hdr_trans-.patch b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_reverse_frag0_hdr_trans-.patch
new file mode 100644
index 0000000000..5d6f9c756a
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-fix-mt7996_reverse_frag0_hdr_trans-.patch
@@ -0,0 +1,63 @@
+From ff14cd727579f0d95643b489fe36ff8f6c999931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 09:56:39 +0200
+Subject: wifi: mt76: mt7996: Fix mt7996_reverse_frag0_hdr_trans for MLO
+
+From: Shayne Chen <shayne.chen@mediatek.com>
+
+[ Upstream commit a3ea1c309bf32fdb3665898c40b3ff8ca29ba6c4 ]
+
+Update mt7996_reverse_frag0_hdr_trans routine to support MLO.
+
+Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-1-89d8fed67f20@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 28477702c18b3..222e720a56cf5 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -229,7 +229,9 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
+ {
+ 	struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb;
+ 	struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap);
+-	struct mt7996_sta *msta = (struct mt7996_sta *)status->wcid;
++	struct mt7996_sta_link *msta_link = (void *)status->wcid;
++	struct mt7996_sta *msta = msta_link->sta;
++	struct ieee80211_bss_conf *link_conf;
+ 	__le32 *rxd = (__le32 *)skb->data;
+ 	struct ieee80211_sta *sta;
+ 	struct ieee80211_vif *vif;
+@@ -246,8 +248,11 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
+ 	if (!msta || !msta->vif)
+ 		return -EINVAL;
+ 
+-	sta = container_of((void *)msta, struct ieee80211_sta, drv_priv);
++	sta = wcid_to_sta(status->wcid);
+ 	vif = container_of((void *)msta->vif, struct ieee80211_vif, drv_priv);
++	link_conf = rcu_dereference(vif->link_conf[msta_link->wcid.link_id]);
++	if (!link_conf)
++		return -EINVAL;
+ 
+ 	/* store the info from RXD and ethhdr to avoid being overridden */
+ 	frame_control = le32_get_bits(rxd[8], MT_RXD8_FRAME_CONTROL);
+@@ -260,7 +265,7 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap)
+ 	switch (frame_control & (IEEE80211_FCTL_TODS |
+ 				 IEEE80211_FCTL_FROMDS)) {
+ 	case 0:
+-		ether_addr_copy(hdr.addr3, vif->bss_conf.bssid);
++		ether_addr_copy(hdr.addr3, link_conf->bssid);
+ 		break;
+ 	case IEEE80211_FCTL_FROMDS:
+ 		ether_addr_copy(hdr.addr3, eth_hdr->h_source);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-set-def_wcid-pointer-in-mt7996_mac_.patch b/queue-6.17/wifi-mt76-mt7996-set-def_wcid-pointer-in-mt7996_mac_.patch
new file mode 100644
index 0000000000..f3ca89b692
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-set-def_wcid-pointer-in-mt7996_mac_.patch
@@ -0,0 +1,37 @@
+From abe9604e4b2e7c9e5ee11ecb2c13e7ed9f77fa0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jul 2025 12:41:23 +0200
+Subject: wifi: mt76: mt7996: Set def_wcid pointer in
+ mt7996_mac_sta_init_link()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit a70b5903c57308fff525cbd62654f6104aa7ecbf ]
+
+In order to get the ieee80211_sta pointer from wcid struct for a MLO
+client, set def_wcid pointer in mt7996_mac_sta_init_link routine.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
+Link: https://patch.msgid.link/20250731-mt7996-mlo-devel-v1-1-7ff4094285d0@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+index d01b5778da20e..4693d376e64ee 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+@@ -969,6 +969,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev,
+ 	msta_link->wcid.sta = 1;
+ 	msta_link->wcid.idx = idx;
+ 	msta_link->wcid.link_id = link_id;
++	msta_link->wcid.def_wcid = &msta->deflink.wcid;
+ 
+ 	ewma_avg_signal_init(&msta_link->avg_ack_signal);
+ 	ewma_signal_init(&msta_link->wcid.rssi);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-support-writing-mac-txd-for-addba-r.patch b/queue-6.17/wifi-mt76-mt7996-support-writing-mac-txd-for-addba-r.patch
new file mode 100644
index 0000000000..9c40ae658c
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-support-writing-mac-txd-for-addba-r.patch
@@ -0,0 +1,177 @@
+From 69aa732ec6f75d416afa79277dacb57b0c777f48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 17:35:49 +0200
+Subject: wifi: mt76: mt7996: support writing MAC TXD for AddBA Request
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit cb6ebbdffef2a888b95f121637cd1fad473919c6 ]
+
+Support writing MAC TXD for the AddBA Req. Without this commit, the
+start sequence number in AddBA Req will be unexpected value for MT7996
+and MT7992. This can result in certain stations (e.g., AX200) dropping
+packets, leading to ping failures and degraded connectivity. Ensuring
+the correct MAC TXD and TXP helps maintain reliable packet transmission
+and prevents interoperability issues with affected stations.
+
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Link: https://patch.msgid.link/20250909-mt7996-addba-txd-fix-v1-1-feec16f0c6f0@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt76_connac3_mac.h |  7 ++
+ .../net/wireless/mediatek/mt76/mt7996/mac.c   | 91 +++++++++++++------
+ 2 files changed, 69 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h
+index 1013cad57a7ff..c5eaedca11e09 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac3_mac.h
+@@ -294,6 +294,13 @@ enum tx_frag_idx {
+ #define MT_TXP_BUF_LEN			GENMASK(11, 0)
+ #define MT_TXP_DMA_ADDR_H		GENMASK(15, 12)
+ 
++#define MT_TXP0_TOKEN_ID0		GENMASK(14, 0)
++#define MT_TXP0_TOKEN_ID0_VALID_MASK	BIT(15)
++
++#define MT_TXP1_TID_ADDBA		GENMASK(14, 12)
++#define MT_TXP3_ML0_MASK		BIT(15)
++#define MT_TXP3_DMA_ADDR_H		GENMASK(13, 12)
++
+ #define MT_TX_RATE_STBC			BIT(14)
+ #define MT_TX_RATE_NSS			GENMASK(13, 10)
+ #define MT_TX_RATE_MODE			GENMASK(9, 6)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 222e720a56cf5..30e2ef1404b90 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -802,6 +802,9 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
+ 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
+ 		if (is_mt7990(&dev->mt76))
+ 			txwi[6] |= cpu_to_le32(FIELD_PREP(MT_TXD6_TID_ADDBA, tid));
++		else
++			txwi[7] |= cpu_to_le32(MT_TXD7_MAC_TXD);
++
+ 		tid = MT_TX_ADDBA;
+ 	} else if (ieee80211_is_mgmt(hdr->frame_control)) {
+ 		tid = MT_TX_NORMAL;
+@@ -1034,10 +1037,10 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
+ 	struct ieee80211_key_conf *key = info->control.hw_key;
+ 	struct ieee80211_vif *vif = info->control.vif;
+-	struct mt76_connac_txp_common *txp;
+ 	struct mt76_txwi_cache *t;
+ 	int id, i, pid, nbuf = tx_info->nbuf - 1;
+ 	bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
++	__le32 *ptr = (__le32 *)txwi_ptr;
+ 	u8 *txwi = (u8 *)txwi_ptr;
+ 
+ 	if (unlikely(tx_info->skb->len <= ETH_HLEN))
+@@ -1060,46 +1063,76 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
+ 		mt7996_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, key,
+ 				      pid, qid, 0);
+ 
+-	txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
+-	for (i = 0; i < nbuf; i++) {
+-		u16 len;
++	/* MT7996 and MT7992 require driver to provide the MAC TXP for AddBA
++	 * req
++	 */
++	if (le32_to_cpu(ptr[7]) & MT_TXD7_MAC_TXD) {
++		u32 val;
++
++		ptr = (__le32 *)(txwi + MT_TXD_SIZE);
++		memset((void *)ptr, 0, sizeof(struct mt76_connac_fw_txp));
++
++		val = FIELD_PREP(MT_TXP0_TOKEN_ID0, id) |
++		      MT_TXP0_TOKEN_ID0_VALID_MASK;
++		ptr[0] = cpu_to_le32(val);
+ 
+-		len = FIELD_PREP(MT_TXP_BUF_LEN, tx_info->buf[i + 1].len);
++		val = FIELD_PREP(MT_TXP1_TID_ADDBA,
++				 tx_info->skb->priority &
++				 IEEE80211_QOS_CTL_TID_MASK);
++		ptr[1] = cpu_to_le32(val);
++		ptr[2] = cpu_to_le32(tx_info->buf[1].addr & 0xFFFFFFFF);
++
++		val = FIELD_PREP(MT_TXP_BUF_LEN, tx_info->buf[1].len) |
++		      MT_TXP3_ML0_MASK;
+ #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
+-		len |= FIELD_PREP(MT_TXP_DMA_ADDR_H,
+-				  tx_info->buf[i + 1].addr >> 32);
++		val |= FIELD_PREP(MT_TXP3_DMA_ADDR_H,
++				  tx_info->buf[1].addr >> 32);
+ #endif
++		ptr[3] = cpu_to_le32(val);
++	} else {
++		struct mt76_connac_txp_common *txp;
+ 
+-		txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
+-		txp->fw.len[i] = cpu_to_le16(len);
+-	}
+-	txp->fw.nbuf = nbuf;
++		txp = (struct mt76_connac_txp_common *)(txwi + MT_TXD_SIZE);
++		for (i = 0; i < nbuf; i++) {
++			u16 len;
++
++			len = FIELD_PREP(MT_TXP_BUF_LEN, tx_info->buf[i + 1].len);
++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
++			len |= FIELD_PREP(MT_TXP_DMA_ADDR_H,
++					  tx_info->buf[i + 1].addr >> 32);
++#endif
+ 
+-	txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
++			txp->fw.buf[i] = cpu_to_le32(tx_info->buf[i + 1].addr);
++			txp->fw.len[i] = cpu_to_le16(len);
++		}
++		txp->fw.nbuf = nbuf;
+ 
+-	if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
++		txp->fw.flags = cpu_to_le16(MT_CT_INFO_FROM_HOST);
+ 
+-	if (!key)
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
++		if (!is_8023 || pid >= MT_PACKET_ID_FIRST)
++			txp->fw.flags |= cpu_to_le16(MT_CT_INFO_APPLY_TXD);
+ 
+-	if (!is_8023 && mt7996_tx_use_mgmt(dev, tx_info->skb))
+-		txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
++		if (!key)
++			txp->fw.flags |= cpu_to_le16(MT_CT_INFO_NONE_CIPHER_FRAME);
+ 
+-	if (vif) {
+-		struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+-		struct mt76_vif_link *mlink = NULL;
++		if (!is_8023 && mt7996_tx_use_mgmt(dev, tx_info->skb))
++			txp->fw.flags |= cpu_to_le16(MT_CT_INFO_MGMT_FRAME);
+ 
+-		if (wcid->offchannel)
+-			mlink = rcu_dereference(mvif->mt76.offchannel_link);
+-		if (!mlink)
+-			mlink = rcu_dereference(mvif->mt76.link[wcid->link_id]);
++		if (vif) {
++			struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
++			struct mt76_vif_link *mlink = NULL;
+ 
+-		txp->fw.bss_idx = mlink ? mlink->idx : mvif->deflink.mt76.idx;
+-	}
++			if (wcid->offchannel)
++				mlink = rcu_dereference(mvif->mt76.offchannel_link);
++			if (!mlink)
++				mlink = rcu_dereference(mvif->mt76.link[wcid->link_id]);
+ 
+-	txp->fw.token = cpu_to_le16(id);
+-	txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff);
++			txp->fw.bss_idx = mlink ? mlink->idx : mvif->deflink.mt76.idx;
++		}
++
++		txp->fw.token = cpu_to_le16(id);
++		txp->fw.rept_wds_wcid = cpu_to_le16(sta ? wcid->idx : 0xfff);
++	}
+ 
+ 	tx_info->skb = NULL;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-mt7996-temporarily-disable-epcs.patch b/queue-6.17/wifi-mt76-mt7996-temporarily-disable-epcs.patch
new file mode 100644
index 0000000000..fc14faedfc
--- /dev/null
+++ b/queue-6.17/wifi-mt76-mt7996-temporarily-disable-epcs.patch
@@ -0,0 +1,36 @@
+From ab8bfc69059c33266a421d40ec3fe198dd962474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 09:56:42 +0200
+Subject: wifi: mt76: mt7996: Temporarily disable EPCS
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit e6291bb7a5935b2f1d337fd7a58eab7ada6678ad ]
+
+EPCS is not yet ready, so do not claim to support it.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-4-89d8fed67f20@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 84015ab24af62..5a77771e3e6d6 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -1330,7 +1330,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 	eht_cap->has_eht = true;
+ 
+ 	eht_cap_elem->mac_cap_info[0] =
+-		IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
+ 		IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
+ 		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
+ 			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-mt76-use-altx-queue-for-offchannel-tx-on-connac.patch b/queue-6.17/wifi-mt76-use-altx-queue-for-offchannel-tx-on-connac.patch
new file mode 100644
index 0000000000..2161f39210
--- /dev/null
+++ b/queue-6.17/wifi-mt76-use-altx-queue-for-offchannel-tx-on-connac.patch
@@ -0,0 +1,36 @@
+From 479bd94037188c554bde4ae3768ca6c2af913baf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 09:59:04 +0200
+Subject: wifi: mt76: use altx queue for offchannel tx on connac+
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 12911593efa97abc27b75e98c530b8b1193c384b ]
+
+This ensures that packets are sent out immediately and are not held by
+firmware internal buffering.
+
+Link: https://patch.msgid.link/20250915075910.47558-9-nbd@nbd.name
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
+index 8ab5840fee57f..b78ae6a34b658 100644
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -618,7 +618,8 @@ mt76_txq_schedule_pending_wcid(struct mt76_phy *phy, struct mt76_wcid *wcid,
+ 		    !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
+ 		    !ieee80211_is_data(hdr->frame_control) &&
+ 		    (!ieee80211_is_bufferable_mmpdu(skb) ||
+-		     ieee80211_is_deauth(hdr->frame_control)))
++		     ieee80211_is_deauth(hdr->frame_control) ||
++		     head == &wcid->tx_offchannel))
+ 			qid = MT_TXQ_PSD;
+ 
+ 		q = phy->q_tx[qid];
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch b/queue-6.17/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
new file mode 100644
index 0000000000..4978f8fb07
--- /dev/null
+++ b/queue-6.17/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
@@ -0,0 +1,52 @@
+From 06e9ff335d6214aebb3a22911b254a37e8f655d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 08:48:15 +0800
+Subject: wifi: rtw88: sdio: use indirect IO for device registers before
+ power-on
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 58de1f91e033b1fface8d8948984583125f93736 ]
+
+The register REG_SYS_CFG1 is used to determine chip basic information
+as arguments of following flows, such as download firmware and load PHY
+parameters, so driver read the value early (before power-on).
+
+However, the direct IO is disallowed before power-on, or it causes wrong
+values, which driver recognizes a chip as a wrong type RF_1T1R, but
+actually RF_2T2R, causing driver warns:
+
+  rtw88_8822cs mmc1:0001:1: unsupported rf path (1)
+
+Fix it by using indirect IO before power-on.
+
+Reported-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/699C22B4-A3E3-4206-97D0-22AB3348EBF6@gmail.com/T/#t
+Suggested-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Tested-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250724004815.7043-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
+index cc2d4fef35879..99d7c629eac6f 100644
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -144,6 +144,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr,
+ 
+ static bool rtw_sdio_use_direct_io(struct rtw_dev *rtwdev, u32 addr)
+ {
++	if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags) &&
++	    !rtw_sdio_is_bus_addr(addr))
++		return false;
++
+ 	return !rtw_sdio_is_sdio30_supported(rtwdev) ||
+ 		rtw_sdio_is_bus_addr(addr);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-8851b-rfk-update-iqk-tia-setting.patch b/queue-6.17/wifi-rtw89-8851b-rfk-update-iqk-tia-setting.patch
new file mode 100644
index 0000000000..6fd0d6c35c
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-8851b-rfk-update-iqk-tia-setting.patch
@@ -0,0 +1,215 @@
+From fedd2bf2f42f22f03ec7e7cc90a4383d02b870e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:37:40 +0800
+Subject: wifi: rtw89: 8851b: rfk: update IQK TIA setting
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit b521685da35ebf091e51f9ea9ad2896a4ddb6e98 ]
+
+With the new TIA setting of RX IQK, unstable RX throughput can
+be avoided, especially in medium-high attenuation environments.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250811123744.15361-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtw89/rtw8851b_rfk.c | 85 ++++++++++++-------
+ 1 file changed, 54 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
+index 7a319a6c838af..a7867b0e083ac 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8851b_rfk.c
+@@ -17,7 +17,7 @@
+ #define DPK_RF_REG_NUM_8851B 4
+ #define DPK_KSET_NUM 4
+ #define RTW8851B_RXK_GROUP_NR 4
+-#define RTW8851B_RXK_GROUP_IDX_NR 2
++#define RTW8851B_RXK_GROUP_IDX_NR 4
+ #define RTW8851B_TXK_GROUP_NR 1
+ #define RTW8851B_IQK_VER 0x14
+ #define RTW8851B_IQK_SS 1
+@@ -114,9 +114,9 @@ static const u32 _tssi_de_mcs_10m[RF_PATH_NUM_8851B] = {0x5830};
+ static const u32 g_idxrxgain[RTW8851B_RXK_GROUP_NR] = {0x10e, 0x116, 0x28e, 0x296};
+ static const u32 g_idxattc2[RTW8851B_RXK_GROUP_NR] = {0x0, 0xf, 0x0, 0xf};
+ static const u32 g_idxrxagc[RTW8851B_RXK_GROUP_NR] = {0x0, 0x1, 0x2, 0x3};
+-static const u32 a_idxrxgain[RTW8851B_RXK_GROUP_IDX_NR] = {0x10C, 0x28c};
+-static const u32 a_idxattc2[RTW8851B_RXK_GROUP_IDX_NR] = {0xf, 0xf};
+-static const u32 a_idxrxagc[RTW8851B_RXK_GROUP_IDX_NR] = {0x4, 0x6};
++static const u32 a_idxrxgain[RTW8851B_RXK_GROUP_IDX_NR] = {0x10C, 0x112, 0x28c, 0x292};
++static const u32 a_idxattc2[RTW8851B_RXK_GROUP_IDX_NR] = {0xf, 0xf, 0xf, 0xf};
++static const u32 a_idxrxagc[RTW8851B_RXK_GROUP_IDX_NR] = {0x4, 0x5, 0x6, 0x7};
+ static const u32 a_power_range[RTW8851B_TXK_GROUP_NR] = {0x0};
+ static const u32 a_track_range[RTW8851B_TXK_GROUP_NR] = {0x6};
+ static const u32 a_gain_bb[RTW8851B_TXK_GROUP_NR] = {0x0a};
+@@ -139,17 +139,6 @@ static const u32 dpk_rf_reg[DPK_RF_REG_NUM_8851B] = {0xde, 0x8f, 0x5, 0x10005};
+ 
+ static void _set_ch(struct rtw89_dev *rtwdev, u32 val);
+ 
+-static u8 _rxk_5ghz_group_from_idx(u8 idx)
+-{
+-	/* There are four RXK groups (RTW8851B_RXK_GROUP_NR), but only group 0
+-	 * and 2 are used in 5 GHz band, so reduce elements to 2.
+-	 */
+-	if (idx < RTW8851B_RXK_GROUP_IDX_NR)
+-		return idx * 2;
+-
+-	return 0;
+-}
+-
+ static u8 _kpath(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx)
+ {
+ 	return RF_A;
+@@ -196,7 +185,7 @@ static void _txck_force(struct rtw89_dev *rtwdev, enum rtw89_rf_path path,
+ static void _rxck_force(struct rtw89_dev *rtwdev, enum rtw89_rf_path path,
+ 			bool force, enum adc_ck ck)
+ {
+-	static const u32 ck960_8851b[] = {0x8, 0x2, 0x2, 0x4, 0xf, 0xa, 0x93};
++	static const u32 ck960_8851b[] = {0x8, 0x2, 0x2, 0x4, 0xf, 0xa, 0x92};
+ 	static const u32 ck1920_8851b[] = {0x9, 0x0, 0x0, 0x3, 0xf, 0xa, 0x49};
+ 	const u32 *data;
+ 
+@@ -905,18 +894,27 @@ static bool _rxk_5g_group_sel(struct rtw89_dev *rtwdev,
+ 	bool kfail = false;
+ 	bool notready;
+ 	u32 rf_0;
+-	u8 idx;
++	u32 val;
+ 	u8 gp;
+ 
+ 	rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK]===>%s\n", __func__);
+ 
+-	for (idx = 0; idx < RTW8851B_RXK_GROUP_IDX_NR; idx++) {
+-		gp = _rxk_5ghz_group_from_idx(idx);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x1000);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x4);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x17);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x5);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x27);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x0);
+ 
++	val = rtw89_read_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_MASK, 0xc);
++
++	for (gp = 0; gp < RTW8851B_RXK_GROUP_IDX_NR; gp++) {
+ 		rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK]S%x, gp = %x\n", path, gp);
+ 
+-		rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_RGM, a_idxrxgain[idx]);
+-		rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, RR_RXA2_ATT, a_idxattc2[idx]);
++		rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_RGM, a_idxrxgain[gp]);
++		rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, RR_RXA2_ATT, a_idxattc2[gp]);
++		rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20, 0x1);
+ 
+ 		rtw89_phy_write32_mask(rtwdev, R_CFIR_LUT, B_CFIR_LUT_SEL, 0x1);
+ 		rtw89_phy_write32_mask(rtwdev, R_CFIR_LUT, B_CFIR_LUT_G3, 0x0);
+@@ -926,7 +924,7 @@ static bool _rxk_5g_group_sel(struct rtw89_dev *rtwdev,
+ 		fsleep(100);
+ 		rf_0 = rtw89_read_rf(rtwdev, path, RR_MOD, RFREG_MASK);
+ 		rtw89_phy_write32_mask(rtwdev, R_IQK_DIF2, B_IQK_DIF2_RXPI, rf_0);
+-		rtw89_phy_write32_mask(rtwdev, R_IQK_RXA, B_IQK_RXAGC, a_idxrxagc[idx]);
++		rtw89_phy_write32_mask(rtwdev, R_IQK_RXA, B_IQK_RXAGC, a_idxrxagc[gp]);
+ 		rtw89_phy_write32_mask(rtwdev, R_IQK_DIF4, B_IQK_DIF4_RXT, 0x11);
+ 		notready = _iqk_one_shot(rtwdev, phy_idx, path, ID_RXAGC);
+ 
+@@ -959,6 +957,7 @@ static bool _rxk_5g_group_sel(struct rtw89_dev *rtwdev,
+ 		_iqk_sram(rtwdev, path);
+ 
+ 	if (kfail) {
++		rtw89_phy_write32_mask(rtwdev, R_IQK_RES, B_IQK_RES_RXCFIR, 0x0);
+ 		rtw89_phy_write32_mask(rtwdev, R_RXIQC + (path << 8), MASKDWORD,
+ 				       iqk_info->nb_rxcfir[path] | 0x2);
+ 		iqk_info->is_wb_txiqk[path] = false;
+@@ -968,6 +967,14 @@ static bool _rxk_5g_group_sel(struct rtw89_dev *rtwdev,
+ 		iqk_info->is_wb_txiqk[path] = true;
+ 	}
+ 
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20, val);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x1000);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x4);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x37);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x5);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x27);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x0);
++
+ 	rtw89_debug(rtwdev, RTW89_DBG_RFK,
+ 		    "[IQK]S%x, kfail = 0x%x, 0x8%x3c = 0x%x\n", path, kfail,
+ 		    1 << path, iqk_info->nb_rxcfir[path]);
+@@ -980,17 +987,26 @@ static bool _iqk_5g_nbrxk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,
+ 	struct rtw89_iqk_info *iqk_info = &rtwdev->iqk;
+ 	bool kfail = false;
+ 	bool notready;
+-	u8 idx = 0x1;
++	u8 gp = 2;
+ 	u32 rf_0;
+-	u8 gp;
+-
+-	gp = _rxk_5ghz_group_from_idx(idx);
++	u32 val;
+ 
+ 	rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK]===>%s\n", __func__);
+ 	rtw89_debug(rtwdev, RTW89_DBG_RFK, "[IQK]S%x, gp = %x\n", path, gp);
+ 
+-	rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_RGM, a_idxrxgain[idx]);
+-	rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, RR_RXA2_ATT, a_idxattc2[idx]);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x1000);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x4);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x17);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x5);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x27);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x0);
++
++	val = rtw89_read_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_MASK, 0xc);
++
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_MOD, RR_MOD_RGM, a_idxrxgain[gp]);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, RR_RXA2_ATT, a_idxattc2[gp]);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20, 0x1);
+ 
+ 	rtw89_phy_write32_mask(rtwdev, R_CFIR_LUT, B_CFIR_LUT_SEL, 0x1);
+ 	rtw89_phy_write32_mask(rtwdev, R_CFIR_LUT, B_CFIR_LUT_G3, 0x0);
+@@ -1000,7 +1016,7 @@ static bool _iqk_5g_nbrxk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,
+ 	fsleep(100);
+ 	rf_0 = rtw89_read_rf(rtwdev, path, RR_MOD, RFREG_MASK);
+ 	rtw89_phy_write32_mask(rtwdev, R_IQK_DIF2, B_IQK_DIF2_RXPI, rf_0);
+-	rtw89_phy_write32_mask(rtwdev, R_IQK_RXA, B_IQK_RXAGC, a_idxrxagc[idx]);
++	rtw89_phy_write32_mask(rtwdev, R_IQK_RXA, B_IQK_RXAGC, a_idxrxagc[gp]);
+ 	rtw89_phy_write32_mask(rtwdev, R_IQK_DIF4, B_IQK_DIF4_RXT, 0x11);
+ 	notready = _iqk_one_shot(rtwdev, phy_idx, path, ID_RXAGC);
+ 
+@@ -1026,6 +1042,7 @@ static bool _iqk_5g_nbrxk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,
+ 		kfail = !!rtw89_phy_read32_mask(rtwdev, R_NCTL_RPT, B_NCTL_RPT_FLG);
+ 
+ 	if (kfail) {
++		rtw89_phy_write32_mask(rtwdev, R_IQK_RES + (path << 8), 0xf, 0x0);
+ 		rtw89_phy_write32_mask(rtwdev, R_RXIQC + (path << 8),
+ 				       MASKDWORD, 0x40000002);
+ 		iqk_info->is_wb_rxiqk[path] = false;
+@@ -1033,6 +1050,14 @@ static bool _iqk_5g_nbrxk(struct rtw89_dev *rtwdev, enum rtw89_phy_idx phy_idx,
+ 		iqk_info->is_wb_rxiqk[path] = false;
+ 	}
+ 
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_RXA2, 0x20, val);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x1000);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x4);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x37);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWA, RFREG_MASK, 0x5);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWD0, RFREG_MASK, 0x27);
++	rtw89_write_rf(rtwdev, RF_PATH_A, RR_LUTWE, RFREG_MASK, 0x0);
++
+ 	rtw89_debug(rtwdev, RTW89_DBG_RFK,
+ 		    "[IQK]S%x, kfail = 0x%x, 0x8%x3c = 0x%x\n", path, kfail,
+ 		    1 << path, iqk_info->nb_rxcfir[path]);
+@@ -1664,8 +1689,6 @@ static void _iqk_init(struct rtw89_dev *rtwdev)
+ 	struct rtw89_iqk_info *iqk_info = &rtwdev->iqk;
+ 	u8 idx, path;
+ 
+-	rtw89_phy_write32_mask(rtwdev, R_IQKINF, MASKDWORD, 0x0);
+-
+ 	if (iqk_info->is_iqk_init)
+ 		return;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-add-dummy-c2h-handlers-for-bcn-resend-and.patch b/queue-6.17/wifi-rtw89-add-dummy-c2h-handlers-for-bcn-resend-and.patch
new file mode 100644
index 0000000000..e0ca194ea9
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-add-dummy-c2h-handlers-for-bcn-resend-and.patch
@@ -0,0 +1,88 @@
+From 5e924d5ea8d6e751403046e0862ed95e91a5aa8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 09:22:34 +0800
+Subject: wifi: rtw89: add dummy C2H handlers for BCN resend and update done
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 04a2de8cfc95076d6c65d4d6d06d0f9d964a2105 ]
+
+Two C2H events are not listed, and driver throws
+
+  MAC c2h class 0 func 6 not support
+  MAC c2h class 1 func 3 not support
+
+Since the implementation in vendor driver does nothing, add two dummy
+functions for them.
+
+Reported-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/d2d62793-046c-4b55-93ed-1d1f43cff7f2@gmail.com/
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250804012234.8913-3-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/mac.c | 13 ++++++++++++-
+ drivers/net/wireless/realtek/rtw89/mac.h |  1 +
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index ef17a307b7702..33a7dd9d6f0e6 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -5235,6 +5235,11 @@ rtw89_mac_c2h_bcn_cnt(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
+ {
+ }
+ 
++static void
++rtw89_mac_c2h_bcn_upd_done(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
++{
++}
++
+ static void
+ rtw89_mac_c2h_pkt_ofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *skb_c2h,
+ 			   u32 len)
+@@ -5257,6 +5262,11 @@ rtw89_mac_c2h_pkt_ofld_rsp(struct rtw89_dev *rtwdev, struct sk_buff *skb_c2h,
+ 	rtw89_complete_cond(wait, cond, &data);
+ }
+ 
++static void
++rtw89_mac_c2h_bcn_resend(struct rtw89_dev *rtwdev, struct sk_buff *c2h, u32 len)
++{
++}
++
+ static void
+ rtw89_mac_c2h_tx_duty_rpt(struct rtw89_dev *rtwdev, struct sk_buff *skb_c2h, u32 len)
+ {
+@@ -5646,7 +5656,7 @@ void (* const rtw89_mac_c2h_ofld_handler[])(struct rtw89_dev *rtwdev,
+ 	[RTW89_MAC_C2H_FUNC_EFUSE_DUMP] = NULL,
+ 	[RTW89_MAC_C2H_FUNC_READ_RSP] = NULL,
+ 	[RTW89_MAC_C2H_FUNC_PKT_OFLD_RSP] = rtw89_mac_c2h_pkt_ofld_rsp,
+-	[RTW89_MAC_C2H_FUNC_BCN_RESEND] = NULL,
++	[RTW89_MAC_C2H_FUNC_BCN_RESEND] = rtw89_mac_c2h_bcn_resend,
+ 	[RTW89_MAC_C2H_FUNC_MACID_PAUSE] = rtw89_mac_c2h_macid_pause,
+ 	[RTW89_MAC_C2H_FUNC_SCANOFLD_RSP] = rtw89_mac_c2h_scanofld_rsp,
+ 	[RTW89_MAC_C2H_FUNC_TX_DUTY_RPT] = rtw89_mac_c2h_tx_duty_rpt,
+@@ -5661,6 +5671,7 @@ void (* const rtw89_mac_c2h_info_handler[])(struct rtw89_dev *rtwdev,
+ 	[RTW89_MAC_C2H_FUNC_DONE_ACK] = rtw89_mac_c2h_done_ack,
+ 	[RTW89_MAC_C2H_FUNC_C2H_LOG] = rtw89_mac_c2h_log,
+ 	[RTW89_MAC_C2H_FUNC_BCN_CNT] = rtw89_mac_c2h_bcn_cnt,
++	[RTW89_MAC_C2H_FUNC_BCN_UPD_DONE] = rtw89_mac_c2h_bcn_upd_done,
+ };
+ 
+ static
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.h b/drivers/net/wireless/realtek/rtw89/mac.h
+index 241e89983c4ad..25fe5e5c8a979 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.h
++++ b/drivers/net/wireless/realtek/rtw89/mac.h
+@@ -419,6 +419,7 @@ enum rtw89_mac_c2h_info_func {
+ 	RTW89_MAC_C2H_FUNC_DONE_ACK,
+ 	RTW89_MAC_C2H_FUNC_C2H_LOG,
+ 	RTW89_MAC_C2H_FUNC_BCN_CNT,
++	RTW89_MAC_C2H_FUNC_BCN_UPD_DONE = 0x06,
+ 	RTW89_MAC_C2H_FUNC_INFO_MAX,
+ };
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-add-usb-id-2001-3327-for-d-link-ax18u-rev.patch b/queue-6.17/wifi-rtw89-add-usb-id-2001-3327-for-d-link-ax18u-rev.patch
new file mode 100644
index 0000000000..0b086f289f
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-add-usb-id-2001-3327-for-d-link-ax18u-rev.patch
@@ -0,0 +1,38 @@
+From 639ebf3839eb40b7f0e655e7539e995b0e40596b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 06:31:00 +0800
+Subject: wifi: rtw89: Add USB ID 2001:3327 for D-Link AX18U rev. A1
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 17002412a82feb21be040bd5577789049dfeebe2 ]
+
+Add USB ID 2001:3327 for D-Link AX18U rev. A1 which is a RTL8832BU-based
+Wi-Fi adapter.
+
+Link: https://github.com/morrownr/rtw89/pull/17
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250903223100.3031-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8852bu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+index b315cb997758a..0694272f7ffae 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8852bu.c
+@@ -30,6 +30,8 @@ static const struct usb_device_id rtw_8852bu_id_table[] = {
+ 	  .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x0db0, 0x6931, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3327, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x3574, 0x6121, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&rtw89_8852bu_info },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x35bc, 0x0100, 0xff, 0xff, 0xff),
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-add-usb-id-2001-332a-for-d-link-ax9u-rev..patch b/queue-6.17/wifi-rtw89-add-usb-id-2001-332a-for-d-link-ax9u-rev..patch
new file mode 100644
index 0000000000..59f03f8ee8
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-add-usb-id-2001-332a-for-d-link-ax9u-rev..patch
@@ -0,0 +1,40 @@
+From c850e208e3540ed1c3ce7d9c1611b14ad82621f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 11:57:55 +0800
+Subject: wifi: rtw89: Add USB ID 2001:332a for D-Link AX9U rev. A1
+
+From: Zenm Chen <zenmchen@gmail.com>
+
+[ Upstream commit 2ffc73cdb8247dc09b6534c4018681a126c1d5f5 ]
+
+Add USB ID 2001:332a for D-Link AX9U rev. A1 which is a RTL8851BU-based
+Wi-Fi adapter.
+
+Only managed mode and AP mode are tested and it works in both.
+
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250902035755.1969530-1-zenmchen@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/rtw8851bu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c
+index c3722547c6b09..04e1ab13b7535 100644
+--- a/drivers/net/wireless/realtek/rtw89/rtw8851bu.c
++++ b/drivers/net/wireless/realtek/rtw89/rtw8851bu.c
+@@ -16,6 +16,9 @@ static const struct rtw89_driver_info rtw89_8851bu_info = {
+ static const struct usb_device_id rtw_8851bu_id_table[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x0bda, 0xb851, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&rtw89_8851bu_info },
++	/* D-Link AX9U rev. A1 */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x332a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&rtw89_8851bu_info },
+ 	/* TP-Link Archer TX10UB Nano */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x3625, 0x010b, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&rtw89_8851bu_info },
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-coex-limit-wi-fi-scan-slot-cost-to-avoid-.patch b/queue-6.17/wifi-rtw89-coex-limit-wi-fi-scan-slot-cost-to-avoid-.patch
new file mode 100644
index 0000000000..0671ee7e43
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-coex-limit-wi-fi-scan-slot-cost-to-avoid-.patch
@@ -0,0 +1,62 @@
+From d9734889961373e6897072aca79a4246146dc102 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 11:44:28 +0800
+Subject: wifi: rtw89: coex: Limit Wi-Fi scan slot cost to avoid A2DP glitch
+
+From: Ching-Te Ku <ku920601@realtek.com>
+
+[ Upstream commit ebea22c7f1b2f06f4ff0719d76bd19830cf25c9f ]
+
+When Wi-Fi is scanning at 2.4GHz, PTA will abort almost all the BT request.
+Once the Wi-Fi slot stay too long, BT audio device can not get enough data,
+audio glitch will happened. This patch limit 2.4Ghz Wi-Fi slot to 80ms
+while Wi-Fi is scanning to avoid audio glitch.
+
+Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250819034428.26307-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/coex.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
+index e4e6daf51a1ba..0f7ae572ef915 100644
+--- a/drivers/net/wireless/realtek/rtw89/coex.c
++++ b/drivers/net/wireless/realtek/rtw89/coex.c
+@@ -93,7 +93,7 @@ static const struct rtw89_btc_fbtc_slot s_def[] = {
+ 	[CXST_E2G]	= __DEF_FBTC_SLOT(5,   0xea5a5a5a, SLOT_MIX),
+ 	[CXST_E5G]	= __DEF_FBTC_SLOT(5,   0xffffffff, SLOT_ISO),
+ 	[CXST_EBT]	= __DEF_FBTC_SLOT(5,   0xe5555555, SLOT_MIX),
+-	[CXST_ENULL]	= __DEF_FBTC_SLOT(5,   0xaaaaaaaa, SLOT_ISO),
++	[CXST_ENULL]	= __DEF_FBTC_SLOT(5,   0x55555555, SLOT_MIX),
+ 	[CXST_WLK]	= __DEF_FBTC_SLOT(250, 0xea5a5a5a, SLOT_MIX),
+ 	[CXST_W1FDD]	= __DEF_FBTC_SLOT(50,  0xffffffff, SLOT_ISO),
+ 	[CXST_B1FDD]	= __DEF_FBTC_SLOT(50,  0xffffdfff, SLOT_ISO),
+@@ -4153,6 +4153,7 @@ void rtw89_btc_set_policy_v1(struct rtw89_dev *rtwdev, u16 policy_type)
+ 				     s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
+ 			_slot_set_le(btc, CXST_ENULL, s_def[CXST_ENULL].dur,
+ 				     s_def[CXST_ENULL].cxtbl, s_def[CXST_ENULL].cxtype);
++			_slot_set_dur(btc, CXST_EBT, dur_2);
+ 			break;
+ 		case BTC_CXP_OFFE_DEF2:
+ 			_slot_set(btc, CXST_E2G, 20, cxtbl[1], SLOT_ISO);
+@@ -4162,6 +4163,7 @@ void rtw89_btc_set_policy_v1(struct rtw89_dev *rtwdev, u16 policy_type)
+ 				     s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
+ 			_slot_set_le(btc, CXST_ENULL, s_def[CXST_ENULL].dur,
+ 				     s_def[CXST_ENULL].cxtbl, s_def[CXST_ENULL].cxtype);
++			_slot_set_dur(btc, CXST_EBT, dur_2);
+ 			break;
+ 		case BTC_CXP_OFFE_2GBWMIXB:
+ 			if (a2dp->exist)
+@@ -4170,6 +4172,7 @@ void rtw89_btc_set_policy_v1(struct rtw89_dev *rtwdev, u16 policy_type)
+ 				_slot_set(btc, CXST_E2G, 5, tbl_w1, SLOT_MIX);
+ 			_slot_set_le(btc, CXST_EBT, cpu_to_le16(40),
+ 				     s_def[CXST_EBT].cxtbl, s_def[CXST_EBT].cxtype);
++			_slot_set_dur(btc, CXST_EBT, dur_2);
+ 			break;
+ 		case BTC_CXP_OFFE_WL: /* for 4-way */
+ 			_slot_set(btc, CXST_E2G, 5, cxtbl[1], SLOT_MIX);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-disable-rtw89_physts_ie09_ftr_0-for-ppdu-.patch b/queue-6.17/wifi-rtw89-disable-rtw89_physts_ie09_ftr_0-for-ppdu-.patch
new file mode 100644
index 0000000000..f0cf25779d
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-disable-rtw89_physts_ie09_ftr_0-for-ppdu-.patch
@@ -0,0 +1,37 @@
+From 3020d926b4a9c675ccd7f932e0e073f9290cfdcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:52:05 +0800
+Subject: wifi: rtw89: disable RTW89_PHYSTS_IE09_FTR_0 for ppdu status
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 4e79a5cc01c5e1f1ba393ed3b44b0c3611eaadf1 ]
+
+The IE length of RTW89_PHYSTS_IE09_FTR_0 is dynamic, need to calculate
+more to get it. This IE is not necessary now, disable it to avoid get
+wrong IE length to let the parse function check failed.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250915065213.38659-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/phy.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
+index 01a03d2de3ffb..59cb32720fb7b 100644
+--- a/drivers/net/wireless/realtek/rtw89/phy.c
++++ b/drivers/net/wireless/realtek/rtw89/phy.c
+@@ -5929,8 +5929,6 @@ static void __rtw89_physts_parsing_init(struct rtw89_dev *rtwdev,
+ 			val |= BIT(RTW89_PHYSTS_IE13_DL_MU_DEF) |
+ 			       BIT(RTW89_PHYSTS_IE01_CMN_OFDM);
+ 		} else if (i >= RTW89_CCK_PKT) {
+-			val |= BIT(RTW89_PHYSTS_IE09_FTR_0);
+-
+ 			val &= ~(GENMASK(RTW89_PHYSTS_IE07_CMN_EXT_PATH_D,
+ 					 RTW89_PHYSTS_IE04_CMN_EXT_PATH_A));
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch b/queue-6.17/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
new file mode 100644
index 0000000000..c4e3392e7c
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-fix-bssid-comparison-for-non-transmitted-.patch
@@ -0,0 +1,47 @@
+From 3e347580811347b73662597ec7c59898fb4d7965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:39:50 +0800
+Subject: wifi: rtw89: fix BSSID comparison for non-transmitted BSSID
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit c4c16c88e78417424b4e3f33177e84baf0bc9a99 ]
+
+For non-transmitted connections, beacons are received from the
+transmitted BSSID. Fix this to avoid missing beacon statistics.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250811123950.15697-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 5dd05b296e71c..0f7a467671ca8 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -2246,6 +2246,7 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ 	struct ieee80211_bss_conf *bss_conf;
+ 	struct rtw89_vif_link *rtwvif_link;
+ 	const u8 *bssid = iter_data->bssid;
++	const u8 *target_bssid;
+ 
+ 	if (rtwdev->scanning &&
+ 	    (ieee80211_is_beacon(hdr->frame_control) ||
+@@ -2267,7 +2268,10 @@ static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,
+ 		goto out;
+ 	}
+ 
+-	if (!ether_addr_equal(bss_conf->bssid, bssid))
++	target_bssid = ieee80211_is_beacon(hdr->frame_control) &&
++		       bss_conf->nontransmitted ?
++		       bss_conf->transmitter_bssid : bss_conf->bssid;
++	if (!ether_addr_equal(target_bssid, bssid))
+ 		goto out;
+ 
+ 	if (is_mld) {
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch b/queue-6.17/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
new file mode 100644
index 0000000000..668691c172
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-obtain-rx-path-from-ppdu-status-ie00.patch
@@ -0,0 +1,51 @@
+From 0140b6aa198dc9f4d0707c22d2987dabe0faf4b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:52:06 +0800
+Subject: wifi: rtw89: obtain RX path from ppdu status IE00
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit e156d2ab36d7e47aec36845705e4ecb1e4e89976 ]
+
+The header v2 of ppdu status is optional, If it is not enabled, the RX
+path must be obtained from IE00 or IE01. Append the IE00 part.
+
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250915065213.38659-5-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 4 ++++
+ drivers/net/wireless/realtek/rtw89/txrx.h | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 0f7a467671ca8..2cebea10cb99b 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -1844,6 +1844,10 @@ static void rtw89_core_parse_phy_status_ie00(struct rtw89_dev *rtwdev,
+ 
+ 	tmp_rpl = le32_get_bits(ie->w0, RTW89_PHY_STS_IE00_W0_RPL);
+ 	phy_ppdu->rpl_avg = tmp_rpl >> 1;
++
++	if (!phy_ppdu->hdr_2_en)
++		phy_ppdu->rx_path_en =
++			le32_get_bits(ie->w3, RTW89_PHY_STS_IE00_W3_RX_PATH_EN);
+ }
+ 
+ static void rtw89_core_parse_phy_status_ie00_v2(struct rtw89_dev *rtwdev,
+diff --git a/drivers/net/wireless/realtek/rtw89/txrx.h b/drivers/net/wireless/realtek/rtw89/txrx.h
+index ec01bfc363da3..307b22ae13b2a 100644
+--- a/drivers/net/wireless/realtek/rtw89/txrx.h
++++ b/drivers/net/wireless/realtek/rtw89/txrx.h
+@@ -572,6 +572,7 @@ struct rtw89_phy_sts_ie00 {
+ } __packed;
+ 
+ #define RTW89_PHY_STS_IE00_W0_RPL GENMASK(15, 7)
++#define RTW89_PHY_STS_IE00_W3_RX_PATH_EN GENMASK(31, 28)
+ 
+ struct rtw89_phy_sts_ie00_v2 {
+ 	__le32 w0;
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch b/queue-6.17/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
new file mode 100644
index 0000000000..7c83834142
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-print-just-once-for-unknown-c2h-events.patch
@@ -0,0 +1,84 @@
+From 25d744e4a30615d0ea9e51dcce85bdc2d58a7343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Aug 2025 09:22:33 +0800
+Subject: wifi: rtw89: print just once for unknown C2H events
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 7e1c44fe4c2e1e01fa47d9490893d95309a99687 ]
+
+When driver receives new or unknown C2H events, it print out messages
+repeatedly once events are received, like
+
+  rtw89_8922ae 0000:81:00.0: PHY c2h class 2 not support
+
+To avoid the thousands of messages, use rtw89_info_once() instead. Also,
+print out class/func for unknown (undefined) class.
+
+Reported-by: Sean Anderson <sean.anderson@linux.dev>
+Closes: https://lore.kernel.org/linux-wireless/20250729204437.164320-1-sean.anderson@linux.dev/
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250804012234.8913-2-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/debug.h | 1 +
+ drivers/net/wireless/realtek/rtw89/mac.c   | 7 +++----
+ drivers/net/wireless/realtek/rtw89/phy.c   | 7 +++----
+ 3 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/debug.h b/drivers/net/wireless/realtek/rtw89/debug.h
+index fc690f7c55dc7..a364e7adb0798 100644
+--- a/drivers/net/wireless/realtek/rtw89/debug.h
++++ b/drivers/net/wireless/realtek/rtw89/debug.h
+@@ -56,6 +56,7 @@ static inline void rtw89_debugfs_deinit(struct rtw89_dev *rtwdev) {}
+ #endif
+ 
+ #define rtw89_info(rtwdev, a...) dev_info((rtwdev)->dev, ##a)
++#define rtw89_info_once(rtwdev, a...) dev_info_once((rtwdev)->dev, ##a)
+ #define rtw89_warn(rtwdev, a...) dev_warn((rtwdev)->dev, ##a)
+ #define rtw89_err(rtwdev, a...) dev_err((rtwdev)->dev, ##a)
+ 
+diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
+index 5a5da9d9c0c5b..ef17a307b7702 100644
+--- a/drivers/net/wireless/realtek/rtw89/mac.c
++++ b/drivers/net/wireless/realtek/rtw89/mac.c
+@@ -5813,12 +5813,11 @@ void rtw89_mac_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ 	case RTW89_MAC_C2H_CLASS_ROLE:
+ 		return;
+ 	default:
+-		rtw89_info(rtwdev, "MAC c2h class %d not support\n", class);
+-		return;
++		break;
+ 	}
+ 	if (!handler) {
+-		rtw89_info(rtwdev, "MAC c2h class %d func %d not support\n", class,
+-			   func);
++		rtw89_info_once(rtwdev, "MAC c2h class %d func %d not support\n",
++				class, func);
+ 		return;
+ 	}
+ 	handler(rtwdev, skb, len);
+diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
+index d607577b353c6..01a03d2de3ffb 100644
+--- a/drivers/net/wireless/realtek/rtw89/phy.c
++++ b/drivers/net/wireless/realtek/rtw89/phy.c
+@@ -3626,12 +3626,11 @@ void rtw89_phy_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ 			handler = rtw89_phy_c2h_dm_handler[func];
+ 		break;
+ 	default:
+-		rtw89_info(rtwdev, "PHY c2h class %d not support\n", class);
+-		return;
++		break;
+ 	}
+ 	if (!handler) {
+-		rtw89_info(rtwdev, "PHY c2h class %d func %d not support\n", class,
+-			   func);
++		rtw89_info_once(rtwdev, "PHY c2h class %d func %d not support\n",
++				class, func);
+ 		return;
+ 	}
+ 	handler(rtwdev, skb, len);
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch b/queue-6.17/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
new file mode 100644
index 0000000000..5a31bb6a52
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-renew-a-completion-for-each-h2c-command-w.patch
@@ -0,0 +1,157 @@
+From 072bd63f8190bfe77f971561a145978a023a9556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 14:53:43 +0800
+Subject: wifi: rtw89: renew a completion for each H2C command waiting C2H
+ event
+
+From: Zong-Zhe Yang <kevin_yang@realtek.com>
+
+[ Upstream commit bc2a5a12fa6259e190c7edb03e63b28ab480101b ]
+
+Logically before a waiting side which has already timed out turns the
+atomic status back to idle, a completing side could still pass atomic
+condition and call complete. It will make the following H2C commands,
+waiting C2H events, get a completion unexpectedly early. Hence, renew
+a completion for each H2C command waiting a C2H event.
+
+Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250915065343.39023-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 49 ++++++++++++++++++++---
+ drivers/net/wireless/realtek/rtw89/core.h | 10 ++++-
+ drivers/net/wireless/realtek/rtw89/fw.c   |  2 +
+ 3 files changed, 53 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
+index 2cebea10cb99b..9896c4ab7146b 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -4860,37 +4860,74 @@ void rtw89_core_csa_beacon_work(struct wiphy *wiphy, struct wiphy_work *work)
+ 
+ int rtw89_wait_for_cond(struct rtw89_wait_info *wait, unsigned int cond)
+ {
+-	struct completion *cmpl = &wait->completion;
++	struct rtw89_wait_response *prep;
+ 	unsigned long time_left;
+ 	unsigned int cur;
++	int err = 0;
+ 
+ 	cur = atomic_cmpxchg(&wait->cond, RTW89_WAIT_COND_IDLE, cond);
+ 	if (cur != RTW89_WAIT_COND_IDLE)
+ 		return -EBUSY;
+ 
+-	time_left = wait_for_completion_timeout(cmpl, RTW89_WAIT_FOR_COND_TIMEOUT);
++	prep = kzalloc(sizeof(*prep), GFP_KERNEL);
++	if (!prep) {
++		err = -ENOMEM;
++		goto reset;
++	}
++
++	init_completion(&prep->completion);
++
++	rcu_assign_pointer(wait->resp, prep);
++
++	time_left = wait_for_completion_timeout(&prep->completion,
++						RTW89_WAIT_FOR_COND_TIMEOUT);
+ 	if (time_left == 0) {
+-		atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
+-		return -ETIMEDOUT;
++		err = -ETIMEDOUT;
++		goto cleanup;
+ 	}
+ 
++	wait->data = prep->data;
++
++cleanup:
++	rcu_assign_pointer(wait->resp, NULL);
++	kfree_rcu(prep, rcu_head);
++
++reset:
++	atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
++
++	if (err)
++		return err;
++
+ 	if (wait->data.err)
+ 		return -EFAULT;
+ 
+ 	return 0;
+ }
+ 
++static void rtw89_complete_cond_resp(struct rtw89_wait_response *resp,
++				     const struct rtw89_completion_data *data)
++{
++	resp->data = *data;
++	complete(&resp->completion);
++}
++
+ void rtw89_complete_cond(struct rtw89_wait_info *wait, unsigned int cond,
+ 			 const struct rtw89_completion_data *data)
+ {
++	struct rtw89_wait_response *resp;
+ 	unsigned int cur;
+ 
++	guard(rcu)();
++
++	resp = rcu_dereference(wait->resp);
++	if (!resp)
++		return;
++
+ 	cur = atomic_cmpxchg(&wait->cond, cond, RTW89_WAIT_COND_IDLE);
+ 	if (cur != cond)
+ 		return;
+ 
+-	wait->data = *data;
+-	complete(&wait->completion);
++	rtw89_complete_cond_resp(resp, data);
+ }
+ 
+ void rtw89_core_ntfy_btc_event(struct rtw89_dev *rtwdev, enum rtw89_btc_hmsg event)
+diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
+index 2de9505c48ffc..460453e63f844 100644
+--- a/drivers/net/wireless/realtek/rtw89/core.h
++++ b/drivers/net/wireless/realtek/rtw89/core.h
+@@ -4545,17 +4545,23 @@ struct rtw89_completion_data {
+ 	u8 buf[RTW89_COMPLETION_BUF_SIZE];
+ };
+ 
++struct rtw89_wait_response {
++	struct rcu_head rcu_head;
++	struct completion completion;
++	struct rtw89_completion_data data;
++};
++
+ struct rtw89_wait_info {
+ 	atomic_t cond;
+-	struct completion completion;
+ 	struct rtw89_completion_data data;
++	struct rtw89_wait_response __rcu *resp;
+ };
+ 
+ #define RTW89_WAIT_FOR_COND_TIMEOUT msecs_to_jiffies(100)
+ 
+ static inline void rtw89_init_wait(struct rtw89_wait_info *wait)
+ {
+-	init_completion(&wait->completion);
++	rcu_assign_pointer(wait->resp, NULL);
+ 	atomic_set(&wait->cond, RTW89_WAIT_COND_IDLE);
+ }
+ 
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index e6f8fab799fc1..7a5d616f7a9b8 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -8679,6 +8679,8 @@ static int rtw89_h2c_tx_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *skb,
+ {
+ 	int ret;
+ 
++	lockdep_assert_wiphy(rtwdev->hw->wiphy);
++
+ 	ret = rtw89_h2c_tx(rtwdev, skb, false);
+ 	if (ret) {
+ 		rtw89_err(rtwdev, "failed to send h2c\n");
+-- 
+2.51.0
+
diff --git a/queue-6.17/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch b/queue-6.17/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
new file mode 100644
index 0000000000..7cb94a7419
--- /dev/null
+++ b/queue-6.17/wifi-rtw89-wow-remove-notify-during-wowlan-net-detec.patch
@@ -0,0 +1,45 @@
+From 9f0ee0093a89d0e7726404163a8989ecda1fe626 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 20:37:39 +0800
+Subject: wifi: rtw89: wow: remove notify during WoWLAN net-detect
+
+From: Kuan-Chung Chen <damon.chen@realtek.com>
+
+[ Upstream commit 38846585f9df9af1f7261d85134a5510fc079458 ]
+
+In WoWLAN net-detect mode, the firmware periodically performs scans
+and sends scan reports via C2H, which driver does not need. These
+unnecessary C2H events cause firmware watchdog timeout, leading
+to unexpected wakeups and SER 0x2599 on 8922AE.
+
+Signed-off-by: Kuan-Chung Chen <damon.chen@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250811123744.15361-4-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw89/fw.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
+index 16e59a4a486e6..e6f8fab799fc1 100644
+--- a/drivers/net/wireless/realtek/rtw89/fw.c
++++ b/drivers/net/wireless/realtek/rtw89/fw.c
+@@ -7123,7 +7123,6 @@ static void rtw89_pno_scan_add_chan_ax(struct rtw89_dev *rtwdev,
+ 	struct rtw89_pktofld_info *info;
+ 	u8 probe_count = 0;
+ 
+-	ch_info->notify_action = RTW89_SCANOFLD_DEBUG_MASK;
+ 	ch_info->dfs_ch = chan_type == RTW89_CHAN_DFS;
+ 	ch_info->bw = RTW89_SCAN_WIDTH;
+ 	ch_info->tx_pkt = true;
+@@ -7264,7 +7263,6 @@ static void rtw89_pno_scan_add_chan_be(struct rtw89_dev *rtwdev, int chan_type,
+ 	struct rtw89_pktofld_info *info;
+ 	u8 probe_count = 0, i;
+ 
+-	ch_info->notify_action = RTW89_SCANOFLD_DEBUG_MASK;
+ 	ch_info->dfs_ch = chan_type == RTW89_CHAN_DFS;
+ 	ch_info->bw = RTW89_SCAN_WIDTH;
+ 	ch_info->tx_null = false;
+-- 
+2.51.0
+
diff --git a/queue-6.17/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-6.17/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..fad4da842f
--- /dev/null
+++ b/queue-6.17/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From 734df85fa4405da6515ff19e3d06f459027ae2f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 57379698015ed..2ecb2ec06aebc 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -1089,16 +1089,6 @@ static void kvm_wait(u8 *ptr, u8 val)
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -1118,6 +1108,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-6.17/x86-virt-tdx-use-precalculated-tdvpr-page-physical-a.patch b/queue-6.17/x86-virt-tdx-use-precalculated-tdvpr-page-physical-a.patch
new file mode 100644
index 0000000000..6af3a7da09
--- /dev/null
+++ b/queue-6.17/x86-virt-tdx-use-precalculated-tdvpr-page-physical-a.patch
@@ -0,0 +1,177 @@
+From bf8247ecf3aa6b92de177cfa01e88ecd813ec473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 19:55:53 +1200
+Subject: x86/virt/tdx: Use precalculated TDVPR page physical address
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit e414b1005891d74bb0c3d27684c58dfbfbd1754b ]
+
+All of the x86 KVM guest types (VMX, SEV and TDX) do some special context
+tracking when entering guests. This means that the actual guest entry
+sequence must be noinstr.
+
+Part of entering a TDX guest is passing a physical address to the TDX
+module. Right now, that physical address is stored as a 'struct page'
+and converted to a physical address at guest entry. That page=>phys
+conversion can be complicated, can vary greatly based on kernel
+config, and it is definitely _not_ a noinstr path today.
+
+There have been a number of tinkering approaches to try and fix this
+up, but they all fall down due to some part of the page=>phys
+conversion infrastructure not being noinstr friendly.
+
+Precalculate the page=>phys conversion and store it in the existing
+'tdx_vp' structure.  Use the new field at every site that needs a
+tdvpr physical address. Remove the now redundant tdx_tdvpr_pa().
+Remove the __flatten remnant from the tinkering.
+
+Note that only one user of the new field is actually noinstr. All
+others can use page_to_phys(). But, they might as well save the effort
+since there is a pre-calculated value sitting there for them.
+
+[ dhansen: rewrite all the text ]
+
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Kiryl Shutsemau <kas@kernel.org>
+Tested-by: Farrah Chen <farrah.chen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/tdx.h  |  2 ++
+ arch/x86/kvm/vmx/tdx.c      |  9 +++++++++
+ arch/x86/virt/vmx/tdx/tdx.c | 21 ++++++++-------------
+ 3 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
+index 7ddef3a698668..5e043961fb1d7 100644
+--- a/arch/x86/include/asm/tdx.h
++++ b/arch/x86/include/asm/tdx.h
+@@ -146,6 +146,8 @@ struct tdx_td {
+ struct tdx_vp {
+ 	/* TDVP root page */
+ 	struct page *tdvpr_page;
++	/* precalculated page_to_phys(tdvpr_page) for use in noinstr code */
++	phys_addr_t tdvpr_pa;
+ 
+ 	/* TD vCPU control structure: */
+ 	struct page **tdcx_pages;
+diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
+index d91d9d6bb26c1..987c0eb10545c 100644
+--- a/arch/x86/kvm/vmx/tdx.c
++++ b/arch/x86/kvm/vmx/tdx.c
+@@ -861,6 +861,7 @@ void tdx_vcpu_free(struct kvm_vcpu *vcpu)
+ 	if (tdx->vp.tdvpr_page) {
+ 		tdx_reclaim_control_page(tdx->vp.tdvpr_page);
+ 		tdx->vp.tdvpr_page = 0;
++		tdx->vp.tdvpr_pa = 0;
+ 	}
+ 
+ 	tdx->state = VCPU_TD_STATE_UNINITIALIZED;
+@@ -2940,6 +2941,13 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx)
+ 		return -ENOMEM;
+ 	tdx->vp.tdvpr_page = page;
+ 
++	/*
++	 * page_to_phys() does not work in 'noinstr' code, like guest
++	 * entry via tdh_vp_enter(). Precalculate and store it instead
++	 * of doing it at runtime later.
++	 */
++	tdx->vp.tdvpr_pa = page_to_phys(tdx->vp.tdvpr_page);
++
+ 	tdx->vp.tdcx_pages = kcalloc(kvm_tdx->td.tdcx_nr_pages, sizeof(*tdx->vp.tdcx_pages),
+ 			       	     GFP_KERNEL);
+ 	if (!tdx->vp.tdcx_pages) {
+@@ -3002,6 +3010,7 @@ static int tdx_td_vcpu_init(struct kvm_vcpu *vcpu, u64 vcpu_rcx)
+ 	if (tdx->vp.tdvpr_page)
+ 		__free_page(tdx->vp.tdvpr_page);
+ 	tdx->vp.tdvpr_page = 0;
++	tdx->vp.tdvpr_pa = 0;
+ 
+ 	return ret;
+ }
+diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
+index c7a9a087ccaf5..9767b5821f4d8 100644
+--- a/arch/x86/virt/vmx/tdx/tdx.c
++++ b/arch/x86/virt/vmx/tdx/tdx.c
+@@ -1502,11 +1502,6 @@ static inline u64 tdx_tdr_pa(struct tdx_td *td)
+ 	return page_to_phys(td->tdr_page);
+ }
+ 
+-static inline u64 tdx_tdvpr_pa(struct tdx_vp *td)
+-{
+-	return page_to_phys(td->tdvpr_page);
+-}
+-
+ /*
+  * The TDX module exposes a CLFLUSH_BEFORE_ALLOC bit to specify whether
+  * a CLFLUSH of pages is required before handing them to the TDX module.
+@@ -1518,9 +1513,9 @@ static void tdx_clflush_page(struct page *page)
+ 	clflush_cache_range(page_to_virt(page), PAGE_SIZE);
+ }
+ 
+-noinstr __flatten u64 tdh_vp_enter(struct tdx_vp *td, struct tdx_module_args *args)
++noinstr u64 tdh_vp_enter(struct tdx_vp *td, struct tdx_module_args *args)
+ {
+-	args->rcx = tdx_tdvpr_pa(td);
++	args->rcx = td->tdvpr_pa;
+ 
+ 	return __seamcall_saved_ret(TDH_VP_ENTER, args);
+ }
+@@ -1581,7 +1576,7 @@ u64 tdh_vp_addcx(struct tdx_vp *vp, struct page *tdcx_page)
+ {
+ 	struct tdx_module_args args = {
+ 		.rcx = page_to_phys(tdcx_page),
+-		.rdx = tdx_tdvpr_pa(vp),
++		.rdx = vp->tdvpr_pa,
+ 	};
+ 
+ 	tdx_clflush_page(tdcx_page);
+@@ -1650,7 +1645,7 @@ EXPORT_SYMBOL_GPL(tdh_mng_create);
+ u64 tdh_vp_create(struct tdx_td *td, struct tdx_vp *vp)
+ {
+ 	struct tdx_module_args args = {
+-		.rcx = tdx_tdvpr_pa(vp),
++		.rcx = vp->tdvpr_pa,
+ 		.rdx = tdx_tdr_pa(td),
+ 	};
+ 
+@@ -1706,7 +1701,7 @@ EXPORT_SYMBOL_GPL(tdh_mr_finalize);
+ u64 tdh_vp_flush(struct tdx_vp *vp)
+ {
+ 	struct tdx_module_args args = {
+-		.rcx = tdx_tdvpr_pa(vp),
++		.rcx = vp->tdvpr_pa,
+ 	};
+ 
+ 	return seamcall(TDH_VP_FLUSH, &args);
+@@ -1752,7 +1747,7 @@ EXPORT_SYMBOL_GPL(tdh_mng_init);
+ u64 tdh_vp_rd(struct tdx_vp *vp, u64 field, u64 *data)
+ {
+ 	struct tdx_module_args args = {
+-		.rcx = tdx_tdvpr_pa(vp),
++		.rcx = vp->tdvpr_pa,
+ 		.rdx = field,
+ 	};
+ 	u64 ret;
+@@ -1769,7 +1764,7 @@ EXPORT_SYMBOL_GPL(tdh_vp_rd);
+ u64 tdh_vp_wr(struct tdx_vp *vp, u64 field, u64 data, u64 mask)
+ {
+ 	struct tdx_module_args args = {
+-		.rcx = tdx_tdvpr_pa(vp),
++		.rcx = vp->tdvpr_pa,
+ 		.rdx = field,
+ 		.r8 = data,
+ 		.r9 = mask,
+@@ -1782,7 +1777,7 @@ EXPORT_SYMBOL_GPL(tdh_vp_wr);
+ u64 tdh_vp_init(struct tdx_vp *vp, u64 initial_rcx, u32 x2apicid)
+ {
+ 	struct tdx_module_args args = {
+-		.rcx = tdx_tdvpr_pa(vp),
++		.rcx = vp->tdvpr_pa,
+ 		.rdx = initial_rcx,
+ 		.r8 = x2apicid,
+ 	};
+-- 
+2.51.0
+
diff --git a/queue-6.17/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-6.17/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..9bdefc8e18
--- /dev/null
+++ b/queue-6.17/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 71a256e782cf4ef47c44fb6d1e3be2802b4ce224 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index c9103a6fa06e8..6e6c0a7408371 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
diff --git a/queue-6.6/6pack-drop-redundant-locking-and-refcounting.patch b/queue-6.6/6pack-drop-redundant-locking-and-refcounting.patch
new file mode 100644
index 0000000000..2d2261ab8e
--- /dev/null
+++ b/queue-6.6/6pack-drop-redundant-locking-and-refcounting.patch
@@ -0,0 +1,173 @@
+From e80d3d93f8fb048280432e8a482c86d4aeaec8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 13:10:59 +0800
+Subject: 6pack: drop redundant locking and refcounting
+
+From: Qingfang Deng <dqfext@gmail.com>
+
+[ Upstream commit 38b04ed7072e54086102eae2d05d03ffcdb4b695 ]
+
+The TTY layer already serializes line discipline operations with
+tty->ldisc_sem, so the extra disc_data_lock and refcnt in 6pack
+are unnecessary.
+
+Removing them simplifies the code and also resolves a lockdep warning
+reported by syzbot. The warning did not indicate a real deadlock, since
+the write-side lock was only taken in process context with hardirqs
+disabled.
+
+Reported-by: syzbot+5fd749c74105b0e1b302@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/68c858b0.050a0220.3c6139.0d1c.GAE@google.com/
+Signed-off-by: Qingfang Deng <dqfext@gmail.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://patch.msgid.link/20250925051059.26876-1-dqfext@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hamradio/6pack.c | 57 ++++--------------------------------
+ 1 file changed, 5 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
+index 6ed38a3cdd734..6cecdfa8631d7 100644
+--- a/drivers/net/hamradio/6pack.c
++++ b/drivers/net/hamradio/6pack.c
+@@ -121,8 +121,6 @@ struct sixpack {
+ 
+ 	struct timer_list	tx_t;
+ 	struct timer_list	resync_t;
+-	refcount_t		refcnt;
+-	struct completion	dead;
+ 	spinlock_t		lock;
+ };
+ 
+@@ -359,42 +357,13 @@ static void sp_bump(struct sixpack *sp, char cmd)
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+-/*
+- * We have a potential race on dereferencing tty->disc_data, because the tty
+- * layer provides no locking at all - thus one cpu could be running
+- * sixpack_receive_buf while another calls sixpack_close, which zeroes
+- * tty->disc_data and frees the memory that sixpack_receive_buf is using.  The
+- * best way to fix this is to use a rwlock in the tty struct, but for now we
+- * use a single global rwlock for all ttys in ppp line discipline.
+- */
+-static DEFINE_RWLOCK(disc_data_lock);
+-                                                                                
+-static struct sixpack *sp_get(struct tty_struct *tty)
+-{
+-	struct sixpack *sp;
+-
+-	read_lock(&disc_data_lock);
+-	sp = tty->disc_data;
+-	if (sp)
+-		refcount_inc(&sp->refcnt);
+-	read_unlock(&disc_data_lock);
+-
+-	return sp;
+-}
+-
+-static void sp_put(struct sixpack *sp)
+-{
+-	if (refcount_dec_and_test(&sp->refcnt))
+-		complete(&sp->dead);
+-}
+-
+ /*
+  * Called by the TTY driver when there's room for more data.  If we have
+  * more packets to send, we send them here.
+  */
+ static void sixpack_write_wakeup(struct tty_struct *tty)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	int actual;
+ 
+ 	if (!sp)
+@@ -406,7 +375,7 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+ 		sp->tx_enable = 0;
+ 		netif_wake_queue(sp->dev);
+-		goto out;
++		return;
+ 	}
+ 
+ 	if (sp->tx_enable) {
+@@ -414,9 +383,6 @@ static void sixpack_write_wakeup(struct tty_struct *tty)
+ 		sp->xleft -= actual;
+ 		sp->xhead += actual;
+ 	}
+-
+-out:
+-	sp_put(sp);
+ }
+ 
+ /* ----------------------------------------------------------------------- */
+@@ -436,7 +402,7 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	if (!count)
+ 		return;
+ 
+-	sp = sp_get(tty);
++	sp = tty->disc_data;
+ 	if (!sp)
+ 		return;
+ 
+@@ -452,7 +418,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
+ 	}
+ 	sixpack_decode(sp, cp, count1);
+ 
+-	sp_put(sp);
+ 	tty_unthrottle(tty);
+ }
+ 
+@@ -567,8 +532,6 @@ static int sixpack_open(struct tty_struct *tty)
+ 
+ 	spin_lock_init(&sp->lock);
+ 	spin_lock_init(&sp->rxlock);
+-	refcount_set(&sp->refcnt, 1);
+-	init_completion(&sp->dead);
+ 
+ 	/* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
+ 
+@@ -650,19 +613,11 @@ static void sixpack_close(struct tty_struct *tty)
+ {
+ 	struct sixpack *sp;
+ 
+-	write_lock_irq(&disc_data_lock);
+ 	sp = tty->disc_data;
+-	tty->disc_data = NULL;
+-	write_unlock_irq(&disc_data_lock);
+ 	if (!sp)
+ 		return;
+ 
+-	/*
+-	 * We have now ensured that nobody can start using ap from now on, but
+-	 * we have to wait for all existing users to finish.
+-	 */
+-	if (!refcount_dec_and_test(&sp->refcnt))
+-		wait_for_completion(&sp->dead);
++	tty->disc_data = NULL;
+ 
+ 	/* We must stop the queue to avoid potentially scribbling
+ 	 * on the free buffers. The sp->dead completion is not sufficient
+@@ -686,7 +641,7 @@ static void sixpack_close(struct tty_struct *tty)
+ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		unsigned long arg)
+ {
+-	struct sixpack *sp = sp_get(tty);
++	struct sixpack *sp = tty->disc_data;
+ 	struct net_device *dev;
+ 	unsigned int tmp, err;
+ 
+@@ -738,8 +693,6 @@ static int sixpack_ioctl(struct tty_struct *tty, unsigned int cmd,
+ 		err = tty_mode_ioctl(tty, cmd, arg);
+ 	}
+ 
+-	sp_put(sp);
+-
+ 	return err;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch b/queue-6.6/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
new file mode 100644
index 0000000000..bded508547
--- /dev/null
+++ b/queue-6.6/accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
@@ -0,0 +1,37 @@
+From 25c8664e95c2aa843cc57a6e5427623a53e9f647 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2024 19:58:30 +0300
+Subject: accel/habanalabs/gaudi2: fix BMON disable configuration
+
+From: Vered Yavniely <vered.yavniely@intel.com>
+
+[ Upstream commit b4fd8e56c9a3b614370fde2d45aec1032eb67ddd ]
+
+Change the BMON_CR register value back to its original state before
+enabling, so that BMON does not continue to collect information
+after being disabled.
+
+Signed-off-by: Vered Yavniely <vered.yavniely@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+index 25b5368f37dde..9ff00b65ae34b 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2_coresight.c
+@@ -2409,7 +2409,7 @@ static int gaudi2_config_bmon(struct hl_device *hdev, struct hl_debug_params *pa
+ 		WREG32(base_reg + mmBMON_ADDRH_E3_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_REDUCTION_OFFSET, 0);
+ 		WREG32(base_reg + mmBMON_STM_TRC_OFFSET, 0x7 | (0xA << 8));
+-		WREG32(base_reg + mmBMON_CR_OFFSET, 0x77 | 0xf << 24);
++		WREG32(base_reg + mmBMON_CR_OFFSET, 0x41);
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.6/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch b/queue-6.6/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
new file mode 100644
index 0000000000..46dd85e9e2
--- /dev/null
+++ b/queue-6.6/accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
@@ -0,0 +1,53 @@
+From 1a4f49534776e13ab8e304094823537a7aaa8b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 15:52:27 +0300
+Subject: accel/habanalabs/gaudi2: read preboot status after recovering from
+ dirty state
+
+From: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+
+[ Upstream commit a0d866bab184161ba155b352650083bf6695e50e ]
+
+Dirty state can occur when the host VM undergoes a reset while the
+device does not. In such a case, the driver must reset the device before
+it can be used again. As part of this reset, the device capabilities
+are zeroed. Therefore, the driver must read the Preboot status again to
+learn the Preboot state, capabilities, and security configuration.
+
+Signed-off-by: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi2/gaudi2.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 31c74ca70a2e5..01df5435d92c4 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -2985,7 +2985,6 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 	rc = hl_fw_read_preboot_status(hdev);
+ 	if (rc) {
+ 		if (hdev->reset_on_preboot_fail)
+-			/* we are already on failure flow, so don't check if hw_fini fails. */
+ 			hdev->asic_funcs->hw_fini(hdev, true, false);
+ 		goto pci_fini;
+ 	}
+@@ -2997,6 +2996,13 @@ static int gaudi2_early_init(struct hl_device *hdev)
+ 			dev_err(hdev->dev, "failed to reset HW in dirty state (%d)\n", rc);
+ 			goto pci_fini;
+ 		}
++
++		rc = hl_fw_read_preboot_status(hdev);
++		if (rc) {
++			if (hdev->reset_on_preboot_fail)
++				hdev->asic_funcs->hw_fini(hdev, true, false);
++			goto pci_fini;
++		}
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.6/accel-habanalabs-return-enomem-if-less-than-requeste.patch b/queue-6.6/accel-habanalabs-return-enomem-if-less-than-requeste.patch
new file mode 100644
index 0000000000..bd775c124b
--- /dev/null
+++ b/queue-6.6/accel-habanalabs-return-enomem-if-less-than-requeste.patch
@@ -0,0 +1,42 @@
+From 30e0486fcef8272b176097a7126f638184e8b142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2024 16:32:32 +0300
+Subject: accel/habanalabs: return ENOMEM if less than requested pages were
+ pinned
+
+From: Tomer Tayar <tomer.tayar@intel.com>
+
+[ Upstream commit 9f5067531c9b79318c4e48a933cb2694f53f3de2 ]
+
+EFAULT is currently returned if less than requested user pages are
+pinned. This value means a "bad address" which might be confusing to
+the user, as the address of the given user memory is not necessarily
+"bad".
+
+Modify the return value to ENOMEM, as "out of memory" is more suitable
+in this case.
+
+Signed-off-by: Tomer Tayar <tomer.tayar@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/common/memory.c b/drivers/accel/habanalabs/common/memory.c
+index 5b7d9a351133f..33a4246dd7358 100644
+--- a/drivers/accel/habanalabs/common/memory.c
++++ b/drivers/accel/habanalabs/common/memory.c
+@@ -2323,7 +2323,7 @@ static int get_user_memory(struct hl_device *hdev, u64 addr, u64 size,
+ 		if (rc < 0)
+ 			goto destroy_pages;
+ 		npages = rc;
+-		rc = -EFAULT;
++		rc = -ENOMEM;
+ 		goto put_pages;
+ 	}
+ 	userptr->npages = npages;
+-- 
+2.51.0
+
diff --git a/queue-6.6/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch b/queue-6.6/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
new file mode 100644
index 0000000000..b89ee63b57
--- /dev/null
+++ b/queue-6.6/accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
@@ -0,0 +1,84 @@
+From 0c0c34bec15a9e15710040e4cfe23f365e42a6f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Sep 2024 15:01:26 +0300
+Subject: accel/habanalabs: support mapping cb with vmalloc-backed coherent
+ memory
+
+From: Moti Haimovski <moti.haimovski@intel.com>
+
+[ Upstream commit 513024d5a0e34fd34247043f1876b6138ca52847 ]
+
+When IOMMU is enabled, dma_alloc_coherent() with GFP_USER may return
+addresses from the vmalloc range. If such an address is mapped without
+VM_MIXEDMAP, vm_insert_page() will trigger a BUG_ON due to the
+VM_PFNMAP restriction.
+
+Fix this by checking for vmalloc addresses and setting VM_MIXEDMAP
+in the VMA before mapping. This ensures safe mapping and avoids kernel
+crashes. The memory is still driver-allocated and cannot be accessed
+directly by userspace.
+
+Signed-off-by: Moti Haimovski  <moti.haimovski@intel.com>
+Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Koby Elbaz <koby.elbaz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/gaudi/gaudi.c   | 19 +++++++++++++++++++
+ drivers/accel/habanalabs/gaudi2/gaudi2.c |  7 +++++++
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/accel/habanalabs/gaudi/gaudi.c b/drivers/accel/habanalabs/gaudi/gaudi.c
+index 056e2ef44afb5..ceed6cfe2f919 100644
+--- a/drivers/accel/habanalabs/gaudi/gaudi.c
++++ b/drivers/accel/habanalabs/gaudi/gaudi.c
+@@ -4173,10 +4173,29 @@ static int gaudi_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 	vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP |
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
++#ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
++
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr,
+ 				(dma_addr - HOST_PHYS_BASE), size);
+ 	if (rc)
+ 		dev_err(hdev->dev, "dma_mmap_coherent error %d", rc);
++#else
++
++	rc = remap_pfn_range(vma, vma->vm_start,
++				virt_to_phys(cpu_addr) >> PAGE_SHIFT,
++				size, vma->vm_page_prot);
++	if (rc)
++		dev_err(hdev->dev, "remap_pfn_range error %d", rc);
++
++ #endif
++
+ 
+ 	return rc;
+ }
+diff --git a/drivers/accel/habanalabs/gaudi2/gaudi2.c b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+index 01df5435d92c4..44b5678ea615c 100644
+--- a/drivers/accel/habanalabs/gaudi2/gaudi2.c
++++ b/drivers/accel/habanalabs/gaudi2/gaudi2.c
+@@ -6345,6 +6345,13 @@ static int gaudi2_mmap(struct hl_device *hdev, struct vm_area_struct *vma,
+ 			VM_DONTCOPY | VM_NORESERVE);
+ 
+ #ifdef _HAS_DMA_MMAP_COHERENT
++	/*
++	 * If dma_alloc_coherent() returns a vmalloc address, set VM_MIXEDMAP
++	 * so vm_insert_page() can handle it safely. Without this, the kernel
++	 * may BUG_ON due to VM_PFNMAP.
++	 */
++	if (is_vmalloc_addr(cpu_addr))
++		vm_flags_set(vma, VM_MIXEDMAP);
+ 
+ 	rc = dma_mmap_coherent(hdev->dev, vma, cpu_addr, dma_addr, size);
+ 	if (rc)
+-- 
+2.51.0
+
diff --git a/queue-6.6/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch b/queue-6.6/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
new file mode 100644
index 0000000000..6ce1019baa
--- /dev/null
+++ b/queue-6.6/acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
@@ -0,0 +1,36 @@
+From bc236fc6149f84378baf27043bc9edfb78b98a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 22:01:04 +0200
+Subject: ACPICA: Update dsmethod.c to get rid of unused variable warning
+
+From: Saket Dumbre <saket.dumbre@intel.com>
+
+[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
+
+All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
+the unused variable i after the removal of its usage by PR #1031
+addressing Issue #1027
+
+Link: https://github.com/acpica/acpica/commit/6d235320
+Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsmethod.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
+index dc53a5d700671..6168597a96e6f 100644
+--- a/drivers/acpi/acpica/dsmethod.c
++++ b/drivers/acpi/acpica/dsmethod.c
+@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
+ 	struct acpi_walk_state *next_walk_state = NULL;
+ 	union acpi_operand_object *obj_desc;
+ 	struct acpi_evaluate_info *info;
+-	u32 i;
+ 
+ 	ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/allow-finish_no_open-file-err_ptr-e.patch b/queue-6.6/allow-finish_no_open-file-err_ptr-e.patch
new file mode 100644
index 0000000000..33a22bf1f0
--- /dev/null
+++ b/queue-6.6/allow-finish_no_open-file-err_ptr-e.patch
@@ -0,0 +1,50 @@
+From 11767e24fbe3f958ca5d163be64d16782525b851 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 11:20:27 -0400
+Subject: allow finish_no_open(file, ERR_PTR(-E...))
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
+
+... allowing any ->lookup() return value to be passed to it.
+
+Reviewed-by: NeilBrown <neil@brown.name>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/open.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/open.c b/fs/open.c
+index f9ac703ec1b2d..b5ea1dcbfb224 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -1029,18 +1029,20 @@ EXPORT_SYMBOL(finish_open);
+  * finish_no_open - finish ->atomic_open() without opening the file
+  *
+  * @file: file pointer
+- * @dentry: dentry or NULL (as returned from ->lookup())
++ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
+  *
+- * This can be used to set the result of a successful lookup in ->atomic_open().
++ * This can be used to set the result of a lookup in ->atomic_open().
+  *
+  * NB: unlike finish_open() this function does consume the dentry reference and
+  * the caller need not dput() it.
+  *
+- * Returns "0" which must be the return value of ->atomic_open() after having
+- * called this function.
++ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
++ * having called this function.
+  */
+ int finish_no_open(struct file *file, struct dentry *dentry)
+ {
++	if (IS_ERR(dentry))
++		return PTR_ERR(dentry);
+ 	file->f_path.dentry = dentry;
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch b/queue-6.6/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
new file mode 100644
index 0000000000..9b7d2e7f36
--- /dev/null
+++ b/queue-6.6/alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
@@ -0,0 +1,39 @@
+From ebe89af21c317445b9f03e1909c4912328d09e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 14:13:27 +0200
+Subject: ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1f9fc89cbbe8a7a8648ea2f827f7d8590e62e52c ]
+
+snd_seq_fifo_poll_wait() evaluates f->cells without locking after
+poll_wait(), and KCSAN doesn't like it as it appears to be a
+data-race.  Although this doesn't matter much in practice as the value
+is volatile, it's still better to address it for the mind piece.
+
+Wrap it with f->lock spinlock for avoiding the potential data race.
+
+Reported-by: syzbot+c3dbc239259940ededba@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=c3dbc239259940ededba
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_fifo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index f8e02e98709ab..faf288fecf26d 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -218,6 +218,7 @@ int snd_seq_fifo_poll_wait(struct snd_seq_fifo *f, struct file *file,
+ 			   poll_table *wait)
+ {
+ 	poll_wait(file, &f->input_sleep, wait);
++	guard(spinlock_irq)(&f->lock);
+ 	return (f->cells > 0);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/alsa-serial-generic-remove-shared-static-buffer.patch b/queue-6.6/alsa-serial-generic-remove-shared-static-buffer.patch
new file mode 100644
index 0000000000..771fe05dac
--- /dev/null
+++ b/queue-6.6/alsa-serial-generic-remove-shared-static-buffer.patch
@@ -0,0 +1,71 @@
+From d8dfe77e5e7aa9f34acd5bbef697aa40382c3f41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 10:42:19 +0100
+Subject: ALSA: serial-generic: remove shared static buffer
+
+From: John Keeping <jkeeping@inmusicbrands.com>
+
+[ Upstream commit 84973249011fda3ff292f83439a062fec81ef982 ]
+
+If multiple instances of this driver are instantiated and try to send
+concurrently then the single static buffer snd_serial_generic_tx_work()
+will cause corruption in the data output.
+
+Move the buffer into the per-instance driver data to avoid this.
+
+Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/drivers/serial-generic.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/sound/drivers/serial-generic.c b/sound/drivers/serial-generic.c
+index c8db6c75d133d..8b8e9e871ed37 100644
+--- a/sound/drivers/serial-generic.c
++++ b/sound/drivers/serial-generic.c
+@@ -37,6 +37,8 @@ MODULE_LICENSE("GPL");
+ #define SERIAL_TX_STATE_ACTIVE	1
+ #define SERIAL_TX_STATE_WAKEUP	2
+ 
++#define INTERNAL_BUF_SIZE 256
++
+ struct snd_serial_generic {
+ 	struct serdev_device *serdev;
+ 
+@@ -51,6 +53,7 @@ struct snd_serial_generic {
+ 	struct work_struct tx_work;
+ 	unsigned long tx_state;
+ 
++	char tx_buf[INTERNAL_BUF_SIZE];
+ };
+ 
+ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+@@ -61,11 +64,8 @@ static void snd_serial_generic_tx_wakeup(struct snd_serial_generic *drvdata)
+ 	schedule_work(&drvdata->tx_work);
+ }
+ 
+-#define INTERNAL_BUF_SIZE 256
+-
+ static void snd_serial_generic_tx_work(struct work_struct *work)
+ {
+-	static char buf[INTERNAL_BUF_SIZE];
+ 	int num_bytes;
+ 	struct snd_serial_generic *drvdata = container_of(work, struct snd_serial_generic,
+ 						   tx_work);
+@@ -78,8 +78,10 @@ static void snd_serial_generic_tx_work(struct work_struct *work)
+ 		if (!test_bit(SERIAL_MODE_OUTPUT_OPEN, &drvdata->filemode))
+ 			break;
+ 
+-		num_bytes = snd_rawmidi_transmit_peek(substream, buf, INTERNAL_BUF_SIZE);
+-		num_bytes = serdev_device_write_buf(drvdata->serdev, buf, num_bytes);
++		num_bytes = snd_rawmidi_transmit_peek(substream, drvdata->tx_buf,
++						      INTERNAL_BUF_SIZE);
++		num_bytes = serdev_device_write_buf(drvdata->serdev, drvdata->tx_buf,
++						    num_bytes);
+ 
+ 		if (!num_bytes)
+ 			break;
+-- 
+2.51.0
+
diff --git a/queue-6.6/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch b/queue-6.6/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
new file mode 100644
index 0000000000..2afd40ddbb
--- /dev/null
+++ b/queue-6.6/alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
@@ -0,0 +1,80 @@
+From 87720d3740993bea7deb1bce82d94c83556a376e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Sep 2025 17:27:30 +0200
+Subject: ALSA: usb-audio: add mono main switch to Presonus S1824c
+
+From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+
+[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
+
+The 1824c does not have the A/B switch that the 1810c has,
+but instead it has a mono main switch that sums the two
+main output channels to mono.
+
+Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
+index 65bdda0841048..2413a6d96971c 100644
+--- a/sound/usb/mixer_s1810c.c
++++ b/sound/usb/mixer_s1810c.c
+@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
+ 
+ #define SC1810C_CTL_LINE_SW	0
+ #define SC1810C_CTL_MUTE_SW	1
++#define SC1824C_CTL_MONO_SW	2
+ #define SC1810C_CTL_AB_SW	3
+ #define SC1810C_CTL_48V_SW	4
+ 
+@@ -123,6 +124,7 @@ struct s1810c_state_packet {
+ #define SC1810C_STATE_48V_SW	58
+ #define SC1810C_STATE_LINE_SW	59
+ #define SC1810C_STATE_MUTE_SW	60
++#define SC1824C_STATE_MONO_SW	61
+ #define SC1810C_STATE_AB_SW	62
+ 
+ struct s1810_mixer_state {
+@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
+ 	.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
+ };
+ 
++static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
++	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
++	.name = "Mono Main Out Switch",
++	.info = snd_ctl_boolean_mono_info,
++	.get = snd_s1810c_switch_get,
++	.put = snd_s1810c_switch_set,
++	.private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
++};
++
+ static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
+ 	.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ 	.name = "48V Phantom Power On Mic Inputs Switch",
+@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+-	if (ret < 0)
+-		return ret;
++	// The 1824c has a Mono Main switch instead of a
++	// A/B select switch.
++	if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
++		if (ret < 0)
++			return ret;
++	} else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
++		ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
++		if (ret < 0)
++			return ret;
++	}
++
+ 	return ret;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch b/queue-6.6/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
new file mode 100644
index 0000000000..335e797e73
--- /dev/null
+++ b/queue-6.6/alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
@@ -0,0 +1,52 @@
+From 3a528a0d4455063a54d30f4b3ec416cbbb59c5c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:17:50 +0200
+Subject: ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
+
+Just add fixed struct size validations for UAC2 and UAC3 effect
+units.  The descriptor has a variable-length array, so it should be
+validated with a proper function later once when the unit is really
+parsed and used by the driver (currently only referred partially for
+the input terminal parsing).
+
+Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/validate.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/validate.c b/sound/usb/validate.c
+index a0d55b77c9941..4bb4893f6e74f 100644
+--- a/sound/usb/validate.c
++++ b/sound/usb/validate.c
+@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
+-	/* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
++	/* just a stop-gap, it should be a proper function for the array
++	 * once if the unit is really parsed/used
++	 */
++	FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor),
+ 	FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
+ 	FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
+ 	FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
+@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
+ 	FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
+-	/*  UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
++	FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
++	      struct uac2_effect_unit_descriptor), /* sharing the same struct */
+ 	FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
+ 	FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
+ 	FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
+-- 
+2.51.0
+
diff --git a/queue-6.6/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch b/queue-6.6/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
new file mode 100644
index 0000000000..dd3c6e0142
--- /dev/null
+++ b/queue-6.6/alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
@@ -0,0 +1,42 @@
+From b92a4e10b95ee17a5c036894e8948de1615a6ea1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 13:09:48 +0800
+Subject: ALSA: usb-audio: apply quirk for MOONDROP Quark2
+
+From: Cryolitia PukNgae <cryolitia@uniontech.com>
+
+[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
+
+It reports a MIN value -15360 for volume control, but will mute when
+setting it less than -14208
+
+Tested-by: Guoli An <anguoli@uniontech.com>
+Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index b8fa0a866153b..cc051756a4220 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1191,6 +1191,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 			cval->res = 1;
+ 		}
+ 		break;
++	case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
++		if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
++			usb_audio_info(chip,
++				"set volume quirk for MOONDROP Quark2\n");
++			cval->min = -14208; /* Mute under it */
++		}
++		break;
+ 	}
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch b/queue-6.6/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
new file mode 100644
index 0000000000..e4e1eaf9b2
--- /dev/null
+++ b/queue-6.6/amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
@@ -0,0 +1,121 @@
+From d71f91b5006ddfe6ca824af067bc3b0c3cf7a471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 21:21:15 +0800
+Subject: amd/amdkfd: resolve a race in amdgpu_amdkfd_device_fini_sw
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 99d7181bca34e96fbf61bdb6844918bdd4df2814 ]
+
+There is race in amdgpu_amdkfd_device_fini_sw and interrupt.
+if amdgpu_amdkfd_device_fini_sw run in b/w kfd_cleanup_nodes and
+  kfree(kfd), and KGD interrupt generated.
+
+kernel panic log:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000098
+amdgpu 0000:c8:00.0: amdgpu: Requesting 4 partitions through PSP
+
+PGD d78c68067 P4D d78c68067
+
+kfd kfd: amdgpu: Allocated 3969056 bytes on gart
+
+PUD 1465b8067 PMD @
+
+Oops: @002 [#1] SMP NOPTI
+
+kfd kfd: amdgpu: Total number of KFD nodes to be created: 4
+CPU: 115 PID: @ Comm: swapper/115 Kdump: loaded Tainted: G S W OE K
+
+RIP: 0010:_raw_spin_lock_irqsave+0x12/0x40
+
+Code: 89 e@ 41 5c c3 cc cc cc cc 66 66 2e Of 1f 84 00 00 00 00 00 OF 1f 40 00 Of 1f 44% 00 00 41 54 9c 41 5c fa 31 cO ba 01 00 00 00 <fO> OF b1 17 75 Ba 4c 89 e@ 41 Sc
+
+89 c6 e8 07 38 5d
+
+RSP: 0018: ffffc90@1a6b0e28 EFLAGS: 00010046
+
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000018
+0000000000000001 RSI: ffff8883bb623e00 RDI: 0000000000000098
+ffff8883bb000000 RO8: ffff888100055020 ROO: ffff888100055020
+0000000000000000 R11: 0000000000000000 R12: 0900000000000002
+ffff888F2b97da0@ R14: @000000000000098 R15: ffff8883babdfo00
+
+CS: 010 DS: 0000 ES: 0000 CRO: 0000000080050033
+
+CR2: 0000000000000098 CR3: 0000000e7cae2006 CR4: 0000000002770ce0
+0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+0000000000000000 DR6: 00000000fffeO7FO DR7: 0000000000000400
+
+PKRU: 55555554
+
+Call Trace:
+
+<IRQ>
+
+kgd2kfd_interrupt+@x6b/0x1f@ [amdgpu]
+
+? amdgpu_fence_process+0xa4/0x150 [amdgpu]
+
+kfd kfd: amdgpu: Node: 0, interrupt_bitmap: 3 YcpxFl Rant tErace
+
+amdgpu_irq_dispatch+0x165/0x210 [amdgpu]
+
+amdgpu_ih_process+0x80/0x100 [amdgpu]
+
+amdgpu: Virtual CRAT table created for GPU
+
+amdgpu_irq_handler+0x1f/@x60 [amdgpu]
+
+__handle_irq_event_percpu+0x3d/0x170
+
+amdgpu: Topology: Add dGPU node [0x74a2:0x1002]
+
+handle_irq_event+0x5a/@xcO
+
+handle_edge_irq+0x93/0x240
+
+kfd kfd: amdgpu: KFD node 1 partition @ size 49148M
+
+asm_call_irq_on_stack+0xf/@x20
+
+</IRQ>
+
+common_interrupt+0xb3/0x130
+
+asm_common_interrupt+0x1le/0x40
+
+5.10.134-010.a1i5000.a18.x86_64 #1
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: Philip Yang<Philip.Yang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+index 2786d47961e07..6af65db4de947 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+@@ -1017,7 +1017,15 @@ void kgd2kfd_interrupt(struct kfd_dev *kfd, const void *ih_ring_entry)
+ 	}
+ 
+ 	for (i = 0; i < kfd->num_nodes; i++) {
+-		node = kfd->nodes[i];
++		/* Race if another thread in b/w
++		 * kfd_cleanup_nodes and kfree(kfd),
++		 * when kfd->nodes[i] = NULL
++		 */
++		if (kfd->nodes[i])
++			node = kfd->nodes[i];
++		else
++			return;
++
+ 		spin_lock_irqsave(&node->interrupt_lock, flags);
+ 
+ 		if (node->interrupts_active
+-- 
+2.51.0
+
diff --git a/queue-6.6/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch b/queue-6.6/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
new file mode 100644
index 0000000000..19b6ecf8f8
--- /dev/null
+++ b/queue-6.6/asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
@@ -0,0 +1,47 @@
+From e9f731b879a6ded2ae400abe5b933ff13a60c8c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Sep 2025 16:43:40 +0100
+Subject: ASoC: qcom: sc8280xp: explicitly set S16LE format in
+ sc8280xp_be_hw_params_fixup()
+
+From: Alexey Klimov <alexey.klimov@linaro.org>
+
+[ Upstream commit 9565c9d53c5b440f0dde6fa731a99c1b14d879d2 ]
+
+Setting format to s16le is required for compressed playback on compatible
+soundcards.
+
+Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
+Link: https://patch.msgid.link/20250911154340.2798304-1-alexey.klimov@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/sc8280xp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/soc/qcom/sc8280xp.c b/sound/soc/qcom/sc8280xp.c
+index d5cc967992d16..ee195a54d0c3b 100644
+--- a/sound/soc/qcom/sc8280xp.c
++++ b/sound/soc/qcom/sc8280xp.c
+@@ -7,6 +7,7 @@
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+ #include <sound/pcm.h>
++#include <sound/pcm_params.h>
+ #include <linux/soundwire/sdw.h>
+ #include <sound/jack.h>
+ #include <linux/input-event-codes.h>
+@@ -58,8 +59,10 @@ static int sc8280xp_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+ 					SNDRV_PCM_HW_PARAM_RATE);
+ 	struct snd_interval *channels = hw_param_interval(params,
+ 					SNDRV_PCM_HW_PARAM_CHANNELS);
++	struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
+ 
+ 	rate->min = rate->max = 48000;
++	snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S16_LE);
+ 	channels->min = 2;
+ 	channels->max = 2;
+ 	switch (cpu_dai->id) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch b/queue-6.6/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
new file mode 100644
index 0000000000..a06c8e6807
--- /dev/null
+++ b/queue-6.6/asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
@@ -0,0 +1,49 @@
+From 9dabfeb9b6fb04415d4e184531495c7405325d44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 14:31:18 +0200
+Subject: ASoC: stm32: sai: manage context in set_sysclk callback
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+[ Upstream commit 27fa1a8b2803dfd88c39f03b0969c55f667cdc43 ]
+
+The mclk direction now needs to be specified in endpoint node with
+"system-clock-direction-out" property. However some calls to the
+set_sysclk callback, related to CPU DAI clock, result in unbalanced
+calls to clock API.
+The set_sysclk callback in STM32 SAI driver is intended only for mclk
+management. So it is relevant to ensure that calls to set_sysclk are
+related to mclk only.
+Since the master clock is handled only at runtime, skip the calls to
+set_sysclk in the initialization phase.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Link: https://patch.msgid.link/20250916123118.84175-1-olivier.moysan@foss.st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index dcbcd1a59a3aa..351e96163406b 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -551,6 +551,14 @@ static int stm32_sai_set_sysclk(struct snd_soc_dai *cpu_dai,
+ 	struct stm32_sai_sub_data *sai = snd_soc_dai_get_drvdata(cpu_dai);
+ 	int ret;
+ 
++	/*
++	 * The mclk rate is determined at runtime from the audio stream rate.
++	 * Skip calls to the set_sysclk callback that are not relevant during the
++	 * initialization phase.
++	 */
++	if (!snd_soc_card_is_instantiated(cpu_dai->component->card))
++		return 0;
++
+ 	if (dir == SND_SOC_CLOCK_OUT && sai->sai_mclk) {
+ 		ret = stm32_sai_sub_reg_up(sai, STM_SAI_CR1_REGX,
+ 					   SAI_XCR1_NODIV,
+-- 
+2.51.0
+
diff --git a/queue-6.6/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch b/queue-6.6/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
new file mode 100644
index 0000000000..3f58d0becd
--- /dev/null
+++ b/queue-6.6/asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
@@ -0,0 +1,99 @@
+From 55816301cdb7a559861a48ea51dc9136aaabb442 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 10:59:29 +0200
+Subject: ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007
+
+From: Primoz Fiser <primoz.fiser@norik.com>
+
+[ Upstream commit 733a763dd8b3ac2858dd238a91bb3a2fdff4739e ]
+
+The problem of having class-D initialization sequence in probe using
+regmap_register_patch() is that it will do hardware register writes
+immediately after being called as it bypasses regcache. Afterwards, in
+aic3x_init() we also perform codec soft reset, rendering class-D init
+sequence pointless. This issue is even more apparent when using reset
+GPIO line, since in that case class-D amplifier initialization fails
+with "Failed to init class D: -5" message as codec is already held in
+reset state after requesting the reset GPIO and hence hardware I/O
+fails with -EIO errno.
+
+Thus move class-D amplifier initialization sequence from probe function
+to aic3x_set_power() just before the usual regcache sync. Use bypassed
+regmap_multi_reg_write_bypassed() function to make sure, class-D init
+sequence is performed in proper order as described in the datasheet.
+
+Signed-off-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250925085929.2581749-1-primoz.fiser@norik.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320aic3x.c | 32 ++++++++++++++------------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index 56e795a00e22f..591f6c9f9d3a6 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -121,6 +121,16 @@ static const struct reg_default aic3x_reg[] = {
+ 	{ 108, 0x00 }, { 109, 0x00 },
+ };
+ 
++static const struct reg_sequence aic3007_class_d[] = {
++	/* Class-D speaker driver init; datasheet p. 46 */
++	{ AIC3X_PAGE_SELECT, 0x0D },
++	{ 0xD, 0x0D },
++	{ 0x8, 0x5C },
++	{ 0x8, 0x5D },
++	{ 0x8, 0x5C },
++	{ AIC3X_PAGE_SELECT, 0x00 },
++};
++
+ static bool aic3x_volatile_reg(struct device *dev, unsigned int reg)
+ {
+ 	switch (reg) {
+@@ -1393,6 +1403,10 @@ static int aic3x_set_power(struct snd_soc_component *component, int power)
+ 			gpiod_set_value(aic3x->gpio_reset, 0);
+ 		}
+ 
++		if (aic3x->model == AIC3X_MODEL_3007)
++			regmap_multi_reg_write_bypassed(aic3x->regmap, aic3007_class_d,
++							ARRAY_SIZE(aic3007_class_d));
++
+ 		/* Sync reg_cache with the hardware */
+ 		regcache_cache_only(aic3x->regmap, false);
+ 		regcache_sync(aic3x->regmap);
+@@ -1723,17 +1737,6 @@ static void aic3x_configure_ocmv(struct device *dev, struct aic3x_priv *aic3x)
+ 	}
+ }
+ 
+-
+-static const struct reg_sequence aic3007_class_d[] = {
+-	/* Class-D speaker driver init; datasheet p. 46 */
+-	{ AIC3X_PAGE_SELECT, 0x0D },
+-	{ 0xD, 0x0D },
+-	{ 0x8, 0x5C },
+-	{ 0x8, 0x5D },
+-	{ 0x8, 0x5C },
+-	{ AIC3X_PAGE_SELECT, 0x00 },
+-};
+-
+ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver_data)
+ {
+ 	struct aic3x_priv *aic3x;
+@@ -1825,13 +1828,6 @@ int aic3x_probe(struct device *dev, struct regmap *regmap, kernel_ulong_t driver
+ 
+ 	aic3x_configure_ocmv(dev, aic3x);
+ 
+-	if (aic3x->model == AIC3X_MODEL_3007) {
+-		ret = regmap_register_patch(aic3x->regmap, aic3007_class_d,
+-					    ARRAY_SIZE(aic3007_class_d));
+-		if (ret != 0)
+-			dev_err(dev, "Failed to init class D: %d\n", ret);
+-	}
+-
+ 	ret = devm_snd_soc_register_component(dev, &soc_component_dev_aic3x, &aic3x_dai, 1);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.6/bluetooth-bcsp-receive-data-only-if-registered.patch b/queue-6.6/bluetooth-bcsp-receive-data-only-if-registered.patch
new file mode 100644
index 0000000000..1ae598d852
--- /dev/null
+++ b/queue-6.6/bluetooth-bcsp-receive-data-only-if-registered.patch
@@ -0,0 +1,58 @@
+From 44566ce67646a1851cd3b1f84125bbe4b3ef3695 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Aug 2025 16:03:40 -0400
+Subject: Bluetooth: bcsp: receive data only if registered
+
+From: Ivan Pravdin <ipravdin.official@gmail.com>
+
+[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
+
+Currently, bcsp_recv() can be called even when the BCSP protocol has not
+been registered. This leads to a NULL pointer dereference, as shown in
+the following stack trace:
+
+    KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
+    RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
+    Call Trace:
+     <TASK>
+     hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
+     tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
+     tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
+     vfs_ioctl fs/ioctl.c:51 [inline]
+     __do_sys_ioctl fs/ioctl.c:907 [inline]
+     __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
+     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+     do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
+     entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
+processing received data. If the protocol is not registered, return
+-EUNATCH.
+
+Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
+Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
+Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcsp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
+index 2a5a27d713f8a..e991d9e624869 100644
+--- a/drivers/bluetooth/hci_bcsp.c
++++ b/drivers/bluetooth/hci_bcsp.c
+@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
+ 	struct bcsp_struct *bcsp = hu->priv;
+ 	const unsigned char *ptr;
+ 
++	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
++		return -EUNATCH;
++
+ 	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
+ 	       hu, count, bcsp->rx_state, bcsp->rx_count);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch b/queue-6.6/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
new file mode 100644
index 0000000000..eb338bc05c
--- /dev/null
+++ b/queue-6.6/bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
@@ -0,0 +1,122 @@
+From aa8a144988678dc908f40dd186d7cfea0f724b3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 18:40:16 +0200
+Subject: Bluetooth: btusb: Check for unexpected bytes when defragmenting HCI
+ frames
+
+From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+
+[ Upstream commit 7722d6fb54e428a8f657fccf422095a8d7e2d72c ]
+
+Some Barrot based USB Bluetooth dongles erroneously send one extra
+random byte for the HCI_OP_READ_LOCAL_EXT_FEATURES command. The
+consequence of that is that the next HCI transfer is misaligned by one
+byte causing undefined behavior. In most cases the response event for
+the next command fails with random error code.
+
+Since the HCI_OP_READ_LOCAL_EXT_FEATURES command is used during HCI
+controller initialization, the initialization fails rendering the USB
+dongle not usable.
+
+> [59.464099] usb 1-1.3: new full-speed USB device number 11 using xhci_hcd
+> [59.561617] usb 1-1.3: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [59.561642] usb 1-1.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [59.561656] usb 1-1.3: Product: UGREEN BT6.0 Adapter
+> [61.720116] Bluetooth: hci1: command 0x1005 tx timeout
+> [61.720167] Bluetooth: hci1: Opcode 0x1005 failed: -110
+
+This patch was tested with the 33fa:0012 device. The info from the
+/sys/kernel/debug/usb/devices is shown below:
+
+T:  Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 12 Spd=12   MxCh= 0
+D:  Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
+P:  Vendor=33fa ProdID=0012 Rev=88.91
+S:  Product=UGREEN BT6.0 Adapter
+C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=100mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
+I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
+I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
+I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
+I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
+
+Now the device is initialized properly:
+
+> [43.329852] usb 1-1.4: new full-speed USB device number 4 using dwc_otg
+> [43.446790] usb 1-1.4: New USB device found, idVendor=33fa, idProduct=0012, bcdDevice=88.91
+> [43.446813] usb 1-1.4: New USB device strings: Mfr=0, Product=2, SerialNumber=0
+> [43.446821] usb 1-1.4: Product: UGREEN BT6.0 Adapter
+> [43.582024] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.703025] Bluetooth: hci1: Unexpected continuation: 1 bytes
+> [43.750141] Bluetooth: MGMT ver 1.23
+
+Link: https://github.com/bluez/bluez/issues/1326
+Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Tested-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btusb.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 4c21230aee460..23a9a221056a4 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -65,6 +65,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
+ #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
+ #define BTUSB_ACTIONS_SEMI		BIT(27)
++#define BTUSB_BARROT			BIT(28)
+ 
+ static const struct usb_device_id btusb_table[] = {
+ 	/* Generic Bluetooth USB device */
+@@ -770,6 +771,10 @@ static const struct usb_device_id quirks_table[] = {
+ 	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
+ 						     BTUSB_WIDEBAND_SPEECH },
+ 
++	/* Barrot Technology Bluetooth devices */
++	{ USB_DEVICE(0x33fa, 0x0010), .driver_info = BTUSB_BARROT },
++	{ USB_DEVICE(0x33fa, 0x0012), .driver_info = BTUSB_BARROT },
++
+ 	/* Actions Semiconductor ATS2851 based devices */
+ 	{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
+ 
+@@ -1167,6 +1172,18 @@ static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
+ 		}
+ 
+ 		if (!hci_skb_expect(skb)) {
++			/* Each chunk should correspond to at least 1 or more
++			 * events so if there are still bytes left that doesn't
++			 * constitute a new event this is likely a bug in the
++			 * controller.
++			 */
++			if (count && count < HCI_EVENT_HDR_SIZE) {
++				bt_dev_warn(data->hdev,
++					"Unexpected continuation: %d bytes",
++					count);
++				count = 0;
++			}
++
+ 			/* Complete frame */
+ 			btusb_recv_event(data, skb);
+ 			skb = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.6/bluetooth-sco-fix-uaf-on-sco_conn_free.patch b/queue-6.6/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
new file mode 100644
index 0000000000..a2cb4fd66a
--- /dev/null
+++ b/queue-6.6/bluetooth-sco-fix-uaf-on-sco_conn_free.patch
@@ -0,0 +1,124 @@
+From 0ade626e25f5b58a7b9485426973019c96973f6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 13:13:13 -0400
+Subject: Bluetooth: SCO: Fix UAF on sco_conn_free
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
+
+BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
+BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
+BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
+net/bluetooth/sco.c:107
+Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
+
+CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
+6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
+Workqueue: hci13 hci_cmd_sync_work
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x191/0x550 mm/kasan/report.c:482
+ kasan_report+0xc4/0x100 mm/kasan/report.c:595
+ sco_conn_free net/bluetooth/sco.c:87 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
+ sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
+ hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
+ hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
+ hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
+ hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
+ hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
+ hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
+ process_one_work kernel/workqueue.c:3236 [inline]
+ process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
+ worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
+ kthread+0x3c7/0x870 kernel/kthread.c:463
+ ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
+ ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
+ </TASK>
+
+Allocated by task 31370:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
+ __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
+ kasan_kmalloc include/linux/kasan.h:260 [inline]
+ __do_kmalloc_node mm/slub.c:4382 [inline]
+ __kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
+ kmalloc_noprof include/linux/slab.h:909 [inline]
+ sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
+ sk_alloc+0x34/0x5a0 net/core/sock.c:2295
+ bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
+ sco_sock_alloc net/bluetooth/sco.c:562 [inline]
+ sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
+ bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
+ __sock_create+0x3ad/0x780 net/socket.c:1589
+ sock_create net/socket.c:1647 [inline]
+ __sys_socket_create net/socket.c:1684 [inline]
+ __sys_socket+0xd5/0x330 net/socket.c:1731
+ __do_sys_socket net/socket.c:1745 [inline]
+ __se_sys_socket net/socket.c:1743 [inline]
+ __x64_sys_socket+0x7a/0x90 net/socket.c:1743
+ do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
+ do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Freed by task 31374:
+ kasan_save_stack mm/kasan/common.c:47 [inline]
+ kasan_save_track+0x30/0x70 mm/kasan/common.c:68
+ kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
+ poison_slab_object mm/kasan/common.c:243 [inline]
+ __kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
+ kasan_slab_free include/linux/kasan.h:233 [inline]
+ slab_free_hook mm/slub.c:2428 [inline]
+ slab_free mm/slub.c:4701 [inline]
+ kfree+0x199/0x3b0 mm/slub.c:4900
+ sk_prot_free net/core/sock.c:2278 [inline]
+ __sk_destruct+0x4aa/0x630 net/core/sock.c:2373
+ sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
+ __sock_release net/socket.c:649 [inline]
+ sock_close+0xb8/0x230 net/socket.c:1439
+ __fput+0x3d1/0x9e0 fs/file_table.c:468
+ task_work_run+0x206/0x2a0 kernel/task_work.c:227
+ get_signal+0x1201/0x1410 kernel/signal.c:2807
+ arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
+ exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
+ exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
+ syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
+ syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
+ do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/sco.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index 64d4d57c7033a..6635d155e360b 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -433,6 +433,13 @@ static void sco_sock_kill(struct sock *sk)
+ 
+ 	BT_DBG("sk %p state %d", sk, sk->sk_state);
+ 
++	/* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++	if (sco_pi(sk)->conn) {
++		sco_conn_lock(sco_pi(sk)->conn);
++		sco_pi(sk)->conn->sk = NULL;
++		sco_conn_unlock(sco_pi(sk)->conn);
++	}
++
+ 	/* Kill poor orphan */
+ 	bt_sock_unlink(&sco_sk_list, sk);
+ 	sock_set_flag(sk, SOCK_DEAD);
+-- 
+2.51.0
+
diff --git a/queue-6.6/bridge-redirect-to-backup-port-when-port-is-administ.patch b/queue-6.6/bridge-redirect-to-backup-port-when-port-is-administ.patch
new file mode 100644
index 0000000000..bff30a4dc6
--- /dev/null
+++ b/queue-6.6/bridge-redirect-to-backup-port-when-port-is-administ.patch
@@ -0,0 +1,61 @@
+From 7d32b1a527542080a54a94a9c4b9db26f7e16bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 11:02:12 +0300
+Subject: bridge: Redirect to backup port when port is administratively down
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
+
+If a backup port is configured for a bridge port, the bridge will
+redirect known unicast traffic towards the backup port when the primary
+port is administratively up but without a carrier. This is useful, for
+example, in MLAG configurations where a system is connected to two
+switches and there is a peer link between both switches. The peer link
+serves as the backup port in case one of the switches loses its
+connection to the multi-homed system.
+
+In order to avoid flooding when the primary port loses its carrier, the
+bridge does not flush dynamic FDB entries pointing to the port upon STP
+disablement, if the port has a backup port.
+
+The above means that known unicast traffic destined to the primary port
+will be blackholed when the port is put administratively down, until the
+FDB entries pointing to it are aged-out.
+
+Given that the current behavior is quite weird and unlikely to be
+depended on by anyone, amend the bridge to redirect to the backup port
+also when the primary port is administratively down and not only when it
+does not have a carrier.
+
+The change is motivated by a report from a user who expected traffic to
+be redirected to the backup port when the primary port was put
+administratively down while debugging a network issue.
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br_forward.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index e19b583ff2c6d..49dd8cd526f46 100644
+--- a/net/bridge/br_forward.c
++++ b/net/bridge/br_forward.c
+@@ -148,7 +148,8 @@ void br_forward(const struct net_bridge_port *to,
+ 		goto out;
+ 
+ 	/* redirect to backup link if the destination port is down */
+-	if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
++	if (rcu_access_pointer(to->backup_port) &&
++	    (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ 		struct net_bridge_port *backup_port;
+ 
+ 		backup_port = rcu_dereference(to->backup_port);
+-- 
+2.51.0
+
diff --git a/queue-6.6/char-misc-does-not-request-module-for-miscdevice-wit.patch b/queue-6.6/char-misc-does-not-request-module-for-miscdevice-wit.patch
new file mode 100644
index 0000000000..92114c8a1c
--- /dev/null
+++ b/queue-6.6/char-misc-does-not-request-module-for-miscdevice-wit.patch
@@ -0,0 +1,58 @@
+From edf5f3ffc8c6726a1a3e877c6a34900fc8be89b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:17 +0800
+Subject: char: misc: Does not request module for miscdevice with dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
+
+misc_open() may request module for miscdevice with dynamic minor, which
+is meaningless since:
+
+- The dynamic minor allocated is unknown in advance without registering
+  miscdevice firstly.
+- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
+
+Fix by only requesting module for miscdevice with fixed minor.
+
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 9ee78c76e8663..6f9ce6b3cc5a6 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -150,7 +150,8 @@ static int misc_open(struct inode *inode, struct file *file)
+ 		break;
+ 	}
+ 
+-	if (!new_fops) {
++	/* Only request module for fixed minor code */
++	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
+ 		mutex_unlock(&misc_mtx);
+ 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
+ 		mutex_lock(&misc_mtx);
+@@ -162,10 +163,11 @@ static int misc_open(struct inode *inode, struct file *file)
+ 			new_fops = fops_get(iter->fops);
+ 			break;
+ 		}
+-		if (!new_fops)
+-			goto fail;
+ 	}
+ 
++	if (!new_fops)
++		goto fail;
++
+ 	/*
+ 	 * Place the miscdevice in the file's
+ 	 * private_data so it can be used by the
+-- 
+2.51.0
+
diff --git a/queue-6.6/char-misc-make-misc_register-reentry-for-miscdevice-.patch b/queue-6.6/char-misc-make-misc_register-reentry-for-miscdevice-.patch
new file mode 100644
index 0000000000..1eff765aff
--- /dev/null
+++ b/queue-6.6/char-misc-make-misc_register-reentry-for-miscdevice-.patch
@@ -0,0 +1,71 @@
+From d782b7736e50adcb5666097b6579e4d6aeeadc2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 23:34:16 +0800
+Subject: char: misc: Make misc_register() reentry for miscdevice who wants
+ dynamic minor
+
+From: Zijun Hu <zijun.hu@oss.qualcomm.com>
+
+[ Upstream commit 52e2bb5ff089d65e2c7d982fe2826dc88e473d50 ]
+
+For miscdevice who wants dynamic minor, it may fail to be registered again
+without reinitialization after being de-registered, which is illustrated
+by kunit test case miscdev_test_dynamic_reentry() newly added.
+
+There is a real case found by cascardo when a part of minor range were
+contained by range [0, 255):
+
+1) wmi/dell-smbios registered minor 122, and acpi_thermal_rel registered
+   minor 123
+2) unbind "int3400 thermal" driver from its device, this will de-register
+   acpi_thermal_rel
+3) rmmod then insmod dell_smbios again, now wmi/dell-smbios is using minor
+   123
+4) bind the device to "int3400 thermal" driver again, acpi_thermal_rel
+   fails to register.
+
+Some drivers may reuse the miscdevice structure after they are deregistered
+If the intention is to allocate a dynamic minor, if the minor number is not
+reset to MISC_DYNAMIC_MINOR before calling misc_register(), it will try to
+register a previously dynamically allocated minor number, which may have
+been registered by a different driver.
+
+One such case is the acpi_thermal_rel misc device, registered by the
+int3400 thermal driver. If the device is unbound from the driver and later
+bound, if there was another dynamic misc device registered in between, it
+would fail to register the acpi_thermal_rel misc device. Other drivers
+behave similarly.
+
+Actually, this kind of issue is prone to happen if APIs
+misc_register()/misc_deregister() are invoked by driver's
+probe()/remove() separately.
+
+Instead of fixing all the drivers, just reset the minor member to
+MISC_DYNAMIC_MINOR in misc_deregister() in case it was a dynamically
+allocated minor number, as error handling of misc_register() does.
+
+Cc: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-5-2ed949665bde@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 30178e20d962d..9ee78c76e8663 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -300,6 +300,8 @@ void misc_deregister(struct miscdevice *misc)
+ 	list_del(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
++	if (misc->minor > MISC_DYNAMIC_MINOR)
++		misc->minor = MISC_DYNAMIC_MINOR;
+ 	mutex_unlock(&misc_mtx);
+ }
+ EXPORT_SYMBOL(misc_deregister);
+-- 
+2.51.0
+
diff --git a/queue-6.6/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch b/queue-6.6/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
new file mode 100644
index 0000000000..fe47a4cdb5
--- /dev/null
+++ b/queue-6.6/char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
@@ -0,0 +1,100 @@
+From 8ecc53ecc3d40f98b31489b8c93ed8f9b274e7b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Apr 2025 05:45:42 -0300
+Subject: char: misc: restrict the dynamic range to exclude reserved minors
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 31b636d2c41613e3bd36256a4bd53e9dacfa2677 ]
+
+When this was first reported [1], the possibility of having sufficient
+number of dynamic misc devices was theoretical, in the case of dlm driver.
+In practice, its userspace never created more than one device.
+
+What we know from commit ab760791c0cf ("char: misc: Increase the maximum
+number of dynamic misc devices to 1048448"), is that the miscdevice
+interface has been used for allocating more than the single-shot devices it
+was designed for. And it is not only coresight_tmc, but many other drivers
+are able to create multiple devices.
+
+On systems like the ones described in the above commit, it is certain that
+the dynamic allocation will allocate certain reserved minor numbers,
+leading to failures when a later driver tries to claim its reserved number.
+
+Instead of excluding the historically statically allocated range from
+dynamic allocation, restrict the latter to minors above 255. That also
+removes the need for DYNAMIC_MINORS and the convolution in allocating minor
+numbers, simplifying the code.
+
+Since commit ab760791c0cf ("char: misc: Increase the maximum number of
+dynamic misc devices to 1048448") has been applied, such range is already
+possible. And given such devices already need to be dynamically created,
+there should be no systems where this might become a problem.
+
+[1] https://lore.kernel.org/all/1257813017-28598-3-git-send-email-cascardo@holoscopio.com/
+
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Link: https://lore.kernel.org/r/20250423-misc-dynrange-v4-1-133b5ae4ca18@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 28 +++++-----------------------
+ 1 file changed, 5 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 792a1412faffe..8d8c4bcf07e1c 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -58,9 +58,8 @@ static LIST_HEAD(misc_list);
+ static DEFINE_MUTEX(misc_mtx);
+ 
+ /*
+- * Assigned numbers, used for dynamic minors
++ * Assigned numbers.
+  */
+-#define DYNAMIC_MINORS 128 /* like dynamic majors */
+ static DEFINE_IDA(misc_minors_ida);
+ 
+ static int misc_minor_alloc(int minor)
+@@ -69,34 +68,17 @@ static int misc_minor_alloc(int minor)
+ 
+ 	if (minor == MISC_DYNAMIC_MINOR) {
+ 		/* allocate free id */
+-		ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL);
+-		if (ret >= 0) {
+-			ret = DYNAMIC_MINORS - ret - 1;
+-		} else {
+-			ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
+-					      MINORMASK, GFP_KERNEL);
+-		}
++		ret = ida_alloc_range(&misc_minors_ida, MISC_DYNAMIC_MINOR + 1,
++				      MINORMASK, GFP_KERNEL);
+ 	} else {
+-		/* specific minor, check if it is in dynamic or misc dynamic range  */
+-		if (minor < DYNAMIC_MINORS) {
+-			minor = DYNAMIC_MINORS - minor - 1;
+-			ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+-		} else if (minor > MISC_DYNAMIC_MINOR) {
+-			ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+-		} else {
+-			/* case of non-dynamic minors, no need to allocate id */
+-			ret = 0;
+-		}
++		ret = ida_alloc_range(&misc_minors_ida, minor, minor, GFP_KERNEL);
+ 	}
+ 	return ret;
+ }
+ 
+ static void misc_minor_free(int minor)
+ {
+-	if (minor < DYNAMIC_MINORS)
+-		ida_free(&misc_minors_ida, DYNAMIC_MINORS - minor - 1);
+-	else if (minor > MISC_DYNAMIC_MINOR)
+-		ida_free(&misc_minors_ida, minor);
++	ida_free(&misc_minors_ida, minor);
+ }
+ 
+ #ifdef CONFIG_PROC_FS
+-- 
+2.51.0
+
diff --git a/queue-6.6/char-use-list_del_init-in-misc_deregister-to-reiniti.patch b/queue-6.6/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
new file mode 100644
index 0000000000..0bcc034ac5
--- /dev/null
+++ b/queue-6.6/char-use-list_del_init-in-misc_deregister-to-reiniti.patch
@@ -0,0 +1,52 @@
+From d36eef0abf6b9bf7569e3a49634210d453a2fd75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 14:37:04 +0800
+Subject: char: Use list_del_init() in misc_deregister() to reinitialize list
+ pointer
+
+From: Xion Wang <xion.wang@mediatek.com>
+
+[ Upstream commit e28022873c0d051e980c4145f1965cab5504b498 ]
+
+Currently, misc_deregister() uses list_del() to remove the device
+from the list. After list_del(), the list pointers are set to
+LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs,
+but does not reset the list head.
+If misc_deregister() is called more than once on the same device,
+list_empty() will not return true, and list_del() may be called again,
+leading to undefined behavior.
+
+Replace list_del() with list_del_init() to reinitialize the list head
+after deletion. This makes the code more robust against double
+deregistration and allows safe usage of list_empty() on the miscdevice
+after deregistration.
+
+[ Note, this seems to keep broken out-of-tree drivers from doing foolish
+  things.  While this does not matter for any in-kernel drivers,
+  external drivers could use a bit of help to show them they shouldn't
+  be doing stuff like re-registering misc devices - gregkh ]
+
+Signed-off-by: Xion Wang <xion.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/misc.c b/drivers/char/misc.c
+index 6f9ce6b3cc5a6..792a1412faffe 100644
+--- a/drivers/char/misc.c
++++ b/drivers/char/misc.c
+@@ -299,7 +299,7 @@ void misc_deregister(struct miscdevice *misc)
+ 		return;
+ 
+ 	mutex_lock(&misc_mtx);
+-	list_del(&misc->list);
++	list_del_init(&misc->list);
+ 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
+ 	misc_minor_free(misc->minor);
+ 	if (misc->minor > MISC_DYNAMIC_MINOR)
+-- 
+2.51.0
+
diff --git a/queue-6.6/crypto-caam-double-the-entropy-delay-interval-for-re.patch b/queue-6.6/crypto-caam-double-the-entropy-delay-interval-for-re.patch
new file mode 100644
index 0000000000..6fffcdd6bd
--- /dev/null
+++ b/queue-6.6/crypto-caam-double-the-entropy-delay-interval-for-re.patch
@@ -0,0 +1,49 @@
+From d49a8c66ab51a2eabe686370309ec1204cc63424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 15:41:48 +0530
+Subject: crypto: caam - double the entropy delay interval for retry
+
+From: Gaurav Jain <gaurav.jain@nxp.com>
+
+[ Upstream commit 9048beca9c5614d486e2b492c0a7867164bf56a8 ]
+
+during entropy evaluation, if the generated samples fail
+any statistical test, then, all of the bits will be discarded,
+and a second set of samples will be generated and tested.
+
+the entropy delay interval should be doubled before performing the
+retry.
+
+also, ctrlpriv->rng4_sh_init and inst_handles both reads RNG DRNG
+status register, but only inst_handles is updated before every retry.
+so only check inst_handles and removing ctrlpriv->rng4_sh_init
+
+Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/ctrl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index bdf367f3f6798..eb880f0435ee9 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -692,12 +692,12 @@ static int caam_ctrl_rng_init(struct device *dev)
+ 			 */
+ 			if (needs_entropy_delay_adjustment())
+ 				ent_delay = 12000;
+-			if (!(ctrlpriv->rng4_sh_init || inst_handles)) {
++			if (!inst_handles) {
+ 				dev_info(dev,
+ 					 "Entropy delay = %u\n",
+ 					 ent_delay);
+ 				kick_trng(dev, ent_delay);
+-				ent_delay += 400;
++				ent_delay = ent_delay * 2;
+ 			}
+ 			/*
+ 			 * if instantiate_rng(...) fails, the loop will rerun
+-- 
+2.51.0
+
diff --git a/queue-6.6/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch b/queue-6.6/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
new file mode 100644
index 0000000000..d1db80c81e
--- /dev/null
+++ b/queue-6.6/crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
@@ -0,0 +1,43 @@
+From af423bbcaa918925306d11b087d049f523c30335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 22:20:26 +0800
+Subject: crypto: qat - use kcalloc() in qat_uclo_map_objs_from_mof()
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit 4c634b6b3c77bba237ee64bca172e73f9cee0cb2 ]
+
+As noted in the kernel documentation [1], open-coded multiplication in
+allocator arguments is discouraged because it can lead to integer overflow.
+
+Use kcalloc() to gain built-in overflow protection, making memory
+allocation safer when calculating allocation size compared to explicit
+multiplication.  Similarly, use size_add() instead of explicit addition
+for 'uobj_chunk_num + sobj_chunk_num'.
+
+Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments #1
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/qat_uclo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/qat_uclo.c b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+index 4bd150d1441a0..473e1ab9b8baa 100644
+--- a/drivers/crypto/intel/qat/qat_common/qat_uclo.c
++++ b/drivers/crypto/intel/qat/qat_common/qat_uclo.c
+@@ -1745,7 +1745,7 @@ static int qat_uclo_map_objs_from_mof(struct icp_qat_mof_handle *mobj_handle)
+ 	if (sobj_hdr)
+ 		sobj_chunk_num = sobj_hdr->num_chunks;
+ 
+-	mobj_hdr = kzalloc((uobj_chunk_num + sobj_chunk_num) *
++	mobj_hdr = kcalloc(size_add(uobj_chunk_num, sobj_chunk_num),
+ 			   sizeof(*mobj_hdr), GFP_KERNEL);
+ 	if (!mobj_hdr)
+ 		return -ENOMEM;
+-- 
+2.51.0
+
diff --git a/queue-6.6/crypto-sun8i-ce-remove-channel-timeout-field.patch b/queue-6.6/crypto-sun8i-ce-remove-channel-timeout-field.patch
new file mode 100644
index 0000000000..1dce42b908
--- /dev/null
+++ b/queue-6.6/crypto-sun8i-ce-remove-channel-timeout-field.patch
@@ -0,0 +1,120 @@
+From c6c69fc326261fd1f98f5a11daedeed17c06e329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:21:26 +0300
+Subject: crypto: sun8i-ce - remove channel timeout field
+
+From: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+
+[ Upstream commit 9a23ea1f7558bdd3f8d2b35b1c2e16a2f9bf671e ]
+
+Using the number of bytes in the request as DMA timeout is really
+inconsistent, as large requests could possibly set a timeout of
+hundreds of seconds.
+
+Remove the per-channel timeout field and use a single, static DMA
+timeout of 3 seconds for all requests.
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait.oss@gmail.com>
+Tested-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Reviewed-by: Corentin LABBE <clabbe.montjoie@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c   | 5 ++---
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c   | 2 --
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c   | 1 -
+ drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h        | 2 +-
+ 6 files changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+index 9e093d44a0662..31f2b4adf3d9a 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c
+@@ -264,7 +264,6 @@ static int sun8i_ce_cipher_prepare(struct crypto_engine *engine, void *async_req
+ 		goto theend_sgs;
+ 	}
+ 
+-	chan->timeout = areq->cryptlen;
+ 	rctx->nr_sgs = ns;
+ 	rctx->nr_sgd = nd;
+ 	return 0;
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+index d4ccd5254280b..eba186c5c6251 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c
+@@ -186,11 +186,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name)
+ 	mutex_unlock(&ce->mlock);
+ 
+ 	wait_for_completion_interruptible_timeout(&ce->chanlist[flow].complete,
+-			msecs_to_jiffies(ce->chanlist[flow].timeout));
++			msecs_to_jiffies(CE_DMA_TIMEOUT_MS));
+ 
+ 	if (ce->chanlist[flow].status == 0) {
+-		dev_err(ce->dev, "DMA timeout for %s (tm=%d) on flow %d\n", name,
+-			ce->chanlist[flow].timeout, flow);
++		dev_err(ce->dev, "DMA timeout for %s on flow %d\n", name, flow);
+ 		err = -EFAULT;
+ 	}
+ 	/* No need to lock for this read, the channel is locked so
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+index ebc857ed10e11..8ee1e94335c37 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c
+@@ -457,8 +457,6 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq)
+ 	else
+ 		cet->t_dlen = cpu_to_le32(areq->nbytes / 4 + j);
+ 
+-	chan->timeout = areq->nbytes;
+-
+ 	err = sun8i_ce_run_task(ce, flow, crypto_ahash_alg_name(tfm));
+ 
+ 	dma_unmap_single(ce->dev, addr_pad, j * 4, DMA_TO_DEVICE);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+index 80815379f6fc5..b571d1d0c4c4c 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-prng.c
+@@ -137,7 +137,6 @@ int sun8i_ce_prng_generate(struct crypto_rng *tfm, const u8 *src,
+ 
+ 	cet->t_dst[0].addr = cpu_to_le32(dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = 2000;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "PRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+index 9c35f2a83eda8..630a0b84b494d 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-trng.c
+@@ -79,7 +79,6 @@ static int sun8i_ce_trng_read(struct hwrng *rng, void *data, size_t max, bool wa
+ 
+ 	cet->t_dst[0].addr = cpu_to_le32(dma_dst);
+ 	cet->t_dst[0].len = cpu_to_le32(todo / 4);
+-	ce->chanlist[flow].timeout = todo;
+ 
+ 	err = sun8i_ce_run_task(ce, 3, "TRNG");
+ 	mutex_unlock(&ce->rnglock);
+diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+index 65cc1278ee155..d817ce445f4a3 100644
+--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce.h
+@@ -106,6 +106,7 @@
+ #define MAX_SG 8
+ 
+ #define CE_MAX_CLOCKS 4
++#define CE_DMA_TIMEOUT_MS	3000
+ 
+ #define MAXFLOW 4
+ 
+@@ -195,7 +196,6 @@ struct sun8i_ce_flow {
+ 	struct completion complete;
+ 	int status;
+ 	dma_addr_t t_phy;
+-	int timeout;
+ 	struct ce_task *tl;
+ 	void *backup_iv;
+ 	void *bounce_iv;
+-- 
+2.51.0
+
diff --git a/queue-6.6/dmaengine-dw-edma-set-status-for-callback_result.patch b/queue-6.6/dmaengine-dw-edma-set-status-for-callback_result.patch
new file mode 100644
index 0000000000..4a39f1e9d3
--- /dev/null
+++ b/queue-6.6/dmaengine-dw-edma-set-status-for-callback_result.patch
@@ -0,0 +1,74 @@
+From 8461d8d587037621e4a999ab01677904b064de59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 17:45:05 +0530
+Subject: dmaengine: dw-edma: Set status for callback_result
+
+From: Devendra K Verma <devverma@amd.com>
+
+[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
+
+DMA Engine has support for the callback_result which provides
+the status of the request and the residue. This helps in
+determining the correct status of the request and in
+efficient resource management of the request.
+The 'callback_result' method is preferred over the deprecated
+'callback' method.
+
+Signed-off-by: Devendra K Verma <devverma@amd.com>
+Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index 68236247059d1..9ae789d4aca7b 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -595,6 +595,25 @@ dw_edma_device_prep_interleaved_dma(struct dma_chan *dchan,
+ 	return dw_edma_device_transfer(&xfer);
+ }
+ 
++static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
++					enum dmaengine_tx_result result)
++{
++	u32 residue = 0;
++	struct dw_edma_desc *desc;
++	struct dmaengine_result *res;
++
++	if (!vd->tx.callback_result)
++		return;
++
++	desc = vd2dw_edma_desc(vd);
++	if (desc)
++		residue = desc->alloc_sz - desc->xfer_sz;
++
++	res = &vd->tx_result;
++	res->result = result;
++	res->residue = residue;
++}
++
+ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ {
+ 	struct dw_edma_desc *desc;
+@@ -608,6 +627,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ 		case EDMA_REQ_NONE:
+ 			desc = vd2dw_edma_desc(vd);
+ 			if (!desc->chunks_alloc) {
++				dw_hdma_set_callback_result(vd,
++							    DMA_TRANS_NOERROR);
+ 				list_del(&vd->node);
+ 				vchan_cookie_complete(vd);
+ 			}
+@@ -644,6 +665,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+ 	vd = vchan_next_desc(&chan->vc);
+ 	if (vd) {
++		dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
+ 		list_del(&vd->node);
+ 		vchan_cookie_complete(vd);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch b/queue-6.6/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
new file mode 100644
index 0000000000..b9e6a3e6fa
--- /dev/null
+++ b/queue-6.6/dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
@@ -0,0 +1,44 @@
+From 146e254db5750b257e064cc2dc9ecdb2d7129c1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:09:42 -0700
+Subject: dmaengine: mv_xor: match alloc_wc and free_wc
+
+From: Rosen Penev <rosenp@gmail.com>
+
+[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
+
+dma_alloc_wc is used but not dma_free_wc.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index ca0ba1d462832..8b215cbca1186 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
+ 
+ 	dma_async_device_unregister(&mv_chan->dmadev);
+ 
+-	dma_free_coherent(dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ 	dma_unmap_single(dev, mv_chan->dummy_src_addr,
+ 			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ err_free_irq:
+ 	free_irq(mv_chan->irq, mv_chan);
+ err_free_dma:
+-	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
++	dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
+ 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+ err_unmap_dst:
+ 	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+-- 
+2.51.0
+
diff --git a/queue-6.6/dmaengine-sh-setup_xref-error-handling.patch b/queue-6.6/dmaengine-sh-setup_xref-error-handling.patch
new file mode 100644
index 0000000000..0dfe038d4e
--- /dev/null
+++ b/queue-6.6/dmaengine-sh-setup_xref-error-handling.patch
@@ -0,0 +1,118 @@
+From 4302b2068708ab955510ace8f31debf65aeadaf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 17:24:43 +0200
+Subject: dmaengine: sh: setup_xref error handling
+
+From: Thomas Andreatta <thomasandreatta2000@gmail.com>
+
+[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
+
+This patch modifies the type of setup_xref from void to int and handles
+errors since the function can fail.
+
+`setup_xref` now returns the (eventual) error from
+`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
+result, removing the chunks from the queue and marking PM as idle in
+case of an error.
+
+Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
+Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
+ drivers/dma/sh/shdmac.c     | 17 +++++++++++++----
+ include/linux/shdma-base.h  |  2 +-
+ 3 files changed, 33 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
+index 588c5f409a808..8d796504cb7f1 100644
+--- a/drivers/dma/sh/shdma-base.c
++++ b/drivers/dma/sh/shdma-base.c
+@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
+ 			const struct shdma_ops *ops = sdev->ops;
+ 			dev_dbg(schan->dev, "Bring up channel %d\n",
+ 				schan->id);
+-			/*
+-			 * TODO: .xfer_setup() might fail on some platforms.
+-			 * Make it int then, on error remove chunks from the
+-			 * queue again
+-			 */
+-			ops->setup_xfer(schan, schan->slave_id);
++
++			ret = ops->setup_xfer(schan, schan->slave_id);
++			if (ret < 0) {
++				dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
++
++				/* Remove chunks from the queue and mark them as idle */
++				list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
++					if (chunk->cookie == cookie) {
++						chunk->mark = DESC_IDLE;
++						list_move(&chunk->node, &schan->ld_free);
++					}
++				}
++
++				schan->pm_state = SHDMA_PM_ESTABLISHED;
++				ret = pm_runtime_put(schan->dev);
++
++				spin_unlock_irq(&schan->chan_lock);
++				return ret;
++			}
+ 
+ 			if (schan->pm_state == SHDMA_PM_PENDING)
+ 				shdma_chan_xfer_ld_queue(schan);
+diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
+index 00067b29e2322..d8210488dd40c 100644
+--- a/drivers/dma/sh/shdmac.c
++++ b/drivers/dma/sh/shdmac.c
+@@ -300,21 +300,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
+ 	return dmae_is_busy(sh_chan);
+ }
+ 
+-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
+-			       int slave_id)
++static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
+ {
+ 	struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
+ 						    shdma_chan);
+ 
++	int ret = 0;
+ 	if (slave_id >= 0) {
+ 		const struct sh_dmae_slave_config *cfg =
+ 			sh_chan->config;
+ 
+-		dmae_set_dmars(sh_chan, cfg->mid_rid);
+-		dmae_set_chcr(sh_chan, cfg->chcr);
++		ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
++		if (ret < 0)
++			goto END;
++
++		ret = dmae_set_chcr(sh_chan, cfg->chcr);
++		if (ret < 0)
++			goto END;
++
+ 	} else {
+ 		dmae_init(sh_chan);
+ 	}
++
++END:
++	return ret;
+ }
+ 
+ /*
+diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
+index 6dfd05ef5c2d9..03ba4dab2ef73 100644
+--- a/include/linux/shdma-base.h
++++ b/include/linux/shdma-base.h
+@@ -96,7 +96,7 @@ struct shdma_ops {
+ 	int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
+ 			  dma_addr_t, dma_addr_t, size_t *);
+ 	int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
+-	void (*setup_xfer)(struct shdma_chan *, int);
++	int (*setup_xfer)(struct shdma_chan *, int);
+ 	void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
+ 	struct shdma_desc *(*embedded_desc)(void *, int);
+ 	bool (*chan_irq)(struct shdma_chan *, int);
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-add-more-cyan-skillfish-pci-ids.patch b/queue-6.6/drm-amd-add-more-cyan-skillfish-pci-ids.patch
new file mode 100644
index 0000000000..bd071deda8
--- /dev/null
+++ b/queue-6.6/drm-amd-add-more-cyan-skillfish-pci-ids.patch
@@ -0,0 +1,36 @@
+From 8ae661b6e6ccfe4716a29e9b2e1b1609023b8d4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:09:06 -0400
+Subject: drm/amd: add more cyan skillfish PCI ids
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1e18746381793bef7c715fc5ec5611a422a75c4c ]
+
+Add additional PCI IDs to the cyan skillfish family.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 940411f8e99be..b15ce4df74798 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -1983,6 +1983,11 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x7410, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ALDEBARAN},
+ 
+ 	/* CYAN_SKILLFISH */
++	{0x1002, 0x13DB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13F9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
++	{0x1002, 0x13FC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x13FE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 	{0x1002, 0x143F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYAN_SKILLFISH|AMD_IS_APU},
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-avoid-evicting-resources-at-s5.patch b/queue-6.6/drm-amd-avoid-evicting-resources-at-s5.patch
new file mode 100644
index 0000000000..6c311875d5
--- /dev/null
+++ b/queue-6.6/drm-amd-avoid-evicting-resources-at-s5.patch
@@ -0,0 +1,48 @@
+From c4d61afa85e4b7aea2584b79860a7a3749f4bf11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 12:00:06 -0500
+Subject: drm/amd: Avoid evicting resources at S5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 531df041f2a5296174abd8292d298eb62fe1ea97 ]
+
+Normally resources are evicted on dGPUs at suspend or hibernate and
+on APUs at hibernate.  These steps are unnecessary when using the S4
+callbacks to put the system into S5.
+
+Cc: AceLan Kao <acelan.kao@canonical.com>
+Cc: Kai-Heng Feng <kaihengf@nvidia.com>
+Cc: Mark Pearson <mpearson-lenovo@squebb.ca>
+Cc: Denis Benato <benato.denis96@gmail.com>
+Cc: Merthan Karakaş <m3rthn.k@gmail.com>
+Tested-by: Eric Naim <dnaim@cachyos.org>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 475d93d4a40bf..b2a1dc193cb8f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4113,6 +4113,10 @@ static int amdgpu_device_evict_resources(struct amdgpu_device *adev)
+ 	if ((adev->in_s3 || adev->in_s0ix) && (adev->flags & AMD_IS_APU))
+ 		return 0;
+ 
++	/* No need to evict when going to S5 through S4 callbacks */
++	if (system_state == SYSTEM_POWER_OFF)
++		return 0;
++
+ 	ret = amdgpu_ttm_evict_resources(adev, TTM_PL_VRAM);
+ 	if (ret)
+ 		DRM_WARN("evicting device resources failed\n");
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch b/queue-6.6/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
new file mode 100644
index 0000000000..b550bdb968
--- /dev/null
+++ b/queue-6.6/drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
@@ -0,0 +1,105 @@
+From a58b627dd0dbfd27708dc34e18706b132d7b1f7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 14:16:27 +0200
+Subject: drm/amd/display: Add AVI infoframe copy in
+ copy_stream_update_to_stream
+
+From: Karthi Kandasamy <karthi.kandasamy@amd.com>
+
+[ Upstream commit c8bedab2d9a1a0daa49ac20f9928a943f7205582 ]
+
+[WHY]
+Ensure AVI infoframe updates from stream updates are applied to the active
+stream so OS overrides are not lost.
+
+[HOW]
+Copy avi_infopacket to stream when valid flag is set.
+Follow existing infopacket copy pattern and perform a basic validity check before assignment.
+
+Reviewed-by: Aric Cyr <aric.cyr@amd.com>
+Signed-off-by: Karthi Kandasamy <karthi.kandasamy@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c          | 7 ++++++-
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 ++++++
+ drivers/gpu/drm/amd/display/dc/dc_stream.h        | 3 +++
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index eb71721dfb715..31c53491b8374 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2952,6 +2952,9 @@ static void copy_stream_update_to_stream(struct dc *dc,
+ 	if (update->adaptive_sync_infopacket)
+ 		stream->adaptive_sync_infopacket = *update->adaptive_sync_infopacket;
+ 
++	if (update->avi_infopacket)
++		stream->avi_infopacket = *update->avi_infopacket;
++
+ 	if (update->dither_option)
+ 		stream->dither_option = *update->dither_option;
+ 
+@@ -3158,7 +3161,8 @@ static void commit_planes_do_stream_update(struct dc *dc,
+ 					stream_update->vsp_infopacket ||
+ 					stream_update->hfvsif_infopacket ||
+ 					stream_update->adaptive_sync_infopacket ||
+-					stream_update->vtem_infopacket) {
++					stream_update->vtem_infopacket ||
++					stream_update->avi_infopacket) {
+ 				resource_build_info_frame(pipe_ctx);
+ 				dc->hwss.update_info_frame(pipe_ctx);
+ 
+@@ -4241,6 +4245,7 @@ static bool full_update_required(struct dc *dc,
+ 			stream_update->hfvsif_infopacket ||
+ 			stream_update->vtem_infopacket ||
+ 			stream_update->adaptive_sync_infopacket ||
++			stream_update->avi_infopacket ||
+ 			stream_update->dpms_off ||
+ 			stream_update->allow_freesync ||
+ 			stream_update->vrr_active_variable ||
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 277b2d205440c..802c0e19d03b3 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -3225,8 +3225,14 @@ static void set_avi_info_frame(
+ 	unsigned int fr_ind = pipe_ctx->stream->timing.fr_index;
+ 	enum dc_timing_3d_format format;
+ 
++	if (stream->avi_infopacket.valid) {
++		*info_packet = stream->avi_infopacket;
++		return;
++	}
++
+ 	memset(&hdmi_info, 0, sizeof(union hdmi_info_packet));
+ 
++
+ 	color_space = pipe_ctx->stream->output_color_space;
+ 	if (color_space == COLOR_SPACE_UNKNOWN)
+ 		color_space = (stream->timing.pixel_encoding == PIXEL_ENCODING_RGB) ?
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_stream.h b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+index d5b3e3a32cc6d..ad020cc246376 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h
++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h
+@@ -197,6 +197,7 @@ struct dc_stream_state {
+ 	struct dc_info_packet hfvsif_infopacket;
+ 	struct dc_info_packet vtem_infopacket;
+ 	struct dc_info_packet adaptive_sync_infopacket;
++	struct dc_info_packet avi_infopacket;
+ 	uint8_t dsc_packed_pps[128];
+ 	struct rect src; /* composition area */
+ 	struct rect dst; /* stream addressable area */
+@@ -323,6 +324,8 @@ struct dc_stream_update {
+ 	struct dc_info_packet *hfvsif_infopacket;
+ 	struct dc_info_packet *vtem_infopacket;
+ 	struct dc_info_packet *adaptive_sync_infopacket;
++	struct dc_info_packet *avi_infopacket;
++
+ 	bool *dpms_off;
+ 	bool integer_scaling_update;
+ 	bool *allow_freesync;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-add-more-cyan-skillfish-devices.patch b/queue-6.6/drm-amd-display-add-more-cyan-skillfish-devices.patch
new file mode 100644
index 0000000000..6358b406b1
--- /dev/null
+++ b/queue-6.6/drm-amd-display-add-more-cyan-skillfish-devices.patch
@@ -0,0 +1,58 @@
+From 0cf72930b597c9ea08c2cce7ae2095b998f3397e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:10:31 -0400
+Subject: drm/amd/display: add more cyan skillfish devices
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 3cf06bd4cf2512d564fdb451b07de0cebe7b138d ]
+
+Add PCI IDs to support display probe for cyan skillfish
+family of SOCs.
+
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 8 +++++++-
+ drivers/gpu/drm/amd/display/include/dal_asic_id.h | 5 +++++
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index 2f25f7096c4d6..277b2d205440c 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -150,7 +150,13 @@ enum dce_version resource_parse_asic_id(struct hw_asic_id asic_id)
+ 
+ 	case FAMILY_NV:
+ 		dc_version = DCN_VERSION_2_0;
+-		if (asic_id.chip_id == DEVICE_ID_NV_13FE || asic_id.chip_id == DEVICE_ID_NV_143F) {
++		if (asic_id.chip_id == DEVICE_ID_NV_13FE ||
++		    asic_id.chip_id == DEVICE_ID_NV_143F ||
++		    asic_id.chip_id == DEVICE_ID_NV_13F9 ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FA ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FB ||
++		    asic_id.chip_id == DEVICE_ID_NV_13FC ||
++		    asic_id.chip_id == DEVICE_ID_NV_13DB) {
+ 			dc_version = DCN_VERSION_2_01;
+ 			break;
+ 		}
+diff --git a/drivers/gpu/drm/amd/display/include/dal_asic_id.h b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+index e317089cf6ee7..b913d08a5e038 100644
+--- a/drivers/gpu/drm/amd/display/include/dal_asic_id.h
++++ b/drivers/gpu/drm/amd/display/include/dal_asic_id.h
+@@ -213,6 +213,11 @@ enum {
+ #endif
+ #define DEVICE_ID_NV_13FE 0x13FE  // CYAN_SKILLFISH
+ #define DEVICE_ID_NV_143F 0x143F
++#define DEVICE_ID_NV_13F9 0x13F9
++#define DEVICE_ID_NV_13FA 0x13FA
++#define DEVICE_ID_NV_13FB 0x13FB
++#define DEVICE_ID_NV_13FC 0x13FC
++#define DEVICE_ID_NV_13DB 0x13DB
+ #define FAMILY_VGH 144
+ #define DEVICE_ID_VGH_163F 0x163F
+ #define DEVICE_ID_VGH_1435 0x1435
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-disable-vrr-on-dce-6.patch b/queue-6.6/drm-amd-display-disable-vrr-on-dce-6.patch
new file mode 100644
index 0000000000..7590982b3d
--- /dev/null
+++ b/queue-6.6/drm-amd-display-disable-vrr-on-dce-6.patch
@@ -0,0 +1,79 @@
+From 35115f66612ef2db368f4db82f6bfc79822ba825 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:56:30 +0200
+Subject: drm/amd/display: Disable VRR on DCE 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 043c87d7d56e135393f8aab927148096e2d17589 ]
+
+DCE 6 was not advertised as being able to support VRR,
+so let's mark it as unsupported for now.
+
+The VRR implementation in amdgpu_dm depends on the VUPDATE
+interrupt which is not registered for DCE 6.
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Reviewed-by: Rodrigo Siqueira <siqueira@igalia.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +++-
+ drivers/gpu/drm/amd/display/dc/dc_helper.c        | 5 +++++
+ drivers/gpu/drm/amd/display/dc/dm_services.h      | 2 ++
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 8421e5f0737bf..4ffab762de543 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9243,6 +9243,8 @@ static void get_freesync_config_for_crtc(
+ 		} else {
+ 			config.state = VRR_STATE_INACTIVE;
+ 		}
++	} else {
++		config.state = VRR_STATE_UNSUPPORTED;
+ 	}
+ out:
+ 	new_crtc_state->freesync_config = config;
+@@ -10838,7 +10840,7 @@ void amdgpu_dm_update_freesync_caps(struct drm_connector *connector,
+ 
+ 	dm_con_state = to_dm_connector_state(connector->state);
+ 
+-	if (!adev->dm.freesync_module)
++	if (!adev->dm.freesync_module || !dc_supports_vrr(sink->ctx->dce_version))
+ 		goto update;
+ 
+ 	/* Some eDP panels only have the refresh rate range info in DisplayID */
+diff --git a/drivers/gpu/drm/amd/display/dc/dc_helper.c b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+index 3907eeff560ce..0713a503f7f6d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dc_helper.c
++++ b/drivers/gpu/drm/amd/display/dc/dc_helper.c
+@@ -744,3 +744,8 @@ char *dce_version_to_string(const int version)
+ 		return "Unknown";
+ 	}
+ }
++
++bool dc_supports_vrr(const enum dce_version v)
++{
++	return v >= DCE_VERSION_8_0;
++}
+diff --git a/drivers/gpu/drm/amd/display/dc/dm_services.h b/drivers/gpu/drm/amd/display/dc/dm_services.h
+index d0eed3b4771e6..f2ab2c42781a4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dm_services.h
++++ b/drivers/gpu/drm/amd/display/dc/dm_services.h
+@@ -294,4 +294,6 @@ void dm_dtn_log_end(struct dc_context *ctx,
+ 
+ char *dce_version_to_string(const int version);
+ 
++bool dc_supports_vrr(const enum dce_version v);
++
+ #endif /* __DM_SERVICES_H__ */
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-ensure-committing-streams-is-seamles.patch b/queue-6.6/drm-amd-display-ensure-committing-streams-is-seamles.patch
new file mode 100644
index 0000000000..de51e9754f
--- /dev/null
+++ b/queue-6.6/drm-amd-display-ensure-committing-streams-is-seamles.patch
@@ -0,0 +1,53 @@
+From be503aa6f1253251b7ce5b314000c6aa5f76c396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jul 2025 13:21:30 -0400
+Subject: drm/amd/display: ensure committing streams is seamless
+
+From: Clay King <clayking@amd.com>
+
+[ Upstream commit ca74cc428f2b9d0170c56b473dbcfd7fa01daf2d ]
+
+[Why]
+When transitioning between topologies such as multi-display to single
+display ODM 2:1, pipes might not be freed before use.
+
+[How]
+In dc_commit_streams, commit an additional, minimal transition if
+original transition is not seamless to ensure pipes are freed.
+
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Clay King <clayking@amd.com>
+Signed-off-by: Wayne Lin <wayne.lin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 640d010b52bec..eb71721dfb715 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2068,6 +2068,18 @@ enum dc_status dc_commit_streams(struct dc *dc,
+ 		goto fail;
+ 	}
+ 
++	/*
++	 * If not already seamless, make transition seamless by inserting intermediate minimal transition
++	 */
++	if (dc->hwss.is_pipe_topology_transition_seamless &&
++			!dc->hwss.is_pipe_topology_transition_seamless(dc, dc->current_state, context)) {
++		res = commit_minimal_transition_state(dc, context);
++		if (res != DC_OK) {
++			BREAK_TO_DEBUGGER();
++			goto fail;
++		}
++	}
++
+ 	res = dc_commit_state_no_check(dc, context);
+ 
+ 	for (i = 0; i < stream_count; i++) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-fix-dvi-d-hdmi-adapters.patch b/queue-6.6/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
new file mode 100644
index 0000000000..1be1aff033
--- /dev/null
+++ b/queue-6.6/drm-amd-display-fix-dvi-d-hdmi-adapters.patch
@@ -0,0 +1,57 @@
+From 7e7f69f6a62a934e97296b4d48210de275b6b01a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 23:33:33 +0200
+Subject: drm/amd/display: Fix DVI-D/HDMI adapters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 489f0f600ce2c0dae640df9035e1d82677d2580f ]
+
+When the EDID has the HDMI bit, we should simply select
+the HDMI signal type even on DVI ports.
+
+For reference see, the legacy amdgpu display code:
+amdgpu_atombios_encoder_get_encoder_mode
+which selects ATOM_ENCODER_MODE_HDMI for the same case.
+
+This commit fixes DVI connectors to work with DVI-D/HDMI
+adapters so that they can now produce output over these
+connectors for HDMI monitors with higher bandwidth modes.
+With this change, even HDMI audio works through DVI.
+
+For testing, I used a CAA-DMDHFD3 DVI-D/HDMI adapter
+with the following GPUs:
+
+Tahiti (DCE 6) - DC can now output 4K 30 Hz over DVI
+Polaris 10 (DCE 11.2) - DC can now output 4K 60 Hz over DVI
+
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/link_detection.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/link_detection.c b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+index c7a9e286a5d4d..978e09284da0e 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/link_detection.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_detection.c
+@@ -1113,6 +1113,10 @@ static bool detect_link_and_local_sink(struct dc_link *link,
+ 		if (sink->sink_signal == SIGNAL_TYPE_HDMI_TYPE_A &&
+ 		    !sink->edid_caps.edid_hdmi)
+ 			sink->sink_signal = SIGNAL_TYPE_DVI_SINGLE_LINK;
++		else if (dc_is_dvi_signal(sink->sink_signal) &&
++			 aud_support->hdmi_audio_native &&
++			 sink->edid_caps.edid_hdmi)
++			sink->sink_signal = SIGNAL_TYPE_HDMI_TYPE_A;
+ 
+ 		if (link->local_sink && dc_is_dp_signal(sink_caps.signal))
+ 			dp_trace_init(link);
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch b/queue-6.6/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
new file mode 100644
index 0000000000..d20e313c8e
--- /dev/null
+++ b/queue-6.6/drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
@@ -0,0 +1,58 @@
+From 6c68ceb38923de8b0b172354601a5281b9da16bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Mar 2025 18:04:01 -0400
+Subject: drm/amd/display: Increase AUX Intra-Hop Done Max Wait Duration
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit e3419e1e44b87d4176fb98679a77301b1ca40f63 ]
+
+[WHY]
+In the worst case, AUX intra-hop done can take hundreds of milliseconds as
+each retimer in a link might have to wait a full AUX_RD_INTERVAL to send
+LT abort downstream.
+
+[HOW]
+Wait 300ms for each retimer in a link to allow time to propagate a LT abort
+without infinitely waiting on intra-hop done.
+For no-retimer case, keep the max duration at 10ms.
+
+Reviewed-by: Wenjing Liu <wenjing.liu@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/link/protocols/link_dp_training.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+index 51e88efee11e4..08c2f11724140 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+@@ -974,14 +974,19 @@ void repeater_training_done(struct dc_link *link, uint32_t offset)
+ static void dpcd_exit_training_mode(struct dc_link *link, enum dp_link_encoding encoding)
+ {
+ 	uint8_t sink_status = 0;
+-	uint8_t i;
++	uint32_t i;
++	uint8_t lttpr_count = dp_parse_lttpr_repeater_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt);
++	uint32_t intra_hop_disable_time_ms = (lttpr_count > 0 ? lttpr_count * 300 : 10);
++
++	// Each hop could theoretically take over 256ms (max 128b/132b AUX RD INTERVAL)
++	// To be safe, allow 300ms per LTTPR and 10ms for no LTTPR case
+ 
+ 	/* clear training pattern set */
+ 	dpcd_set_training_pattern(link, DP_TRAINING_PATTERN_VIDEOIDLE);
+ 
+ 	if (encoding == DP_128b_132b_ENCODING) {
+ 		/* poll for intra-hop disable */
+-		for (i = 0; i < 10; i++) {
++		for (i = 0; i < intra_hop_disable_time_ms; i++) {
+ 			if ((core_link_read_dpcd(link, DP_SINK_STATUS, &sink_status, 1) == DC_OK) &&
+ 					(sink_status & DP_INTRA_HOP_AUX_REPLY_INDICATION) == 0)
+ 				break;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch b/queue-6.6/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
new file mode 100644
index 0000000000..5a5c505aca
--- /dev/null
+++ b/queue-6.6/drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
@@ -0,0 +1,123 @@
+From c809ac4d194fe3ee0dcc85c2a354c3b83d3a48ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 11:51:42 +0800
+Subject: drm/amd/display: update dpp/disp clock from smu clock table
+
+From: Paul Hsieh <Paul.Hsieh@amd.com>
+
+[ Upstream commit 2e72fdba8a32ce062a86571edff4592710c26215 ]
+
+[Why]
+The reason some high-resolution monitors fail to display properly
+is that this platform does not support sufficiently high DPP and
+DISP clock frequencies
+
+[How]
+Update DISP and DPP clocks from the smu clock table then DML can
+filter these mode if not support.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Paul Hsieh <Paul.Hsieh@amd.com>
+Signed-off-by: Roman Li <roman.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../display/dc/clk_mgr/dcn301/vg_clk_mgr.c    | 16 +++++++++++++++
+ .../amd/display/dc/dml/dcn301/dcn301_fpu.c    | 20 ++++++++++++++++---
+ 2 files changed, 33 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+index a5489fe6875f4..086f60e1dd173 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn301/vg_clk_mgr.c
+@@ -561,6 +561,7 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ {
+ 	int i, j;
+ 	struct clk_bw_params *bw_params = clk_mgr->base.bw_params;
++	uint32_t max_dispclk = 0, max_dppclk = 0;
+ 
+ 	j = -1;
+ 
+@@ -581,6 +582,15 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		return;
+ 	}
+ 
++	/* dispclk and dppclk can be max at any voltage, same number of levels for both */
++	if (clock_table->NumDispClkLevelsEnabled <= VG_NUM_DISPCLK_DPM_LEVELS &&
++	    clock_table->NumDispClkLevelsEnabled <= VG_NUM_DPPCLK_DPM_LEVELS) {
++		max_dispclk = find_max_clk_value(clock_table->DispClocks, clock_table->NumDispClkLevelsEnabled);
++		max_dppclk = find_max_clk_value(clock_table->DppClocks, clock_table->NumDispClkLevelsEnabled);
++	} else {
++		ASSERT(0);
++	}
++
+ 	bw_params->clk_table.num_entries = j + 1;
+ 
+ 	for (i = 0; i < bw_params->clk_table.num_entries - 1; i++, j--) {
+@@ -588,11 +598,17 @@ static void vg_clk_mgr_helper_populate_bw_params(
+ 		bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 		bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 		bw_params->clk_table.entries[i].dcfclk_mhz = find_dcfclk_for_voltage(clock_table, clock_table->DfPstateTable[j].voltage);
++
++		/* Now update clocks we do read */
++		bw_params->clk_table.entries[i].dispclk_mhz = max_dispclk;
++		bw_params->clk_table.entries[i].dppclk_mhz = max_dppclk;
+ 	}
+ 	bw_params->clk_table.entries[i].fclk_mhz = clock_table->DfPstateTable[j].fclk;
+ 	bw_params->clk_table.entries[i].memclk_mhz = clock_table->DfPstateTable[j].memclk;
+ 	bw_params->clk_table.entries[i].voltage = clock_table->DfPstateTable[j].voltage;
+ 	bw_params->clk_table.entries[i].dcfclk_mhz = find_max_clk_value(clock_table->DcfClocks, VG_NUM_DCFCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dispclk_mhz = find_max_clk_value(clock_table->DispClocks, VG_NUM_DISPCLK_DPM_LEVELS);
++	bw_params->clk_table.entries[i].dppclk_mhz = find_max_clk_value(clock_table->DppClocks, VG_NUM_DPPCLK_DPM_LEVELS);
+ 
+ 	bw_params->vram_type = bios_info->memory_type;
+ 	bw_params->num_channels = bios_info->ma_channel_number;
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+index 6ce90678b33c0..dc7435d5ef4df 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn301/dcn301_fpu.c
+@@ -326,7 +326,7 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
+ 	struct dcn301_resource_pool *pool = TO_DCN301_RES_POOL(dc->res_pool);
+ 	struct clk_limit_table *clk_table = &bw_params->clk_table;
+ 	unsigned int i, closest_clk_lvl;
+-	int j;
++	int j = 0, max_dispclk_mhz = 0, max_dppclk_mhz = 0;
+ 
+ 	dc_assert_fp_enabled();
+ 
+@@ -338,6 +338,15 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
+ 	dcn3_01_soc.num_chans = bw_params->num_channels;
+ 
+ 	ASSERT(clk_table->num_entries);
++
++	/* Prepass to find max clocks independent of voltage level. */
++	for (i = 0; i < clk_table->num_entries; ++i) {
++		if (clk_table->entries[i].dispclk_mhz > max_dispclk_mhz)
++			max_dispclk_mhz = clk_table->entries[i].dispclk_mhz;
++		if (clk_table->entries[i].dppclk_mhz > max_dppclk_mhz)
++			max_dppclk_mhz = clk_table->entries[i].dppclk_mhz;
++	}
++
+ 	for (i = 0; i < clk_table->num_entries; i++) {
+ 		/* loop backwards*/
+ 		for (closest_clk_lvl = 0, j = dcn3_01_soc.num_states - 1; j >= 0; j--) {
+@@ -353,8 +362,13 @@ void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_param
+ 		s[i].socclk_mhz = clk_table->entries[i].socclk_mhz;
+ 		s[i].dram_speed_mts = clk_table->entries[i].memclk_mhz * 2;
+ 
+-		s[i].dispclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
+-		s[i].dppclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++		/* Clocks independent of voltage level. */
++		s[i].dispclk_mhz = max_dispclk_mhz ? max_dispclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dispclk_mhz;
++
++		s[i].dppclk_mhz = max_dppclk_mhz ? max_dppclk_mhz :
++			dcn3_01_soc.clock_limits[closest_clk_lvl].dppclk_mhz;
++
+ 		s[i].dram_bw_per_chan_gbps =
+ 			dcn3_01_soc.clock_limits[closest_clk_lvl].dram_bw_per_chan_gbps;
+ 		s[i].dscclk_mhz = dcn3_01_soc.clock_limits[closest_clk_lvl].dscclk_mhz;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch b/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
new file mode 100644
index 0000000000..24bb67e56d
--- /dev/null
+++ b/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
@@ -0,0 +1,37 @@
+From b80c767b3c21d42d75047db53f7bfea32d42d88a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:15:45 +0530
+Subject: drm/amd/pm: Use cached metrics data on aldebaran
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit e87577ef6daa0cfb10ca139c720f0c57bd894174 ]
+
+Cached metrics data validity is 1ms on aldebaran. It's not reasonable
+for any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index b225617801499..d1fd643e7a48c 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1737,7 +1737,7 @@ static ssize_t aldebaran_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch b/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
new file mode 100644
index 0000000000..335e071d8e
--- /dev/null
+++ b/queue-6.6/drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
@@ -0,0 +1,37 @@
+From b1f7aeb04c14fc7525dbb5f1f9df96a7530cf498 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jul 2025 12:18:04 +0530
+Subject: drm/amd/pm: Use cached metrics data on arcturus
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
+
+Cached metrics data validity is 1ms on arcturus. It's not reasonable for
+any client to query gpu_metrics at a faster rate and constantly
+interrupt PMFW.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index 0cdf3257b19b3..a47898487de09 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2376,7 +2376,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
+ 
+ 	ret = smu_cmn_get_metrics_table(smu,
+ 					&metrics,
+-					true);
++					false);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch b/queue-6.6/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
new file mode 100644
index 0000000000..10fca8f83e
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
@@ -0,0 +1,44 @@
+From 0d13462fca2a9cad683f9ebcc391421549b760eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:21:16 -0400
+Subject: drm/amdgpu: add support for cyan skillfish gpu_info
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit fa819e3a7c1ee994ce014cc5a991c7fd91bc00f1 ]
+
+Some SOCs which are part of the cyan skillfish family
+rely on an explicit firmware for IP discovery.  Add support
+for the gpu_info firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 200b59318759d..475d93d4a40bf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -93,6 +93,7 @@ MODULE_FIRMWARE("amdgpu/picasso_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/raven2_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/arcturus_gpu_info.bin");
+ MODULE_FIRMWARE("amdgpu/navi12_gpu_info.bin");
++MODULE_FIRMWARE("amdgpu/cyan_skillfish_gpu_info.bin");
+ 
+ #define AMDGPU_RESUME_MS		2000
+ #define AMDGPU_MAX_RETRY_LIMIT		2
+@@ -1939,6 +1940,9 @@ static int amdgpu_device_parse_gpu_info_fw(struct amdgpu_device *adev)
+ 	case CHIP_NAVI12:
+ 		chip_name = "navi12";
+ 		break;
++	case CHIP_CYAN_SKILLFISH:
++		chip_name = "cyan_skillfish";
++		break;
+ 	}
+ 
+ 	snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_gpu_info.bin", chip_name);
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch b/queue-6.6/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
new file mode 100644
index 0000000000..ea95337473
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
@@ -0,0 +1,40 @@
+From b95f9d072c0ef246e917ac0a80a04da1cdec20b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 10:01:32 -0500
+Subject: drm/amdgpu: Allow kfd CRIU with no buffer objects
+
+From: David Francis <David.Francis@amd.com>
+
+[ Upstream commit 85705b18ae7674347f8675f64b2b3115fb1d5629 ]
+
+The kfd CRIU checkpoint ioctl would return an error if trying
+to checkpoint a process with no kfd buffer objects.
+
+This is a normal case and should not be an error.
+
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: David Francis <David.Francis@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 76196ab75475e..2e194aa608489 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -2572,8 +2572,8 @@ static int criu_restore(struct file *filep,
+ 	pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
+ 		 args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
+ 
+-	if (!args->bos || !args->devices || !args->priv_data || !args->priv_data_size ||
+-	    !args->num_devices || !args->num_bos)
++	if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
++	    !args->priv_data_size || !args->num_devices)
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&p->mutex);
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch b/queue-6.6/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
new file mode 100644
index 0000000000..70811d10ad
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
@@ -0,0 +1,42 @@
+From b195e97c195122177770ccae1102b1d3f4de04bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jun 2025 10:25:09 -0400
+Subject: drm/amdgpu: don't enable SMU on cyan skillfish
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 94bd7bf2c920998b4c756bc8a54fd3dbdf7e4360 ]
+
+Cyan skillfish uses different SMU firmware.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index b04d789bfd100..2e492f779b54c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -1819,13 +1819,16 @@ static int amdgpu_discovery_set_smu_ip_blocks(struct amdgpu_device *adev)
+ 	case IP_VERSION(11, 0, 5):
+ 	case IP_VERSION(11, 0, 9):
+ 	case IP_VERSION(11, 0, 7):
+-	case IP_VERSION(11, 0, 8):
+ 	case IP_VERSION(11, 0, 11):
+ 	case IP_VERSION(11, 0, 12):
+ 	case IP_VERSION(11, 0, 13):
+ 	case IP_VERSION(11, 5, 0):
+ 		amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
+ 		break;
++	case IP_VERSION(11, 0, 8):
++		if (adev->apu_flags & AMD_APU_IS_CYAN_SKILLFISH2)
++			amdgpu_device_ip_block_add(adev, &smu_v11_0_ip_block);
++		break;
+ 	case IP_VERSION(12, 0, 0):
+ 	case IP_VERSION(12, 0, 1):
+ 		amdgpu_device_ip_block_add(adev, &smu_v12_0_ip_block);
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch b/queue-6.6/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
new file mode 100644
index 0000000000..255ed32af7
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
@@ -0,0 +1,42 @@
+From 8ef3367b8f980b07ecc337f5bb8007815b13c803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Aug 2025 21:28:25 +0530
+Subject: drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
+
+From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+
+[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
+
+Acquire jpeg_pg_lock before changes to jpeg power state
+and release it after power off from idle work handler.
+
+Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+index 2ff2897fd1db6..cd8fa1164d540 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
+ 			fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec[j]);
+ 	}
+ 
+-	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
++	if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
++		mutex_lock(&adev->jpeg.jpeg_pg_lock);
+ 		amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
+ 						       AMD_PG_STATE_GATE);
+-	else
++		mutex_unlock(&adev->jpeg.jpeg_pg_lock);
++	} else
+ 		schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-reject-gang-submissions-under-sriov.patch b/queue-6.6/drm-amdgpu-reject-gang-submissions-under-sriov.patch
new file mode 100644
index 0000000000..805fb584db
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-reject-gang-submissions-under-sriov.patch
@@ -0,0 +1,52 @@
+From 37ebb4cf9accb6fb4880c0c141d3a68a2e0781d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 13:14:43 +0200
+Subject: drm/amdgpu: reject gang submissions under SRIOV
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit d7ddcf921e7d0d8ebe82e89635bc9dc26ba9540d ]
+
+Gang submission means that the kernel driver guarantees that multiple
+submissions are executed on the HW at the same time on different engines.
+
+Background is that those submissions then depend on each other and each
+can't finish stand alone.
+
+SRIOV now uses world switch to preempt submissions on the engines to allow
+sharing the HW resources between multiple VFs.
+
+The problem is now that the SRIOV world switch can't know about such inter
+dependencies and will cause a timeout if it waits for a partially running
+gang submission.
+
+To conclude SRIOV and gang submissions are fundamentally incompatible at
+the moment. For now just disable them.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 958034bc3b6d5..5b4d7fe148586 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -286,7 +286,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
+ 		}
+ 	}
+ 
+-	if (!p->gang_size) {
++	if (!p->gang_size || (amdgpu_sriov_vf(p->adev) && p->gang_size > 1)) {
+ 		ret = -EINVAL;
+ 		goto free_all_kdata;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch b/queue-6.6/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
new file mode 100644
index 0000000000..496e13f6cb
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
@@ -0,0 +1,114 @@
+From 3b97ebf82f013ba5182095c9413c1e8884413142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 16:50:36 +0200
+Subject: drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timur Kristóf <timur.kristof@gmail.com>
+
+[ Upstream commit 585b2f685c56c5095cc22c7202bf74d8e9a73cdd ]
+
+Update the legacy (non-DC) display code to respect the maximum
+pixel clock for HDMI and DVI-D. Reject modes that would require
+a higher pixel clock than can be supported.
+
+Also update the maximum supported HDMI clock value depending on
+the ASIC type.
+
+For reference, see the DC code:
+check max_hdmi_pixel_clock in dce*_resource.c
+
+v2:
+Fix maximum clocks for DVI-D and DVI/HDMI adapters.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/amdgpu/amdgpu_connectors.c    | 57 ++++++++++++++-----
+ 1 file changed, 44 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+index d34037b85cf85..eb20018b61e47 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+@@ -1205,29 +1205,60 @@ static void amdgpu_connector_dvi_force(struct drm_connector *connector)
+ 		amdgpu_connector->use_digital = true;
+ }
+ 
++/**
++ * Returns the maximum supported HDMI (TMDS) pixel clock in KHz.
++ */
++static int amdgpu_max_hdmi_pixel_clock(const struct amdgpu_device *adev)
++{
++	if (adev->asic_type >= CHIP_POLARIS10)
++		return 600000;
++	else if (adev->asic_type >= CHIP_TONGA)
++		return 300000;
++	else
++		return 297000;
++}
++
++/**
++ * Validates the given display mode on DVI and HDMI connectors,
++ * including analog signals on DVI-I.
++ */
+ static enum drm_mode_status amdgpu_connector_dvi_mode_valid(struct drm_connector *connector,
+ 					    struct drm_display_mode *mode)
+ {
+ 	struct drm_device *dev = connector->dev;
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	struct amdgpu_connector *amdgpu_connector = to_amdgpu_connector(connector);
++	const int max_hdmi_pixel_clock = amdgpu_max_hdmi_pixel_clock(adev);
++	const int max_dvi_single_link_pixel_clock = 165000;
++	int max_digital_pixel_clock_khz;
+ 
+ 	/* XXX check mode bandwidth */
+ 
+-	if (amdgpu_connector->use_digital && (mode->clock > 165000)) {
+-		if ((amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D) ||
+-		    (amdgpu_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B)) {
+-			return MODE_OK;
+-		} else if (connector->display_info.is_hdmi) {
+-			/* HDMI 1.3+ supports max clock of 340 Mhz */
+-			if (mode->clock > 340000)
+-				return MODE_CLOCK_HIGH;
+-			else
+-				return MODE_OK;
+-		} else {
+-			return MODE_CLOCK_HIGH;
++	if (amdgpu_connector->use_digital) {
++		switch (amdgpu_connector->connector_object_id) {
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_A:
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_D:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock;
++			break;
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I:
++		case CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_D:
++		case CONNECTOR_OBJECT_ID_HDMI_TYPE_B:
++			max_digital_pixel_clock_khz = max_dvi_single_link_pixel_clock * 2;
++			break;
+ 		}
++
++		/* When the display EDID claims that it's an HDMI display,
++		 * we use the HDMI encoder mode of the display HW,
++		 * so we should verify against the max HDMI clock here.
++		 */
++		if (connector->display_info.is_hdmi)
++			max_digital_pixel_clock_khz = max_hdmi_pixel_clock;
++
++		if (mode->clock > max_digital_pixel_clock_khz)
++			return MODE_CLOCK_HIGH;
+ 	}
+ 
+ 	/* check against the max pixel clock */
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch b/queue-6.6/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
new file mode 100644
index 0000000000..2f3a52c264
--- /dev/null
+++ b/queue-6.6/drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
@@ -0,0 +1,64 @@
+From 66833766f3cb984c7da3e22115a18eb1d6aa921d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jun 2025 11:44:27 +0100
+Subject: drm/amdgpu: Use memdup_array_user in amdgpu_cs_wait_fences_ioctl
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+[ Upstream commit dea75df7afe14d6217576dbc28cc3ec1d1f712fb ]
+
+Replace kmalloc_array() + copy_from_user() with memdup_array_user().
+
+This shrinks the source code and improves separation between the kernel
+and userspace slabs.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index 13c97ba7a820b..958034bc3b6d5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1732,30 +1732,21 @@ int amdgpu_cs_wait_fences_ioctl(struct drm_device *dev, void *data,
+ {
+ 	struct amdgpu_device *adev = drm_to_adev(dev);
+ 	union drm_amdgpu_wait_fences *wait = data;
+-	uint32_t fence_count = wait->in.fence_count;
+-	struct drm_amdgpu_fence *fences_user;
+ 	struct drm_amdgpu_fence *fences;
+ 	int r;
+ 
+ 	/* Get the fences from userspace */
+-	fences = kmalloc_array(fence_count, sizeof(struct drm_amdgpu_fence),
+-			GFP_KERNEL);
+-	if (fences == NULL)
+-		return -ENOMEM;
+-
+-	fences_user = u64_to_user_ptr(wait->in.fences);
+-	if (copy_from_user(fences, fences_user,
+-		sizeof(struct drm_amdgpu_fence) * fence_count)) {
+-		r = -EFAULT;
+-		goto err_free_fences;
+-	}
++	fences = memdup_array_user(u64_to_user_ptr(wait->in.fences),
++				   wait->in.fence_count,
++				   sizeof(struct drm_amdgpu_fence));
++	if (IS_ERR(fences))
++		return PTR_ERR(fences);
+ 
+ 	if (wait->in.wait_all)
+ 		r = amdgpu_cs_wait_all_fences(adev, filp, wait, fences);
+ 	else
+ 		r = amdgpu_cs_wait_any_fence(adev, filp, wait, fences);
+ 
+-err_free_fences:
+ 	kfree(fences);
+ 
+ 	return r;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch b/queue-6.6/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
new file mode 100644
index 0000000000..7a7121fb53
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
@@ -0,0 +1,43 @@
+From da23526b751df58e4155621f6383d21450535a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 14:22:53 -0400
+Subject: drm/amdkfd: fix vram allocation failure for a special case
+
+From: Eric Huang <jinhuieric.huang@amd.com>
+
+[ Upstream commit 93aa919ca05bec544b17ee9a1bfe394ce6c94bd8 ]
+
+When it only allocates vram without va, which is 0, and a
+SVM range allocated stays in this range, the vram allocation
+returns failure. It should be skipped for this case from
+SVM usage check.
+
+Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index f77324a5e9584..76196ab75475e 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -1085,7 +1085,12 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
+ 	svm_range_list_lock_and_flush_work(&p->svms, current->mm);
+ 	mutex_lock(&p->svms.lock);
+ 	mmap_write_unlock(current->mm);
+-	if (interval_tree_iter_first(&p->svms.objects,
++
++	/* Skip a special case that allocates VRAM without VA,
++	 * VA will be invalid of 0.
++	 */
++	if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
++	    interval_tree_iter_first(&p->svms.objects,
+ 				     args->va_addr >> PAGE_SHIFT,
+ 				     (args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
+ 		pr_err("Address: 0x%llx already allocated by SVM\n",
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch b/queue-6.6/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
new file mode 100644
index 0000000000..116795fce3
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
@@ -0,0 +1,67 @@
+From 758001a28f4aa11e7fc4d6b20d9092f35f158ff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Jul 2025 14:06:36 -0400
+Subject: drm/amdkfd: Handle lack of READ permissions in SVM mapping
+
+From: Kent Russell <kent.russell@amd.com>
+
+[ Upstream commit 0ed704d058cec7643a716a21888d58c7d03f2c3e ]
+
+HMM assumes that pages have READ permissions by default. Inside
+svm_range_validate_and_map, we add READ permissions then add WRITE
+permissions if the VMA isn't read-only. This will conflict with regions
+that only have PROT_WRITE or have PROT_NONE. When that happens,
+svm_range_restore_work will continue to retry, silently, giving the
+impression of a hang if pr_debug isn't enabled to show the retries..
+
+If pages don't have READ permissions, simply unmap them and continue. If
+they weren't mapped in the first place, this would be a no-op. Since x86
+doesn't support write-only, and PROT_NONE doesn't allow reads or writes
+anyways, this will allow the svm range validation to continue without
+getting stuck in a loop forever on mappings we can't use with HMM.
+
+Signed-off-by: Kent Russell <kent.russell@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+index 3168d6fb11e76..9ba9732f0172a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+@@ -1709,6 +1709,29 @@ static int svm_range_validate_and_map(struct mm_struct *mm,
+ 
+ 			next = min(vma->vm_end, end);
+ 			npages = (next - addr) >> PAGE_SHIFT;
++			/* HMM requires at least READ permissions. If provided with PROT_NONE,
++			 * unmap the memory. If it's not already mapped, this is a no-op
++			 * If PROT_WRITE is provided without READ, warn first then unmap
++			 */
++			if (!(vma->vm_flags & VM_READ)) {
++				unsigned long e, s;
++
++				svm_range_lock(prange);
++				if (vma->vm_flags & VM_WRITE)
++					pr_debug("VM_WRITE without VM_READ is not supported");
++				s = max(start, prange->start);
++				e = min(end, prange->last);
++				if (e >= s)
++					r = svm_range_unmap_from_gpus(prange, s, e,
++						       KFD_SVM_UNMAP_TRIGGER_UNMAP_FROM_CPU);
++				svm_range_unlock(prange);
++				/* If unmap returns non-zero, we'll bail on the next for loop
++				 * iteration, so just leave r and continue
++				 */
++				addr = next;
++				continue;
++			}
++
+ 			WRITE_ONCE(p->svms.faulting_task, current);
+ 			r = amdgpu_hmm_range_get_pages(&prange->notifier, addr, npages,
+ 						       readonly, owner, NULL,
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch b/queue-6.6/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
new file mode 100644
index 0000000000..9252f7bb9f
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
@@ -0,0 +1,53 @@
+From 6ea1ef74878f521b9b27d2af640b4abf38cacd81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 13:53:40 +1000
+Subject: drm/amdkfd: return -ENOTTY for unsupported IOCTLs
+
+From: Geoffrey McRae <geoffrey.mcrae@amd.com>
+
+[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
+
+Some kfd ioctls may not be available depending on the kernel version the
+user is running, as such we need to report -ENOTTY so userland can
+determine the cause of the ioctl failure.
+
+Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+index 35dc926f234e3..f77324a5e9584 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+@@ -3252,8 +3252,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 	int retcode = -EINVAL;
+ 	bool ptrace_attached = false;
+ 
+-	if (nr >= AMDKFD_CORE_IOCTL_COUNT)
++	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
+ 		u32 amdkfd_size;
+@@ -3266,8 +3268,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
+ 			asize = amdkfd_size;
+ 
+ 		cmd = ioctl->cmd;
+-	} else
++	} else {
++		retcode = -ENOTTY;
+ 		goto err_i1;
++	}
+ 
+ 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch b/queue-6.6/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
new file mode 100644
index 0000000000..32341e1743
--- /dev/null
+++ b/queue-6.6/drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
@@ -0,0 +1,48 @@
+From 5a94492dbfec598ac73907d44b68e9e28177d81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:04:15 -0400
+Subject: drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
+
+From: Amber Lin <Amber.Lin@amd.com>
+
+[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
+
+When KFD asks CP to preempt queues, other than preempt CP queues, CP
+also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
+Currently queue_preemption_timeout_ms is 9000 ms by default but can be
+configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
+4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
+queue_preemption_timeout_ms so in a slow system such as emulator, both
+CP and SDMA slowness are taken into account.
+
+Signed-off-by: Amber Lin <Amber.Lin@amd.com>
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 27c9d5c43765a..b475c2ab9768a 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -111,7 +111,14 @@
+ 
+ #define KFD_KERNEL_QUEUE_SIZE 2048
+ 
+-#define KFD_UNMAP_LATENCY_MS	(4000)
++/*  KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
++ *  can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
++ *  driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
++ *  queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
++ *  The format here makes CP workload 10% of total timeout
++ */
++#define KFD_UNMAP_LATENCY_MS	\
++	((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
+ 
+ #define KFD_MAX_SDMA_QUEUES	128
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch b/queue-6.6/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
new file mode 100644
index 0000000000..99c8062288
--- /dev/null
+++ b/queue-6.6/drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
@@ -0,0 +1,44 @@
+From 24e4c096a8b3b230acc2e98fc4867609c6fb2d55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:21 +0300
+Subject: drm/bridge: cdns-dsi: Don't fail on MIPI_DSI_MODE_VIDEO_BURST
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 7070f55f294745c5a3c033623b76309f3512be67 ]
+
+While the cdns-dsi does not support DSI burst mode, the burst mode is
+essentially DSI event mode with more versatile clocking and timings.
+Thus cdns-dsi doesn't need to fail if the DSI peripheral driver requests
+MIPI_DSI_MODE_VIDEO_BURST.
+
+In my particular use case, this allows the use of ti-sn65dsi83 driver.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-15-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index faa0bdfd19370..ddfbb2009c8d3 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -959,10 +959,6 @@ static int cdns_dsi_attach(struct mipi_dsi_host *host,
+ 	if (output->dev)
+ 		return -EBUSY;
+ 
+-	/* We do not support burst mode yet. */
+-	if (dev->mode_flags & MIPI_DSI_MODE_VIDEO_BURST)
+-		return -ENOTSUPP;
+-
+ 	/*
+ 	 * The host <-> device link might be described using an OF-graph
+ 	 * representation, in this case we extract the device of_node from
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch b/queue-6.6/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
new file mode 100644
index 0000000000..389be7f424
--- /dev/null
+++ b/queue-6.6/drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
@@ -0,0 +1,58 @@
+From 27d287e896e47288d0cd62452b6b7b78fc4c84be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:17 +0300
+Subject: drm/bridge: cdns-dsi: Fix REG_WAKEUP_TIME value
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit eea4f89b6461294ed6bea1d3285bb3f79c09a041 ]
+
+The driver tries to calculate the value for REG_WAKEUP_TIME. However,
+the calculation itself is not correct, and to add on it, the resulting
+value is almost always larger than the field's size, so the actual
+result is more or less random.
+
+According to the docs, figuring out the value for REG_WAKEUP_TIME
+requires HW characterization and there's no way to have a generic
+algorithm to come up with the value. That doesn't help at all...
+
+However, we know that the value must be smaller than the line time, and,
+at least in my understanding, the proper value for it is quite small.
+Testing shows that setting it to 1/10 of the line time seems to work
+well. All video modes from my HDMI monitor work with this algorithm.
+
+Hopefully we'll get more information on how to calculate the value, and
+we can then update this.
+
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-11-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+index 89eed0668bfb2..faa0bdfd19370 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+@@ -833,7 +833,13 @@ static void cdns_dsi_bridge_enable(struct drm_bridge *bridge)
+ 
+ 	tx_byte_period = DIV_ROUND_DOWN_ULL((u64)NSEC_PER_SEC * 8,
+ 					    phy_cfg->hs_clk_rate);
+-	reg_wakeup = (phy_cfg->hs_prepare + phy_cfg->hs_zero) / tx_byte_period;
++
++	/*
++	 * Estimated time [in clock cycles] to perform LP->HS on D-PHY.
++	 * It is not clear how to calculate this, so for now,
++	 * set it to 1/10 of the total number of clocks in a line.
++	 */
++	reg_wakeup = dsi_cfg.htotal / nlanes / 10;
+ 	writel(REG_WAKEUP_TIME(reg_wakeup) | REG_LINE_DURATION(tmp),
+ 	       dsi->regs + VID_DPHY_TIME);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-bridge-display-connector-don-t-set-op_detect-for.patch b/queue-6.6/drm-bridge-display-connector-don-t-set-op_detect-for.patch
new file mode 100644
index 0000000000..b03a4fc492
--- /dev/null
+++ b/queue-6.6/drm-bridge-display-connector-don-t-set-op_detect-for.patch
@@ -0,0 +1,51 @@
+From bca0409db739a4ce99c8f8d35eb73dee62b8f1ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Aug 2025 13:40:35 +0300
+Subject: drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
+
+From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+
+[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
+
+Detecting the monitor for DisplayPort targets is more complicated than
+just reading the HPD pin level: it requires reading the DPCD in order to
+check what kind of device is attached to the port and whether there is
+an actual display attached.
+
+In order to let DRM framework handle such configurations, disable
+DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
+driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
+it is valid for the bridge to report HPD events.
+
+Currently inside the kernel there are only two targets which list
+hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
+arm64/qcom/sa8295p-adp. Both should be fine with this change.
+
+Cc: Bjorn Andersson <andersson@kernel.org>
+Cc: Konrad Dybcio <konradybcio@kernel.org>
+Cc: linux-arm-msm@vger.kernel.org
+Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/display-connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
+index 08bd5695ddae0..0f3714aae6089 100644
+--- a/drivers/gpu/drm/bridge/display-connector.c
++++ b/drivers/gpu/drm/bridge/display-connector.c
+@@ -363,7 +363,8 @@ static int display_connector_probe(struct platform_device *pdev)
+ 	if (conn->bridge.ddc)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_EDID
+ 				 |  DRM_BRIDGE_OP_DETECT;
+-	if (conn->hpd_gpio)
++	/* Detecting the monitor requires reading DPCD */
++	if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
+ 	if (conn->hpd_irq >= 0)
+ 		conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch b/queue-6.6/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
new file mode 100644
index 0000000000..acfccc7ac2
--- /dev/null
+++ b/queue-6.6/drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
@@ -0,0 +1,44 @@
+From f73d559237a53644037f510a60c5b510cd678629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:44 +0200
+Subject: drm/msm/dsi/phy: Toggle back buffer resync after preparing PLL
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b63f008f395ca5f6bc89123db97440bdc19981c4 ]
+
+According to Hardware Programming Guide for DSI PHY, the retime buffer
+resync should be done after PLL clock users (byte_clk and intf_byte_clk)
+are enabled.  Downstream also does it as part of configuring the PLL.
+
+Driver was only turning off the resync FIFO buffer, but never bringing it
+on again.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657823/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-6-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index f72ce6a3c456d..47ee2fd569db4 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -445,6 +445,10 @@ static int dsi_pll_7nm_vco_prepare(struct clk_hw *hw)
+ 	if (pll_7nm->slave)
+ 		dsi_pll_enable_global_clk(pll_7nm->slave);
+ 
++	writel(0x1, pll_7nm->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++	if (pll_7nm->slave)
++		writel(0x1, pll_7nm->slave->phy->base + REG_DSI_7nm_PHY_CMN_RBUF_CTRL);
++
+ error:
+ 	return rc;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch b/queue-6.6/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
new file mode 100644
index 0000000000..17bc8bd4c1
--- /dev/null
+++ b/queue-6.6/drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
@@ -0,0 +1,54 @@
+From fb4a9a31cf82f397b2923bfdbadc3f477f430347 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Jun 2025 16:05:47 +0200
+Subject: drm/msm/dsi/phy_7nm: Fix missing initial VCO rate
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 5ddcb0cb9d10e6e70a68e0cb8f0b8e3a7eb8ccaf ]
+
+Driver unconditionally saves current state on first init in
+dsi_pll_7nm_init(), but does not save the VCO rate, only some of the
+divider registers.  The state is then restored during probe/enable via
+msm_dsi_phy_enable() -> msm_dsi_phy_pll_restore_state() ->
+dsi_7nm_pll_restore_state().
+
+Restoring calls dsi_pll_7nm_vco_set_rate() with
+pll_7nm->vco_current_rate=0, which basically overwrites existing rate of
+VCO and messes with clock hierarchy, by setting frequency to 0 to clock
+tree.  This makes anyway little sense - VCO rate was not saved, so
+should not be restored.
+
+If PLL was not configured configure it to minimum rate to avoid glitches
+and configuring entire in clock hierarchy to 0 Hz.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/657827/
+Link: https://lore.kernel.org/r/20250610-b4-sm8750-display-v6-9-ee633e3ddbff@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+index 47ee2fd569db4..bed9867ced6d4 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_7nm.c
+@@ -797,6 +797,12 @@ static int dsi_pll_7nm_init(struct msm_dsi_phy *phy)
+ 
+ 	/* TODO: Remove this when we have proper display handover support */
+ 	msm_dsi_phy_pll_save_state(phy);
++	/*
++	 * Store also proper vco_current_rate, because its value will be used in
++	 * dsi_7nm_pll_restore_state().
++	 */
++	if (!dsi_pll_7nm_vco_recalc_rate(&pll_7nm->clk_hw, VCO_REF_CLK_RATE))
++		pll_7nm->vco_current_rate = pll_7nm->phy->cfg->min_pll_rate;
+ 
+ 	return 0;
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch b/queue-6.6/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
new file mode 100644
index 0000000000..0cd184bc7a
--- /dev/null
+++ b/queue-6.6/drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
@@ -0,0 +1,43 @@
+From 4847c8b27b406a8cb16f46a7a7c76d14dbb8289b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Aug 2025 15:06:34 +0200
+Subject: drm/msm: make sure to not queue up recovery more than once
+
+From: Antonino Maniscalco <antomani103@gmail.com>
+
+[ Upstream commit 10fb1b2fcaee5545a5e54db1ed4d7b15c2db50c8 ]
+
+If two fault IRQs arrive in short succession recovery work will be
+queued up twice.
+
+When recovery runs a second time it may end up killing an unrelated
+context.
+
+Prevent this by masking off interrupts when triggering recovery.
+
+Signed-off-by: Antonino Maniscalco <antomani103@gmail.com>
+Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/670023/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index 00bfc6f38f459..4654c0f362c7d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1702,6 +1702,9 @@ static void a6xx_fault_detect_irq(struct msm_gpu *gpu)
+ 	/* Turn off the hangcheck timer to keep it from bothering us */
+ 	del_timer(&gpu->hangcheck_timer);
+ 
++	/* Turn off interrupts to avoid triggering recovery again */
++	gpu_write(gpu, REG_A6XX_RBBM_INT_0_MASK, 0);
++
+ 	kthread_queue_work(gpu->worker, &gpu->recover_work);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch b/queue-6.6/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
new file mode 100644
index 0000000000..8250699037
--- /dev/null
+++ b/queue-6.6/drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
@@ -0,0 +1,41 @@
+From e624039eda03904988dee6318eeedd0c188f292a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 15:59:13 -0400
+Subject: drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
+
+From: Seyediman Seyedarab <imandevel@gmail.com>
+
+[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
+
+snprintf() returns the number of characters that *would* have been
+written, which can overestimate how much you actually wrote to the
+buffer in case of truncation. That leads to 'data += this' advancing
+the pointer past the end of the buffer and size going negative.
+
+Switching to scnprintf() prevents potential buffer overflows and ensures
+consistent behavior when building the output string.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+index b9581feb24ccb..a23b40b27b81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
+ 	bool space = false;
+ 	while (size >= 1 && bf->name) {
+ 		if (value & bf->mask) {
+-			int this = snprintf(data, size, "%s%s",
++			int this = scnprintf(data, size, "%s%s",
+ 					    space ? " " : "", bf->name);
+ 			size -= this;
+ 			data += this;
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch b/queue-6.6/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
new file mode 100644
index 0000000000..b05f84dfce
--- /dev/null
+++ b/queue-6.6/drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
@@ -0,0 +1,48 @@
+From 33e7fc263665cb3612c2579c1642aab983771b0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 13:34:02 +0530
+Subject: drm/tidss: Set crtc modesetting parameters with adjusted mode
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfb29225db20c56432a8525366321c0c09edfb2e ]
+
+TIDSS uses crtc_* fields to propagate its registers and set the
+clock rates. So set the CRTC modesetting timing parameters with
+the adjusted mode when needed, to set correct values.
+
+Cc: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Link: https://lore.kernel.org/r/20250624080402.302526-1-j-choudhary@ti.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index df177881b9d32..356b7566013b1 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -91,7 +91,7 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 	struct dispc_device *dispc = tidss->dispc;
+ 	struct tidss_crtc *tcrtc = to_tidss_crtc(crtc);
+ 	u32 hw_videoport = tcrtc->hw_videoport;
+-	const struct drm_display_mode *mode;
++	struct drm_display_mode *mode;
+ 	enum drm_mode_status ok;
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+@@ -108,6 +108,9 @@ static int tidss_crtc_atomic_check(struct drm_crtc *crtc,
+ 		return -EINVAL;
+ 	}
+ 
++	if (drm_atomic_crtc_needs_modeset(crtc_state))
++		drm_mode_set_crtcinfo(mode, 0);
++
+ 	return dispc_vp_bus_check(dispc, hw_videoport, crtc_state);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/drm-tidss-use-the-crtc_-timings-when-programming-the.patch b/queue-6.6/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
new file mode 100644
index 0000000000..31a4ade88c
--- /dev/null
+++ b/queue-6.6/drm-tidss-use-the-crtc_-timings-when-programming-the.patch
@@ -0,0 +1,76 @@
+From 7d35d2d4c4e87d39eed1a2625db71fdfd3a57e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 13:05:09 +0300
+Subject: drm/tidss: Use the crtc_* timings when programming the HW
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
+
+Use the crtc_* fields from drm_display_mode, instead of the "logical"
+fields. This shouldn't change anything in practice, but afaiu the crtc_*
+fields are the correct ones to use here.
+
+Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
+Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
+Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c  |  2 +-
+ drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 1baa4ace12e15..df177881b9d32 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -229,7 +229,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	tidss_runtime_get(tidss);
+ 
+ 	r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
+-				  mode->clock * 1000);
++				  mode->crtc_clock * 1000);
+ 	if (r != 0)
+ 		return;
+ 
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 355c64bafb82b..8a702f4059b95 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -1030,13 +1030,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 
+ 	dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
+ 
+-	hfp = mode->hsync_start - mode->hdisplay;
+-	hsw = mode->hsync_end - mode->hsync_start;
+-	hbp = mode->htotal - mode->hsync_end;
++	hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
++	hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
++	hbp = mode->crtc_htotal - mode->crtc_hsync_end;
+ 
+-	vfp = mode->vsync_start - mode->vdisplay;
+-	vsw = mode->vsync_end - mode->vsync_start;
+-	vbp = mode->vtotal - mode->vsync_end;
++	vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
++	vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
++	vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
+ 		       FLD_VAL(hsw - 1, 7, 0) |
+@@ -1078,8 +1078,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
+ 		       FLD_VAL(ivs, 12, 12));
+ 
+ 	dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
+-		       FLD_VAL(mode->hdisplay - 1, 11, 0) |
+-		       FLD_VAL(mode->vdisplay - 1, 27, 16));
++		       FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
++		       FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
+ 
+ 	VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch b/queue-6.6/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
new file mode 100644
index 0000000000..04c09884c5
--- /dev/null
+++ b/queue-6.6/eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
@@ -0,0 +1,44 @@
+From 2e18e798f4ebfc453be8324c39bc30c5c9fed482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 15:43:49 +0900
+Subject: eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
+
+From: Daniel Palmer <daniel@thingy.jp>
+
+[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
+
+When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
+and from there __pci_ioport_map() for the PCI IO space.
+If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
+m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
+always fail and the driver will complain it couldn't map the PIO space
+and return an error.
+
+NO_IOPORT_MAP seems to cover the case where what 8139too is trying
+to do cannot ever work so make 8139TOO_PIO depend on being it false
+and avoid creating an unusable driver.
+
+Signed-off-by: Daniel Palmer <daniel@thingy.jp>
+Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
+index 93d9df55b361a..01811924c4db4 100644
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -58,7 +58,7 @@ config 8139TOO
+ config 8139TOO_PIO
+ 	bool "Use PIO instead of MMIO"
+ 	default y
+-	depends on 8139TOO
++	depends on 8139TOO && !NO_IOPORT_MAP
+ 	help
+ 	  This instructs the driver to use programmed I/O ports (PIO) instead
+ 	  of PCI shared memory (MMIO).  This can possibly solve some problems
+-- 
+2.51.0
+
diff --git a/queue-6.6/ethernet-extend-device_get_mac_address-to-use-nvmem.patch b/queue-6.6/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
new file mode 100644
index 0000000000..79e3a11177
--- /dev/null
+++ b/queue-6.6/ethernet-extend-device_get_mac_address-to-use-nvmem.patch
@@ -0,0 +1,42 @@
+From 26616084e63bd653c938278e13dbdb375567592c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 16:03:32 +0200
+Subject: ethernet: Extend device_get_mac_address() to use NVMEM
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit d2d3f529e7b6ff2aa432b16a2317126621c28058 ]
+
+A lot of modern SoC have the ability to store MAC addresses in their
+NVMEM. So extend the generic function device_get_mac_address() to
+obtain the MAC address from an nvmem cell named 'mac-address' in
+case there is no firmware node which contains the MAC address directly.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250912140332.35395-3-wahrenst@gmx.net
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ethernet/eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index 049c3adeb8504..b4a6e26ec2871 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -615,7 +615,10 @@ EXPORT_SYMBOL(fwnode_get_mac_address);
+  */
+ int device_get_mac_address(struct device *dev, char *addr)
+ {
+-	return fwnode_get_mac_address(dev_fwnode(dev), addr);
++	if (!fwnode_get_mac_address(dev_fwnode(dev), addr))
++		return 0;
++
++	return nvmem_get_mac_address(dev, addr);
+ }
+ EXPORT_SYMBOL(device_get_mac_address);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/exfat-limit-log-print-for-io-error.patch b/queue-6.6/exfat-limit-log-print-for-io-error.patch
new file mode 100644
index 0000000000..eb88322524
--- /dev/null
+++ b/queue-6.6/exfat-limit-log-print-for-io-error.patch
@@ -0,0 +1,85 @@
+From a2f86e58c6e43bae5063be933ae6cfed1348da24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 17:32:45 +0800
+Subject: exfat: limit log print for IO error
+
+From: Chi Zhiling <chizhiling@kylinos.cn>
+
+[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
+
+For exFAT filesystems with 4MB read_ahead_size, removing the storage device
+when the read operation is in progress, which cause the last read syscall
+spent 150s [1]. The main reason is that exFAT generates excessive log
+messages [2].
+
+After applying this patch, approximately 300,000 lines of log messages
+were suppressed, and the delay of the last read() syscall was reduced
+to about 4 seconds.
+
+[1]:
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
+read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
+write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
+read(4, 0x7fccf28ae000, 131072)         = -1 EIO (Input/output error) <150.186215>
+
+[2]:
+[  333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+[  333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
+
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exfat/fatent.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
+index 407880901ee3f..e5f4ce8c38e1a 100644
+--- a/fs/exfat/fatent.c
++++ b/fs/exfat/fatent.c
+@@ -89,35 +89,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
+ 	int err;
+ 
+ 	if (!is_valid_cluster(sbi, loc)) {
+-		exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
++		exfat_fs_error_ratelimit(sb,
++			"invalid access to FAT (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	err = __exfat_ent_get(sb, loc, content);
+ 	if (err) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"failed to access to FAT (entry 0x%08x, err:%d)",
+ 			loc, err);
+ 		return err;
+ 	}
+ 
+ 	if (*content == EXFAT_FREE_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT free cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content == EXFAT_BAD_CLUSTER) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT bad cluster (entry 0x%08x)",
+ 			loc);
+ 		return -EIO;
+ 	}
+ 
+ 	if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
+-		exfat_fs_error(sb,
++		exfat_fs_error_ratelimit(sb,
+ 			"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
+ 			loc, *content);
+ 		return -EIO;
+-- 
+2.51.0
+
diff --git a/queue-6.6/ext4-increase-io-priority-of-fastcommit.patch b/queue-6.6/ext4-increase-io-priority-of-fastcommit.patch
new file mode 100644
index 0000000000..d0164e562f
--- /dev/null
+++ b/queue-6.6/ext4-increase-io-priority-of-fastcommit.patch
@@ -0,0 +1,50 @@
+From a5e4e11578a7acee91076bf197e5f7aef7ed7300 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:18:12 +0800
+Subject: ext4: increase IO priority of fastcommit
+
+From: Julian Sun <sunjunchao@bytedance.com>
+
+[ Upstream commit 46e75c56dfeafb6756773b71cabe187a6886859a ]
+
+The following code paths may result in high latency or even task hangs:
+   1. fastcommit io is throttled by wbt.
+   2. jbd2_fc_wait_bufs() might wait for a long time while
+JBD2_FAST_COMMIT_ONGOING is set in journal->flags, and then
+jbd2_journal_commit_transaction() waits for the
+JBD2_FAST_COMMIT_ONGOING bit for a long time while holding the write
+lock of j_state_lock.
+   3. start_this_handle() waits for read lock of j_state_lock which
+results in high latency or task hang.
+
+Given the fact that ext4_fc_commit() already modifies the current
+process' IO priority to match that of the jbd2 thread, it should be
+reasonable to match jbd2's IO submission flags as well.
+
+Suggested-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
+Reviewed-by: Zhang Yi <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Message-ID: <20250827121812.1477634-1-sunjunchao@bytedance.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/fast_commit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
+index b527f4ab47e02..62a6960242c5a 100644
+--- a/fs/ext4/fast_commit.c
++++ b/fs/ext4/fast_commit.c
+@@ -675,7 +675,7 @@ void ext4_fc_track_range(handle_t *handle, struct inode *inode, ext4_lblk_t star
+ 
+ static void ext4_fc_submit_bh(struct super_block *sb, bool is_tail)
+ {
+-	blk_opf_t write_flags = REQ_SYNC;
++	blk_opf_t write_flags = JBD2_JOURNAL_REQ_FLAGS;
+ 	struct buffer_head *bh = EXT4_SB(sb)->s_fc_bh;
+ 
+ 	/* Add REQ_FUA | REQ_PREFLUSH only its tail */
+-- 
+2.51.0
+
diff --git a/queue-6.6/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch b/queue-6.6/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
new file mode 100644
index 0000000000..70abb5eee8
--- /dev/null
+++ b/queue-6.6/extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
@@ -0,0 +1,37 @@
+From cedf64f7bfa8f67ce349eccfd92ddf45ff20a8d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 May 2025 16:33:21 +0200
+Subject: extcon: adc-jack: Fix wakeup source leaks on device unbind
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
+
+Device can be unbound, so driver must also release memory for the wakeup
+source.  Do not use devm interface, because it would change the order of
+cleanup.
+
+Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
+Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-adc-jack.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
+index 0317b614b6805..ea06cd4340525 100644
+--- a/drivers/extcon/extcon-adc-jack.c
++++ b/drivers/extcon/extcon-adc-jack.c
+@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
+ {
+ 	struct adc_jack_data *data = platform_get_drvdata(pdev);
+ 
++	device_init_wakeup(&pdev->dev, false);
+ 	free_irq(data->irq, data);
+ 	cancel_work_sync(&data->handler.work);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch b/queue-6.6/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
new file mode 100644
index 0000000000..ed5de7f95b
--- /dev/null
+++ b/queue-6.6/f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
@@ -0,0 +1,42 @@
+From 0f258e30ce3f638a9d151a4d8ed81db5047dee67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 10:36:22 +0800
+Subject: f2fs: fix infinite loop in __insert_extent_tree()
+
+From: wangzijie <wangzijie1@honor.com>
+
+[ Upstream commit 23361bd54966b437e1ed3eb1a704572f4b279e58 ]
+
+When we get wrong extent info data, and look up extent_node in rb tree,
+it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this by
+return NULL and print some kernel messages in that case.
+
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/extent_cache.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 6a77581106a9e..79d07c786f6ae 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -562,7 +562,13 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ 			p = &(*p)->rb_right;
+ 			leftmost = false;
+ 		} else {
++			f2fs_err_ratelimited(sbi, "%s: corrupted extent, type: %d, "
++				"extent node in rb tree [%u, %u, %u], age [%llu, %llu], "
++				"extent node to insert [%u, %u, %u], age [%llu, %llu]",
++				__func__, et->type, en->ei.fofs, en->ei.blk, en->ei.len, en->ei.age,
++				en->ei.last_blocks, ei->fofs, ei->blk, ei->len, ei->age, ei->last_blocks);
+ 			f2fs_bug_on(sbi, 1);
++			return NULL;
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch b/queue-6.6/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
new file mode 100644
index 0000000000..d2db441a53
--- /dev/null
+++ b/queue-6.6/fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
@@ -0,0 +1,34 @@
+From 4f5555a5aaf1dea12dfd03c7c304ebfab2d69a67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 10:28:49 +0800
+Subject: fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
+
+From: chuguangqing <chuguangqing@inspur.com>
+
+[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
+
+The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
+
+Signed-off-by: chuguangqing <chuguangqing@inspur.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/xattr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 66933e55efb3b..307081c994374 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1552,7 +1552,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
+ 	WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
+ 		     !(current->flags & PF_MEMALLOC_NOFS));
+ 
+-	ea_data = kvmalloc(value_len, GFP_KERNEL);
++	ea_data = kvmalloc(value_len, GFP_NOFS);
+ 	if (!ea_data) {
+ 		mb_cache_entry_put(ea_inode_cache, ce);
+ 		return NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.6/ftrace-fix-softlockup-in-ftrace_module_enable.patch b/queue-6.6/ftrace-fix-softlockup-in-ftrace_module_enable.patch
new file mode 100644
index 0000000000..e0fd386643
--- /dev/null
+++ b/queue-6.6/ftrace-fix-softlockup-in-ftrace_module_enable.patch
@@ -0,0 +1,44 @@
+From 88eead966d95d69f97eccce2daa91490c10414ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 13:28:55 +0200
+Subject: ftrace: Fix softlockup in ftrace_module_enable
+
+From: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+
+[ Upstream commit 4099b98203d6b33d990586542fa5beee408032a3 ]
+
+A soft lockup was observed when loading amdgpu module.
+If a module has a lot of tracable functions, multiple calls
+to kallsyms_lookup can spend too much time in RCU critical
+section and with disabled preemption, causing kernel panic.
+This is the same issue that was fixed in
+commit d0b24b4e91fc ("ftrace: Prevent RCU stall on PREEMPT_VOLUNTARY
+kernels") and commit 42ea22e754ba ("ftrace: Add cond_resched() to
+ftrace_graph_set_hash()").
+
+Fix it the same way by adding cond_resched() in ftrace_module_enable.
+
+Link: https://lore.kernel.org/aMQD9_lxYmphT-up@vova-pc
+Signed-off-by: Vladimir Riabchun <ferr.lambarginio@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 15785a729a0cd..398992597685b 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6873,6 +6873,8 @@ void ftrace_module_enable(struct module *mod)
+ 		if (!within_module(rec->ip, mod))
+ 			break;
+ 
++		cond_resched();
++
+ 		/* Weak functions should still be ignored */
+ 		if (!test_for_valid_rec(rec)) {
+ 			/* Clear all other flags. Should not be enabled anyway */
+-- 
+2.51.0
+
diff --git a/queue-6.6/fuse-zero-initialize-inode-private-data.patch b/queue-6.6/fuse-zero-initialize-inode-private-data.patch
new file mode 100644
index 0000000000..cd8756dd11
--- /dev/null
+++ b/queue-6.6/fuse-zero-initialize-inode-private-data.patch
@@ -0,0 +1,46 @@
+From 78001a329a1acb1469a446551de0ac709a8683bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Aug 2025 16:44:02 +0200
+Subject: fuse: zero initialize inode private data
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 3ca1b311181072415b6432a169de765ac2034e5a ]
+
+This is slightly tricky, since the VFS uses non-zeroing allocation to
+preserve some fields that are left in a consistent state.
+
+Reported-by: Chunsheng Luo <luochunsheng@ustc.edu>
+Closes: https://lore.kernel.org/all/20250818083224.229-1-luochunsheng@ustc.edu/
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/inode.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index 735abf426a064..96050028d91b0 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -94,14 +94,11 @@ static struct inode *fuse_alloc_inode(struct super_block *sb)
+ 	if (!fi)
+ 		return NULL;
+ 
+-	fi->i_time = 0;
++	/* Initialize private data (i.e. everything except fi->inode) */
++	BUILD_BUG_ON(offsetof(struct fuse_inode, inode) != 0);
++	memset((void *) fi + sizeof(fi->inode), 0, sizeof(*fi) - sizeof(fi->inode));
++
+ 	fi->inval_mask = ~0;
+-	fi->nodeid = 0;
+-	fi->nlookup = 0;
+-	fi->attr_version = 0;
+-	fi->orig_ino = 0;
+-	fi->state = 0;
+-	fi->submount_lookup = NULL;
+ 	mutex_init(&fi->mutex);
+ 	spin_lock_init(&fi->lock);
+ 	fi->forget = fuse_alloc_forget();
+-- 
+2.51.0
+
diff --git a/queue-6.6/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch b/queue-6.6/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
new file mode 100644
index 0000000000..76921a010b
--- /dev/null
+++ b/queue-6.6/hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
@@ -0,0 +1,65 @@
+From 20d440ff25660595abcdc12428980ac45582b69b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 15:01:51 +0200
+Subject: HID: asus: add Z13 folio to generic group for multitouch to work
+
+From: Antheas Kapenekakis <lkml@antheas.dev>
+
+[ Upstream commit b595974b4afe0e171dd707da570964ff642742e3 ]
+
+The Asus Z13 folio has a multitouch touchpad that needs to bind
+to the hid-multitouch driver in order to work properly. So bind
+it to the HID_GROUP_GENERIC group to release the touchpad and
+move it to the bottom so that the comment applies to it.
+
+While at it, change the generic KEYBOARD3 name to Z13_FOLIO.
+
+Reviewed-by: Luke D. Jones <luke@ljones.dev>
+Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-asus.c | 6 +++---
+ drivers/hid/hid-ids.h  | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
+index a8d440f6e804f..d971e339b5eac 100644
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1282,9 +1282,6 @@ static const struct hid_device_id asus_devices[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+-	    USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3),
+-	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 	    USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR),
+ 	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+@@ -1314,6 +1311,9 @@ static const struct hid_device_id asus_devices[] = {
+ 	 * Note bind to the HID_GROUP_GENERIC group, so that we only bind to the keyboard
+ 	 * part, while letting hid-multitouch.c handle the touchpad.
+ 	 */
++	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
++		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO),
++	  QUIRK_USE_KBD_BACKLIGHT | QUIRK_ROG_NKEY_KEYBOARD },
+ 	{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ 		USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_T101HA_KEYBOARD) },
+ 	{ }
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 3f74633070b6e..8de59d8a54580 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -213,7 +213,7 @@
+ #define USB_DEVICE_ID_ASUSTEK_ROG_KEYBOARD3 0x1822
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD	0x1866
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD2	0x19b6
+-#define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_KEYBOARD3	0x1a30
++#define USB_DEVICE_ID_ASUSTEK_ROG_Z13_FOLIO		0x1a30
+ #define USB_DEVICE_ID_ASUSTEK_ROG_Z13_LIGHTBAR		0x18c6
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY		0x1abe
+ #define USB_DEVICE_ID_ASUSTEK_ROG_NKEY_ALLY_X		0x1b4c
+-- 
+2.51.0
+
diff --git a/queue-6.6/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch b/queue-6.6/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
new file mode 100644
index 0000000000..0027400069
--- /dev/null
+++ b/queue-6.6/hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
@@ -0,0 +1,130 @@
+From 580e6565559b7e287ae27544e2d883263a55be05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 06:00:06 -0500
+Subject: HID: i2c-hid: Resolve touchpad issues on Dell systems during S4
+
+From: Mario Limonciello (AMD) <superm1@kernel.org>
+
+[ Upstream commit 7d62beb102d6fa9a4e5e874be7fbf47a62fcc4f6 ]
+
+Dell systems utilize an EC-based touchpad emulation when the ACPI
+touchpad _DSM is not invoked. This emulation acts as a secondary
+master on the I2C bus, designed for scenarios where the I2C touchpad
+driver is absent, such as in BIOS menus. Typically, loading the
+i2c-hid module triggers the _DSM at initialization, disabling the
+EC-based emulation.
+
+However, if the i2c-hid module is missing from the boot kernel
+used for hibernation snapshot restoration, the _DSM remains
+uncalled, resulting in dual masters on the I2C bus and
+subsequent arbitration errors. This issue arises when i2c-hid
+resides in the rootfs instead of the kernel or initramfs.
+
+To address this, switch from using the SYSTEM_SLEEP_PM_OPS()
+macro to dedicated callbacks, introducing a specific
+callback for restoring the S4 image. This callback ensures
+the _DSM is invoked.
+
+Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-acpi.c |  8 ++++++++
+ drivers/hid/i2c-hid/i2c-hid-core.c | 28 +++++++++++++++++++++++++++-
+ drivers/hid/i2c-hid/i2c-hid.h      |  2 ++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-acpi.c b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+index 1b49243adb16a..abd700a101f46 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-acpi.c
++++ b/drivers/hid/i2c-hid/i2c-hid-acpi.c
+@@ -76,6 +76,13 @@ static int i2c_hid_acpi_get_descriptor(struct i2c_hid_acpi *ihid_acpi)
+ 	return hid_descriptor_address;
+ }
+ 
++static void i2c_hid_acpi_restore_sequence(struct i2chid_ops *ops)
++{
++	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
++
++	i2c_hid_acpi_get_descriptor(ihid_acpi);
++}
++
+ static void i2c_hid_acpi_shutdown_tail(struct i2chid_ops *ops)
+ {
+ 	struct i2c_hid_acpi *ihid_acpi = container_of(ops, struct i2c_hid_acpi, ops);
+@@ -96,6 +103,7 @@ static int i2c_hid_acpi_probe(struct i2c_client *client)
+ 
+ 	ihid_acpi->adev = ACPI_COMPANION(dev);
+ 	ihid_acpi->ops.shutdown_tail = i2c_hid_acpi_shutdown_tail;
++	ihid_acpi->ops.restore_sequence = i2c_hid_acpi_restore_sequence;
+ 
+ 	ret = i2c_hid_acpi_get_descriptor(ihid_acpi);
+ 	if (ret < 0)
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 3dcdd3368b463..172b783274201 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -937,6 +937,14 @@ static void i2c_hid_core_shutdown_tail(struct i2c_hid *ihid)
+ 	ihid->ops->shutdown_tail(ihid->ops);
+ }
+ 
++static void i2c_hid_core_restore_sequence(struct i2c_hid *ihid)
++{
++	if (!ihid->ops->restore_sequence)
++		return;
++
++	ihid->ops->restore_sequence(ihid->ops);
++}
++
+ static int i2c_hid_core_suspend(struct i2c_hid *ihid, bool force_poweroff)
+ {
+ 	struct i2c_client *client = ihid->client;
+@@ -1320,8 +1328,26 @@ static int i2c_hid_core_pm_resume(struct device *dev)
+ 	return i2c_hid_core_resume(ihid);
+ }
+ 
++static int i2c_hid_core_pm_restore(struct device *dev)
++{
++	struct i2c_client *client = to_i2c_client(dev);
++	struct i2c_hid *ihid = i2c_get_clientdata(client);
++
++	if (ihid->is_panel_follower)
++		return 0;
++
++	i2c_hid_core_restore_sequence(ihid);
++
++	return i2c_hid_core_resume(ihid);
++}
++
+ const struct dev_pm_ops i2c_hid_core_pm = {
+-	SYSTEM_SLEEP_PM_OPS(i2c_hid_core_pm_suspend, i2c_hid_core_pm_resume)
++	.suspend = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.resume = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.freeze = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.thaw = pm_sleep_ptr(i2c_hid_core_pm_resume),
++	.poweroff = pm_sleep_ptr(i2c_hid_core_pm_suspend),
++	.restore = pm_sleep_ptr(i2c_hid_core_pm_restore),
+ };
+ EXPORT_SYMBOL_GPL(i2c_hid_core_pm);
+ 
+diff --git a/drivers/hid/i2c-hid/i2c-hid.h b/drivers/hid/i2c-hid/i2c-hid.h
+index 2c7b66d5caa0f..1724a435c783a 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.h
++++ b/drivers/hid/i2c-hid/i2c-hid.h
+@@ -27,11 +27,13 @@ static inline u32 i2c_hid_get_dmi_quirks(const u16 vendor, const u16 product)
+  * @power_up: do sequencing to power up the device.
+  * @power_down: do sequencing to power down the device.
+  * @shutdown_tail: called at the end of shutdown.
++ * @restore_sequence: hibernation restore sequence.
+  */
+ struct i2chid_ops {
+ 	int (*power_up)(struct i2chid_ops *ops);
+ 	void (*power_down)(struct i2chid_ops *ops);
+ 	void (*shutdown_tail)(struct i2chid_ops *ops);
++	void (*restore_sequence)(struct i2chid_ops *ops);
+ };
+ 
+ int i2c_hid_core_probe(struct i2c_client *client, struct i2chid_ops *ops,
+-- 
+2.51.0
+
diff --git a/queue-6.6/ice-don-t-use-pk-through-printk-or-tracepoints.patch b/queue-6.6/ice-don-t-use-pk-through-printk-or-tracepoints.patch
new file mode 100644
index 0000000000..619e01caca
--- /dev/null
+++ b/queue-6.6/ice-don-t-use-pk-through-printk-or-tracepoints.patch
@@ -0,0 +1,104 @@
+From 01a85030a896840a0709b4632486c48bcb00e873 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 11:43:18 +0200
+Subject: ice: Don't use %pK through printk or tracepoints
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+
+[ Upstream commit 66ceb45b7d7e9673254116eefe5b6d3a44eba267 ]
+
+In the past %pK was preferable to %p as it would not leak raw pointer
+values into the kernel log.
+Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
+the regular %p has been improved to avoid this issue.
+Furthermore, restricted pointers ("%pK") were never meant to be used
+through printk(). They can still unintentionally leak raw pointers or
+acquire sleeping locks in atomic contexts.
+
+Switch to the regular pointer formatting which is safer and
+easier to reason about.
+There are still a few users of %pK left, but these use it through seq_file,
+for which its usage is safe.
+
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Acked-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-1-2e2fdc7d3f2c@linutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c  |  2 +-
+ drivers/net/ethernet/intel/ice/ice_trace.h | 10 +++++-----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index e1a68fb5e9fff..e846246261b94 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -8765,7 +8765,7 @@ static int ice_create_q_channels(struct ice_vsi *vsi)
+ 		list_add_tail(&ch->list, &vsi->ch_list);
+ 		vsi->tc_map_vsi[i] = ch->ch_vsi;
+ 		dev_dbg(ice_pf_to_dev(pf),
+-			"successfully created channel: VSI %pK\n", ch->ch_vsi);
++			"successfully created channel: VSI %p\n", ch->ch_vsi);
+ 	}
+ 	return 0;
+ 
+diff --git a/drivers/net/ethernet/intel/ice/ice_trace.h b/drivers/net/ethernet/intel/ice/ice_trace.h
+index b2f5c9fe01492..a41e210a310d1 100644
+--- a/drivers/net/ethernet/intel/ice/ice_trace.h
++++ b/drivers/net/ethernet/intel/ice/ice_trace.h
+@@ -130,7 +130,7 @@ DECLARE_EVENT_CLASS(ice_tx_template,
+ 				   __entry->buf = buf;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK buf %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p buf %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->buf)
+ );
+ 
+@@ -158,7 +158,7 @@ DECLARE_EVENT_CLASS(ice_rx_template,
+ 				   __entry->desc = desc;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc)
+ );
+ DEFINE_EVENT(ice_rx_template, ice_clean_rx_irq,
+@@ -182,7 +182,7 @@ DECLARE_EVENT_CLASS(ice_rx_indicate_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s ring: %pK desc: %pK skb %pK", __get_str(devname),
++		    TP_printk("netdev: %s ring: %p desc: %p skb %p", __get_str(devname),
+ 			      __entry->ring, __entry->desc, __entry->skb)
+ );
+ 
+@@ -205,7 +205,7 @@ DECLARE_EVENT_CLASS(ice_xmit_template,
+ 				   __entry->skb = skb;
+ 				   __assign_str(devname, ring->netdev->name);),
+ 
+-		    TP_printk("netdev: %s skb: %pK ring: %pK", __get_str(devname),
++		    TP_printk("netdev: %s skb: %p ring: %p", __get_str(devname),
+ 			      __entry->skb, __entry->ring)
+ );
+ 
+@@ -228,7 +228,7 @@ DECLARE_EVENT_CLASS(ice_tx_tstamp_template,
+ 		    TP_fast_assign(__entry->skb = skb;
+ 				   __entry->idx = idx;),
+ 
+-		    TP_printk("skb %pK idx %d",
++		    TP_printk("skb %p idx %d",
+ 			      __entry->skb, __entry->idx)
+ );
+ #define DEFINE_TX_TSTAMP_OP_EVENT(name) \
+-- 
+2.51.0
+
diff --git a/queue-6.6/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch b/queue-6.6/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
new file mode 100644
index 0000000000..1d2fa610a4
--- /dev/null
+++ b/queue-6.6/iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
@@ -0,0 +1,88 @@
+From 3b440388ada7f1dc6877d1ac955df96dd250908c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:04:23 +0800
+Subject: iio: adc: imx93_adc: load calibrated values even calibration failed
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 12c9b09e981ab14ebec8e4eefa946cbd26dd306b ]
+
+ADC calibration might fail because of the noise on reference voltage.
+To avoid calibration fail, need to meet the following requirement:
+    ADC reference voltage Noise < 1.8V * 1/2^ENOB
+
+For the case which the ADC reference voltage on board do not meet
+the requirement, still load the calibrated values, so ADC can also
+work but maybe not that accurate.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Reviewed-by: Primoz Fiser <primoz.fiser@norik.com>
+Link: https://patch.msgid.link/20250812-adc-v2-2-0260833f13b8@nxp.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/imx93_adc.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c
+index 512d7b95b08e6..2303ae19c602e 100644
+--- a/drivers/iio/adc/imx93_adc.c
++++ b/drivers/iio/adc/imx93_adc.c
+@@ -38,6 +38,7 @@
+ #define IMX93_ADC_PCDR6		0x118
+ #define IMX93_ADC_PCDR7		0x11c
+ #define IMX93_ADC_CALSTAT	0x39C
++#define IMX93_ADC_CALCFG0	0x3A0
+ 
+ /* ADC bit shift */
+ #define IMX93_ADC_MCR_MODE_MASK			BIT(29)
+@@ -58,6 +59,8 @@
+ #define IMX93_ADC_IMR_ECH_MASK			BIT(0)
+ #define IMX93_ADC_PCDR_CDATA_MASK		GENMASK(11, 0)
+ 
++#define IMX93_ADC_CALCFG0_LDFAIL_MASK		BIT(4)
++
+ /* ADC status */
+ #define IMX93_ADC_MSR_ADCSTATUS_IDLE			0
+ #define IMX93_ADC_MSR_ADCSTATUS_POWER_DOWN		1
+@@ -145,7 +148,7 @@ static void imx93_adc_config_ad_clk(struct imx93_adc *adc)
+ 
+ static int imx93_adc_calibration(struct imx93_adc *adc)
+ {
+-	u32 mcr, msr;
++	u32 mcr, msr, calcfg;
+ 	int ret;
+ 
+ 	/* make sure ADC in power down mode */
+@@ -158,6 +161,11 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 
+ 	imx93_adc_power_up(adc);
+ 
++	/* Enable loading of calibrated values even in fail condition */
++	calcfg = readl(adc->regs + IMX93_ADC_CALCFG0);
++	calcfg |= IMX93_ADC_CALCFG0_LDFAIL_MASK;
++	writel(calcfg, adc->regs + IMX93_ADC_CALCFG0);
++
+ 	/*
+ 	 * TODO: we use the default TSAMP/NRSMPL/AVGEN in MCR,
+ 	 * can add the setting of these bit if need in future.
+@@ -180,9 +188,13 @@ static int imx93_adc_calibration(struct imx93_adc *adc)
+ 	/* check whether calbration is success or not */
+ 	msr = readl(adc->regs + IMX93_ADC_MSR);
+ 	if (msr & IMX93_ADC_MSR_CALFAIL_MASK) {
++		/*
++		 * Only give warning here, this means the noise of the
++		 * reference voltage do not meet the requirement:
++		 *     ADC reference voltage Noise < 1.8V * 1/2^ENOB
++		 * And the resault of ADC is not that accurate.
++		 */
+ 		dev_warn(adc->dev, "ADC calibration failed!\n");
+-		imx93_adc_power_down(adc);
+-		return -EAGAIN;
+ 	}
+ 
+ 	return 0;
+-- 
+2.51.0
+
diff --git a/queue-6.6/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch b/queue-6.6/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
new file mode 100644
index 0000000000..a3bbc83ca0
--- /dev/null
+++ b/queue-6.6/iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
@@ -0,0 +1,65 @@
+From cf119945c1026cf0c94d6c47a0dcbdd08bf489b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 19:13:49 -0300
+Subject: iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample
+ before setting register
+
+From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+
+[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
+
+avg sample info is a bit field coded inside the following
+bits: 5,6,7 and 8 of a device status register.
+
+Channel num info the same, but over bits: 1, 2 and 3.
+
+Mask both values in order to avoid touching other register bits,
+since the first info (avg sample), came from DT.
+
+Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/spear_adc.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
+index ad54ef7981090..602ed05552bfd 100644
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/io.h>
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
+ #include <linux/completion.h>
+@@ -29,9 +30,9 @@
+ 
+ /* Bit definitions for SPEAR_ADC_STATUS */
+ #define SPEAR_ADC_STATUS_START_CONVERSION	BIT(0)
+-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x)		((x) << 1)
++#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK	GENMASK(3, 1)
+ #define SPEAR_ADC_STATUS_ADC_ENABLE		BIT(4)
+-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x)		((x) << 5)
++#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK	GENMASK(8, 5)
+ #define SPEAR_ADC_STATUS_VREF_INTERNAL		BIT(9)
+ 
+ #define SPEAR_ADC_DATA_MASK		0x03ff
+@@ -157,8 +158,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_RAW:
+ 		mutex_lock(&st->lock);
+ 
+-		status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
+-			SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
++		status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
++			FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
+ 			SPEAR_ADC_STATUS_START_CONVERSION |
+ 			SPEAR_ADC_STATUS_ADC_ENABLE;
+ 		if (st->vref_external == 0)
+-- 
+2.51.0
+
diff --git a/queue-6.6/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch b/queue-6.6/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
new file mode 100644
index 0000000000..1c1df7a157
--- /dev/null
+++ b/queue-6.6/ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
@@ -0,0 +1,155 @@
+From d26039a8236ec536cd93dbb464c86f2588b74bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 13:55:23 +0800
+Subject: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA
+ xattr
+
+From: Coiby Xu <coxu@redhat.com>
+
+[ Upstream commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd ]
+
+Currently when both IMA and EVM are in fix mode, the IMA signature will
+be reset to IMA hash if a program first stores IMA signature in
+security.ima and then writes/removes some other security xattr for the
+file.
+
+For example, on Fedora, after booting the kernel with "ima_appraise=fix
+evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima,
+installing/reinstalling a package will not make good reference IMA
+signature generated. Instead IMA hash is generated,
+
+    # getfattr -m - -d -e hex /usr/bin/bash
+    # file: usr/bin/bash
+    security.ima=0x0404...
+
+This happens because when setting security.selinux, the IMA_DIGSIG flag
+that had been set early was cleared. As a result, IMA hash is generated
+when the file is closed.
+
+Similarly, IMA signature can be cleared on file close after removing
+security xattr like security.evm or setting/removing ACL.
+
+Prevent replacing the IMA file signature with a file hash, by preventing
+the IMA_DIGSIG flag from being reset.
+
+Here's a minimal C reproducer which sets security.selinux as the last
+step which can also replaced by removing security.evm or setting ACL,
+
+    #include <stdio.h>
+    #include <sys/xattr.h>
+    #include <fcntl.h>
+    #include <unistd.h>
+    #include <string.h>
+    #include <stdlib.h>
+
+    int main() {
+        const char* file_path = "/usr/sbin/test_binary";
+        const char* hex_string = "030204d33204490066306402304";
+        int length = strlen(hex_string);
+        char* ima_attr_value;
+        int fd;
+
+        fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
+        if (fd == -1) {
+            perror("Error opening file");
+            return 1;
+        }
+
+        ima_attr_value = (char*)malloc(length / 2 );
+        for (int i = 0, j = 0; i < length; i += 2, j++) {
+            sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]);
+        }
+
+        if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        const char* selinux_value= "system_u:object_r:bin_t:s0";
+        if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) {
+            perror("Error setting extended attribute");
+            close(fd);
+            return 1;
+        }
+
+        close(fd);
+
+        return 0;
+    }
+
+Signed-off-by: Coiby Xu <coxu@redhat.com>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/integrity/ima/ima_appraise.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index 870dde67707b1..0acf7d6baa37f 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -671,6 +671,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name,
+ 	return 0;
+ }
+ 
++/*
++ * ima_reset_appraise_flags - reset ima_iint_cache flags
++ *
++ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values
++ *          0: clear IMA_DIGSIG
++ *          1: set IMA_DIGSIG
++ *         -1: don't change IMA_DIGSIG
++ *
++ */
+ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ {
+ 	struct integrity_iint_cache *iint;
+@@ -683,9 +692,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig)
+ 		return;
+ 	iint->measured_pcrs = 0;
+ 	set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags);
+-	if (digsig)
++	if (digsig == 1)
+ 		set_bit(IMA_DIGSIG, &iint->atomic_flags);
+-	else
++	else if (digsig == 0)
+ 		clear_bit(IMA_DIGSIG, &iint->atomic_flags);
+ }
+ 
+@@ -770,6 +779,8 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+ 		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
+ 	} else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) {
+ 		digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG);
++	} else {
++		digsig = -1;
+ 	}
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+ 		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+@@ -783,18 +794,20 @@ int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
+ 		      const char *acl_name, struct posix_acl *kacl)
+ {
+ 	if (evm_revalidate_status(acl_name))
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		ima_reset_appraise_flags(d_backing_inode(dentry), -1);
+ 
+ 	return 0;
+ }
+ 
+ int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
+ {
+-	int result;
++	int result, digsig = -1;
+ 
+ 	result = ima_protect_xattr(dentry, xattr_name, NULL, 0);
+ 	if (result == 1 || evm_revalidate_status(xattr_name)) {
+-		ima_reset_appraise_flags(d_backing_inode(dentry), 0);
++		if (!strcmp(xattr_name, XATTR_NAME_IMA))
++			digsig = 0;
++		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
+ 		if (result == 1)
+ 			result = 0;
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch b/queue-6.6/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
new file mode 100644
index 0000000000..e479882ae9
--- /dev/null
+++ b/queue-6.6/iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
@@ -0,0 +1,79 @@
+From af1ba0f11cc85dc11ab4e9986ce377936544af95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 21:46:53 +0000
+Subject: iommu/amd: Skip enabling command/event buffers for kdump
+
+From: Ashish Kalra <ashish.kalra@amd.com>
+
+[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
+
+After a panic if SNP is enabled in the previous kernel then the kdump
+kernel boots with IOMMU SNP enforcement still enabled.
+
+IOMMU command buffers and event buffer registers remain locked and
+exclusive to the previous kernel. Attempts to enable command and event
+buffers in the kdump kernel will fail, as hardware ignores writes to
+the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
+
+Skip enabling command buffers and event buffers for kdump boot as they
+are already enabled in the previous kernel.
+
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
+Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
+Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 431cea41df2af..1897619209f14 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -840,11 +840,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->cmd_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->cmd_buf);
+-	entry |= MMIO_CMD_SIZE_512;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Command buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->cmd_buf);
++		entry |= MMIO_CMD_SIZE_512;
++		memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	amd_iommu_reset_cmd_buffer(iommu);
+ }
+@@ -893,10 +898,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
+ 
+ 	BUG_ON(iommu->evt_buf == NULL);
+ 
+-	entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+-
+-	memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+-		    &entry, sizeof(entry));
++	if (!is_kdump_kernel()) {
++		/*
++		 * Event buffer is re-used for kdump kernel and setting
++		 * of MMIO register is not required.
++		 */
++		entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
++		memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
++			    &entry, sizeof(entry));
++	}
+ 
+ 	/* set head and tail to zero manually */
+ 	writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
+-- 
+2.51.0
+
diff --git a/queue-6.6/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch b/queue-6.6/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
new file mode 100644
index 0000000000..b0f917e6a7
--- /dev/null
+++ b/queue-6.6/iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
@@ -0,0 +1,49 @@
+From f6924410db1aa1d15e21692f38bd8daa8b761457 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 12:57:18 +0200
+Subject: iommu/apple-dart: Clear stream error indicator bits for T8110 DARTs
+
+From: Hector Martin <marcan@marcan.st>
+
+[ Upstream commit ecf6508923f87e4597228f70cc838af3d37f6662 ]
+
+These registers exist and at least on the t602x variant the IRQ only
+clears when theses are cleared.
+
+Signed-off-by: Hector Martin <marcan@marcan.st>
+Signed-off-by: Janne Grunau <j@jannau.net>
+Reviewed-by: Sven Peter <sven@kernel.org>
+Reviewed-by: Neal Gompa <neal@gompa.dev>
+Link: https://lore.kernel.org/r/20250826-dart-t8110-stream-error-v1-1-e33395112014@jannau.net
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/apple-dart.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c
+index 0b89275084274..0ea450cbb7786 100644
+--- a/drivers/iommu/apple-dart.c
++++ b/drivers/iommu/apple-dart.c
+@@ -121,6 +121,8 @@
+ #define DART_T8110_ERROR_ADDR_LO 0x170
+ #define DART_T8110_ERROR_ADDR_HI 0x174
+ 
++#define DART_T8110_ERROR_STREAMS 0x1c0
++
+ #define DART_T8110_PROTECT 0x200
+ #define DART_T8110_UNPROTECT 0x204
+ #define DART_T8110_PROTECT_LOCK 0x208
+@@ -1041,6 +1043,9 @@ static irqreturn_t apple_dart_t8110_irq(int irq, void *dev)
+ 		error, stream_idx, error_code, fault_name, addr);
+ 
+ 	writel(error, dart->regs + DART_T8110_ERROR);
++	for (int i = 0; i < BITS_TO_U32(dart->num_streams); i++)
++		writel(U32_MAX, dart->regs + DART_T8110_ERROR_STREAMS + 4 * i);
++
+ 	return IRQ_HANDLED;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch b/queue-6.6/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
new file mode 100644
index 0000000000..dc030096bb
--- /dev/null
+++ b/queue-6.6/iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
@@ -0,0 +1,131 @@
+From 548e8466fc3290881710078d8dbec8616930e805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 13:01:58 +0800
+Subject: iommu/vt-d: Replace snprintf with scnprintf in
+ dmar_latency_snapshot()
+
+From: Seyediman Seyedarab <ImanDevel@gmail.com>
+
+[ Upstream commit 75c02a037609f34db17e91be195cedb33b61bae0 ]
+
+snprintf() returns the number of bytes that would have been written, not
+the number actually written. Using this for offset tracking can cause
+buffer overruns if truncation occurs.
+
+Replace snprintf() with scnprintf() to ensure the offset stays within
+bounds.
+
+Since scnprintf() never returns a negative value, and zero is not possible
+in this context because 'bytes' starts at 0 and 'size - bytes' is
+DEBUG_BUFFER_SIZE in the first call, which is large enough to hold the
+string literals used, the return value is always positive. An integer
+overflow is also completely out of reach here due to the small and fixed
+buffer size. The error check in latency_show_one() is therefore
+unnecessary. Remove it and make dmar_latency_snapshot() return void.
+
+Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
+Link: https://lore.kernel.org/r/20250731225048.131364-1-ImanDevel@gmail.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/debugfs.c | 10 ++--------
+ drivers/iommu/intel/perf.c    | 10 ++++------
+ drivers/iommu/intel/perf.h    |  5 ++---
+ 3 files changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c
+index 1f925285104ee..aa9cfcb6039e2 100644
+--- a/drivers/iommu/intel/debugfs.c
++++ b/drivers/iommu/intel/debugfs.c
+@@ -562,17 +562,11 @@ DEFINE_SHOW_ATTRIBUTE(ir_translation_struct);
+ static void latency_show_one(struct seq_file *m, struct intel_iommu *iommu,
+ 			     struct dmar_drhd_unit *drhd)
+ {
+-	int ret;
+-
+ 	seq_printf(m, "IOMMU: %s Register Base Address: %llx\n",
+ 		   iommu->name, drhd->reg_base_addr);
+ 
+-	ret = dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
+-	if (ret < 0)
+-		seq_puts(m, "Failed to get latency snapshot");
+-	else
+-		seq_puts(m, debug_buf);
+-	seq_puts(m, "\n");
++	dmar_latency_snapshot(iommu, debug_buf, DEBUG_BUFFER_SIZE);
++	seq_printf(m, "%s\n", debug_buf);
+ }
+ 
+ static int latency_show(struct seq_file *m, void *v)
+diff --git a/drivers/iommu/intel/perf.c b/drivers/iommu/intel/perf.c
+index 94ee70ac38e30..ae64e1123f257 100644
+--- a/drivers/iommu/intel/perf.c
++++ b/drivers/iommu/intel/perf.c
+@@ -113,7 +113,7 @@ static char *latency_type_names[] = {
+ 	"     svm_prq"
+ };
+ 
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+ 	struct latency_statistic *lstat = iommu->perf_statistic;
+ 	unsigned long flags;
+@@ -122,7 +122,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 	memset(str, 0, size);
+ 
+ 	for (i = 0; i < COUNTS_NUM; i++)
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "%s", latency_counter_names[i]);
+ 
+ 	spin_lock_irqsave(&latency_lock, flags);
+@@ -130,7 +130,7 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 		if (!dmar_latency_enabled(iommu, i))
+ 			continue;
+ 
+-		bytes += snprintf(str + bytes, size - bytes,
++		bytes += scnprintf(str + bytes, size - bytes,
+ 				  "\n%s", latency_type_names[i]);
+ 
+ 		for (j = 0; j < COUNTS_NUM; j++) {
+@@ -156,11 +156,9 @@ int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ 				break;
+ 			}
+ 
+-			bytes += snprintf(str + bytes, size - bytes,
++			bytes += scnprintf(str + bytes, size - bytes,
+ 					  "%12lld", val);
+ 		}
+ 	}
+ 	spin_unlock_irqrestore(&latency_lock, flags);
+-
+-	return bytes;
+ }
+diff --git a/drivers/iommu/intel/perf.h b/drivers/iommu/intel/perf.h
+index fd6db8049d1a7..1e481e9e4ad04 100644
+--- a/drivers/iommu/intel/perf.h
++++ b/drivers/iommu/intel/perf.h
+@@ -41,7 +41,7 @@ void dmar_latency_disable(struct intel_iommu *iommu, enum latency_type type);
+ bool dmar_latency_enabled(struct intel_iommu *iommu, enum latency_type type);
+ void dmar_latency_update(struct intel_iommu *iommu, enum latency_type type,
+ 			 u64 latency);
+-int dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
++void dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size);
+ #else
+ static inline int
+ dmar_latency_enable(struct intel_iommu *iommu, enum latency_type type)
+@@ -65,9 +65,8 @@ dmar_latency_update(struct intel_iommu *iommu, enum latency_type type, u64 laten
+ {
+ }
+ 
+-static inline int
++static inline void
+ dmar_latency_snapshot(struct intel_iommu *iommu, char *str, size_t size)
+ {
+-	return 0;
+ }
+ #endif /* CONFIG_DMAR_PERF */
+-- 
+2.51.0
+
diff --git a/queue-6.6/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch b/queue-6.6/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
new file mode 100644
index 0000000000..cd6c940604
--- /dev/null
+++ b/queue-6.6/ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
@@ -0,0 +1,39 @@
+From 66a7d985297f697682b3cf4cce8556a113731f5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Sep 2025 20:37:26 +0800
+Subject: ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
+
+From: Yue Haibing <yuehaibing@huawei.com>
+
+[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
+
+In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
+idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
+zero, but if one of the values is negative it will in fact return non-zero.
+
+Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
+Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 1c3b0ba289fbd..0e49ee83533b5 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -7102,7 +7102,9 @@ static const struct ctl_table addrconf_sysctl[] = {
+ 		.data		= &ipv6_devconf.rpl_seg_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler   = proc_dointvec_minmax,
++		.extra1         = SYSCTL_ZERO,
++		.extra2         = SYSCTL_ONE,
+ 	},
+ 	{
+ 		.procname	= "ioam6_enabled",
+-- 
+2.51.0
+
diff --git a/queue-6.6/ipv6-np-rxpmtu-race-annotation.patch b/queue-6.6/ipv6-np-rxpmtu-race-annotation.patch
new file mode 100644
index 0000000000..ae29d357f5
--- /dev/null
+++ b/queue-6.6/ipv6-np-rxpmtu-race-annotation.patch
@@ -0,0 +1,58 @@
+From 1bb014a5e38217efc2f75828a82485954413e38b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 16:09:44 +0000
+Subject: ipv6: np->rxpmtu race annotation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
+
+Add READ_ONCE() annotations because np->rxpmtu can be changed
+while udpv6_recvmsg() and rawv6_recvmsg() read it.
+
+Since this is a very rarely used feature, and that udpv6_recvmsg()
+and rawv6_recvmsg() read np->rxopt anyway, change the test order
+so that np->rxpmtu does not need to be in a hot cache line.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/raw.c | 2 +-
+ net/ipv6/udp.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
+index 4f526606bc894..7d72633ea0198 100644
+--- a/net/ipv6/raw.c
++++ b/net/ipv6/raw.c
+@@ -438,7 +438,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ 	skb = skb_recv_datagram(sk, flags, &err);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9ff8e723402ba..6df2459f25618 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -347,7 +347,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_ERRQUEUE)
+ 		return ipv6_recv_error(sk, msg, len, addr_len);
+ 
+-	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
++	if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
+ 		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
+ 
+ try_again:
+-- 
+2.51.0
+
diff --git a/queue-6.6/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch b/queue-6.6/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
new file mode 100644
index 0000000000..08a98e0c46
--- /dev/null
+++ b/queue-6.6/jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
@@ -0,0 +1,61 @@
+From d6224f6bc60b682a70f018b628a5d4ac7277f07c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Aug 2025 01:43:32 +0530
+Subject: jfs: fix uninitialized waitqueue in transaction manager
+
+From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+
+[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
+
+The transaction manager initialization in txInit() was not properly
+initializing TxBlock[0].waitor waitqueue, causing a crash when
+txEnd(0) is called on read-only filesystems.
+
+When a filesystem is mounted read-only, txBegin() returns tid=0 to
+indicate no transaction. However, txEnd(0) still gets called and
+tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
+waitqueue was never initialized because the initialization loop
+started at index 1 instead of 0.
+
+This causes a 'non-static key' lockdep warning and system crash:
+  INFO: trying to register non-static key in txEnd
+
+Fix by ensuring all transaction blocks including TxBlock[0] have
+their waitqueues properly initialized during txInit().
+
+Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
+
+Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index dccc8b3f10459..42fb833ef2834 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -272,14 +272,15 @@ int txInit(void)
+ 	if (TxBlock == NULL)
+ 		return -ENOMEM;
+ 
+-	for (k = 1; k < nTxBlock - 1; k++) {
+-		TxBlock[k].next = k + 1;
++	for (k = 0; k < nTxBlock; k++) {
+ 		init_waitqueue_head(&TxBlock[k].gcwait);
+ 		init_waitqueue_head(&TxBlock[k].waitor);
+ 	}
++
++	for (k = 1; k < nTxBlock - 1; k++) {
++		TxBlock[k].next = k + 1;
++	}
+ 	TxBlock[k].next = 0;
+-	init_waitqueue_head(&TxBlock[k].gcwait);
+-	init_waitqueue_head(&TxBlock[k].waitor);
+ 
+ 	TxAnchor.freetid = 1;
+ 	init_waitqueue_head(&TxAnchor.freewait);
+-- 
+2.51.0
+
diff --git a/queue-6.6/jfs-verify-inode-mode-when-loading-from-disk.patch b/queue-6.6/jfs-verify-inode-mode-when-loading-from-disk.patch
new file mode 100644
index 0000000000..ed27031ac3
--- /dev/null
+++ b/queue-6.6/jfs-verify-inode-mode-when-loading-from-disk.patch
@@ -0,0 +1,46 @@
+From f717c1803ded5230da611ff71661e2a5c4f88e80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 23:18:44 +0900
+Subject: jfs: Verify inode mode when loading from disk
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
+
+The inode mode loaded from corrupted disk can be invalid. Do like what
+commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
+does.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/inode.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
+index 66c38ef5e5711..1e6c1d1a15a6a 100644
+--- a/fs/jfs/inode.c
++++ b/fs/jfs/inode.c
+@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
+ 			 */
+ 			inode->i_link[inode->i_size] = '\0';
+ 		}
+-	} else {
++	} else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
++		   S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
+ 		inode->i_op = &jfs_file_inode_operations;
+ 		init_special_inode(inode, inode->i_mode, inode->i_rdev);
++	} else {
++		printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
++		       inode->i_mode, inode->i_ino);
++		iget_failed(inode);
++		return ERR_PTR(-EIO);
+ 	}
+ 	unlock_new_inode(inode);
+ 	return inode;
+-- 
+2.51.0
+
diff --git a/queue-6.6/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch b/queue-6.6/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
new file mode 100644
index 0000000000..3cb828e4cf
--- /dev/null
+++ b/queue-6.6/ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
@@ -0,0 +1,42 @@
+From aa6dc92181148176e569b9b6f7249d522ff22251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Sep 2025 21:12:05 +0900
+Subject: ksmbd: use sock_create_kern interface to create kernel socket
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 3677ca67b9791481af16d86e47c3c7d1f2442f95 ]
+
+we should use sock_create_kern() if the socket resides in kernel space.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/transport_tcp.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c
+index 665d21d40e7a1..279a61d0dcc6b 100644
+--- a/fs/smb/server/transport_tcp.c
++++ b/fs/smb/server/transport_tcp.c
+@@ -476,12 +476,13 @@ static int create_socket(struct interface *iface)
+ 	struct socket *ksmbd_socket;
+ 	bool ipv4 = false;
+ 
+-	ret = sock_create(PF_INET6, SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
++	ret = sock_create_kern(current->nsproxy->net_ns, PF_INET6, SOCK_STREAM,
++			IPPROTO_TCP, &ksmbd_socket);
+ 	if (ret) {
+ 		if (ret != -EAFNOSUPPORT)
+ 			pr_err("Can't create socket for ipv6, fallback to ipv4: %d\n", ret);
+-		ret = sock_create(PF_INET, SOCK_STREAM, IPPROTO_TCP,
+-				  &ksmbd_socket);
++		ret = sock_create_kern(current->nsproxy->net_ns, PF_INET,
++				SOCK_STREAM, IPPROTO_TCP, &ksmbd_socket);
+ 		if (ret) {
+ 			pr_err("Can't create socket for ipv4: %d\n", ret);
+ 			goto out_clear;
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-adv7180-add-missing-lock-in-suspend-callback.patch b/queue-6.6/media-adv7180-add-missing-lock-in-suspend-callback.patch
new file mode 100644
index 0000000000..04c967ef4d
--- /dev/null
+++ b/queue-6.6/media-adv7180-add-missing-lock-in-suspend-callback.patch
@@ -0,0 +1,57 @@
+From 57633aebf7e2829d54127e33080c90f740fb5deb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:45 +0200
+Subject: media: adv7180: Add missing lock in suspend callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 878c496ac5080f94a93a9216a8f70cfd67ace8c9 ]
+
+The adv7180_set_power() utilizes adv7180_write() which in turn requires
+the state mutex to be held, take it before calling adv7180_set_power()
+to avoid tripping a lockdep_assert_held().
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 114ac0c263fb2..831ce10718550 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -804,6 +804,8 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+ 		if (state->field != format->format.field) {
++			guard(mutex)(&state->mutex);
++
+ 			state->field = format->format.field;
+ 			adv7180_set_power(state, false);
+ 			adv7180_set_field_mode(state);
+@@ -1568,6 +1570,8 @@ static int adv7180_suspend(struct device *dev)
+ 	struct v4l2_subdev *sd = dev_get_drvdata(dev);
+ 	struct adv7180_state *state = to_state(sd);
+ 
++	guard(mutex)(&state->mutex);
++
+ 	return adv7180_set_power(state, false);
+ }
+ 
+@@ -1581,6 +1585,8 @@ static int adv7180_resume(struct device *dev)
+ 	if (ret < 0)
+ 		return ret;
+ 
++	guard(mutex)(&state->mutex);
++
+ 	ret = adv7180_set_power(state, state->powered);
+ 	if (ret)
+ 		return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-adv7180-do-not-write-format-to-device-in-set_f.patch b/queue-6.6/media-adv7180-do-not-write-format-to-device-in-set_f.patch
new file mode 100644
index 0000000000..238feadcf5
--- /dev/null
+++ b/queue-6.6/media-adv7180-do-not-write-format-to-device-in-set_f.patch
@@ -0,0 +1,50 @@
+From efb2b7f5de22ccb888cb8abe17c62a68cdec1497 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:52 +0200
+Subject: media: adv7180: Do not write format to device in set_fmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 46c1e7814d1c3310ef23c01ed1a582ef0c8ab1d2 ]
+
+The .set_fmt callback should not write the new format directly do the
+device, it should only store it and have it applied by .s_stream.
+
+The .s_stream callback already calls adv7180_set_field_mode() so it's
+safe to remove programming of the device and just store the format and
+have .s_stream apply it.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index 831ce10718550..ef2c769929a97 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -803,14 +803,7 @@ static int adv7180_set_pad_format(struct v4l2_subdev *sd,
+ 	ret = adv7180_mbus_fmt(sd,  &format->format);
+ 
+ 	if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) {
+-		if (state->field != format->format.field) {
+-			guard(mutex)(&state->mutex);
+-
+-			state->field = format->format.field;
+-			adv7180_set_power(state, false);
+-			adv7180_set_field_mode(state);
+-			adv7180_set_power(state, true);
+-		}
++		state->field = format->format.field;
+ 	} else {
+ 		framefmt = v4l2_subdev_get_try_format(sd, sd_state, 0);
+ 		*framefmt = format->format;
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-adv7180-only-validate-format-in-querystd.patch b/queue-6.6/media-adv7180-only-validate-format-in-querystd.patch
new file mode 100644
index 0000000000..4ace4c2478
--- /dev/null
+++ b/queue-6.6/media-adv7180-only-validate-format-in-querystd.patch
@@ -0,0 +1,85 @@
+From a460525ad286ca9b742a710f071e3edd6221b3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 18:06:54 +0200
+Subject: media: adv7180: Only validate format in querystd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 91c5d7c849273d14bc4bae1b92666bdb5409294a ]
+
+The .querystd callback should not program the device with the detected
+standard, it should only report the standard to user-space. User-space
+may then use .s_std to set the standard, if it wants to use it.
+
+All that is required of .querystd is to setup the auto detection of
+standards and report its findings.
+
+While at it add some documentation on why this can't happen while
+streaming and improve the error handling using a scoped guard.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/adv7180.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/i2c/adv7180.c b/drivers/media/i2c/adv7180.c
+index ef2c769929a97..ecb0e7b1f2a5f 100644
+--- a/drivers/media/i2c/adv7180.c
++++ b/drivers/media/i2c/adv7180.c
+@@ -356,32 +356,27 @@ static inline struct adv7180_state *to_state(struct v4l2_subdev *sd)
+ static int adv7180_querystd(struct v4l2_subdev *sd, v4l2_std_id *std)
+ {
+ 	struct adv7180_state *state = to_state(sd);
+-	int err = mutex_lock_interruptible(&state->mutex);
+-	if (err)
+-		return err;
+-
+-	if (state->streaming) {
+-		err = -EBUSY;
+-		goto unlock;
+-	}
++	int ret;
+ 
+-	err = adv7180_set_video_standard(state,
+-			ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
+-	if (err)
+-		goto unlock;
++	guard(mutex)(&state->mutex);
+ 
+-	msleep(100);
+-	__adv7180_status(state, NULL, std);
++	/*
++	 * We can't sample the standard if the device is streaming as that would
++	 * interfere with the capture session as the VID_SEL reg is touched.
++	 */
++	if (state->streaming)
++		return -EBUSY;
+ 
+-	err = v4l2_std_to_adv7180(state->curr_norm);
+-	if (err < 0)
+-		goto unlock;
++	/* Set the standard to autodetect PAL B/G/H/I/D, NTSC J or SECAM */
++	ret = adv7180_set_video_standard(state,
++					 ADV7180_STD_AD_PAL_BG_NTSC_J_SECAM);
++	if (ret)
++		return ret;
+ 
+-	err = adv7180_set_video_standard(state, err);
++	/* Allow some time for the autodetection to run. */
++	msleep(100);
+ 
+-unlock:
+-	mutex_unlock(&state->mutex);
+-	return err;
++	return __adv7180_status(state, NULL, std);
+ }
+ 
+ static int adv7180_s_routing(struct v4l2_subdev *sd, u32 input,
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch b/queue-6.6/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
new file mode 100644
index 0000000000..c0d64b72e2
--- /dev/null
+++ b/queue-6.6/media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
@@ -0,0 +1,91 @@
+From ced56c13b117fa88d180b6d5e6fda182a74636ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:56 +0300
+Subject: media: amphion: Delete v4l2_fh synchronously in .release()
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 19fb9c5b815f70eb90d5b545f65b83bc9c490ecd ]
+
+The v4l2_fh initialized and added in vpu_v4l2_open() is delete and
+cleaned up when the last reference to the vpu_inst is released. This may
+happen later than at vpu_v4l2_close() time.
+
+Not deleting and cleaning up the v4l2_fh when closing the file handle to
+the video device is not ideal, as the v4l2_fh will still be present in
+the video device's fh_list, and will store a copy of events queued to
+the video device. There may also be other side effects of keeping alive
+an object that represents an open file handle after the file handle is
+closed.
+
+The v4l2_fh instance is embedded in the vpu_inst structure, and is
+accessed in two different ways:
+
+- in vpu_notify_eos() and vpu_notify_source_change(), to queue V4L2
+  events to the file handle ; and
+
+- through the driver to access the v4l2_fh.m2m_ctx pointer.
+
+The v4l2_fh.m2m_ctx pointer is not touched by v4l2_fh_del() and
+v4l2_fh_exit(). It is set to NULL by the driver when closing the file
+handle, in vpu_v4l2_close().
+
+The vpu_notify_eos() and vpu_notify_source_change() functions are called
+in vpu_set_last_buffer_dequeued() and vdec_handle_resolution_change()
+respectively, only if the v4l2_fh.m2m_ctx pointer is not NULL. There is
+therefore a guarantee that no new event will be queued to the v4l2_fh
+after vpu_v4l2_close() destroys the m2m_ctx.
+
+The vpu_notify_eos() function is also called from vpu_vb2_buf_finish(),
+which is guaranteed to be called for all queued buffers when
+vpu_v4l2_close() calls v4l2_m2m_ctx_release(), and will not be called
+later.
+
+It is therefore safe to assume that the driver will not touch the
+v4l2_fh, except to check the m2m_ctx pointer, after vpu_v4l2_close()
+destroys the m2m_ctx. We can safely delete and cleanup the v4l2_fh
+synchronously in vpu_v4l2_close().
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Ming Qian <ming.qian@oss.nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_v4l2.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_v4l2.c b/drivers/media/platform/amphion/vpu_v4l2.c
+index 61d27b63b99d4..75084ba8f93b6 100644
+--- a/drivers/media/platform/amphion/vpu_v4l2.c
++++ b/drivers/media/platform/amphion/vpu_v4l2.c
+@@ -693,8 +693,6 @@ static int vpu_v4l2_release(struct vpu_inst *inst)
+ 
+ 	v4l2_ctrl_handler_free(&inst->ctrl_handler);
+ 	mutex_destroy(&inst->lock);
+-	v4l2_fh_del(&inst->fh);
+-	v4l2_fh_exit(&inst->fh);
+ 
+ 	call_void_vop(inst, cleanup);
+ 
+@@ -763,6 +761,8 @@ int vpu_v4l2_open(struct file *file, struct vpu_inst *inst)
+ 
+ 	return 0;
+ error:
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
+ 	vpu_inst_put(inst);
+ 	return ret;
+ }
+@@ -782,6 +782,9 @@ int vpu_v4l2_close(struct file *file)
+ 	call_void_vop(inst, release);
+ 	vpu_inst_unlock(inst);
+ 
++	v4l2_fh_del(&inst->fh);
++	v4l2_fh_exit(&inst->fh);
++
+ 	vpu_inst_unregister(inst);
+ 	vpu_inst_put(inst);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-fix-uninitialized-symbol-warnings.patch b/queue-6.6/media-fix-uninitialized-symbol-warnings.patch
new file mode 100644
index 0000000000..1f96e0d7f3
--- /dev/null
+++ b/queue-6.6/media-fix-uninitialized-symbol-warnings.patch
@@ -0,0 +1,113 @@
+From 169aa016b5a68917cbfdfc91839e15978c8cc629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 23:09:36 -0700
+Subject: media: fix uninitialized symbol warnings
+
+From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+
+[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
+
+Initialize variables to fix these smatch warnings
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'protocol'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'scancode'.
+drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
+symbol 'toggle'.
+drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
+symbol 'adc_envelope'.
+drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
+symbol 'lock_status'.
+drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
+symbol 'frame_lines'.
+drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
+symbol 'quality'.
+drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
+symbol 'snr'.
+drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
+symbol 'totalgain'.
+
+Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ir-kbd-i2c.c |  6 +++---
+ drivers/media/tuners/xc4000.c  |  8 ++++----
+ drivers/media/tuners/xc5000.c  | 12 ++++++------
+ 3 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
+index b37a2aaf8ac04..a8026f0f980f9 100644
+--- a/drivers/media/i2c/ir-kbd-i2c.c
++++ b/drivers/media/i2c/ir-kbd-i2c.c
+@@ -321,9 +321,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
+ 
+ static int ir_key_poll(struct IR_i2c *ir)
+ {
+-	enum rc_proto protocol;
+-	u32 scancode;
+-	u8 toggle;
++	enum rc_proto protocol = 0;
++	u32 scancode = 0;
++	u8 toggle = 0;
+ 	int rc;
+ 
+ 	dev_dbg(&ir->rc->dev, "%s\n", __func__);
+diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
+index 29bc63021c5aa..6fb3550811a28 100644
+--- a/drivers/media/tuners/xc4000.c
++++ b/drivers/media/tuners/xc4000.c
+@@ -1087,12 +1087,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
+ 
+ static void xc_debug_dump(struct xc4000_priv *priv)
+ {
+-	u16	adc_envelope;
++	u16	adc_envelope = 0;
+ 	u32	freq_error_hz = 0;
+-	u16	lock_status;
++	u16	lock_status = 0;
+ 	u32	hsync_freq_hz = 0;
+-	u16	frame_lines;
+-	u16	quality;
++	u16	frame_lines = 0;
++	u16	quality = 0;
+ 	u16	signal = 0;
+ 	u16	noise = 0;
+ 	u8	hw_majorversion = 0, hw_minorversion = 0;
+diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
+index ec9a3cd4784e1..a28481edd22ed 100644
+--- a/drivers/media/tuners/xc5000.c
++++ b/drivers/media/tuners/xc5000.c
+@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
+ 
+ static void xc_debug_dump(struct xc5000_priv *priv)
+ {
+-	u16 adc_envelope;
++	u16 adc_envelope = 0;
+ 	u32 freq_error_hz = 0;
+-	u16 lock_status;
++	u16 lock_status = 0;
+ 	u32 hsync_freq_hz = 0;
+-	u16 frame_lines;
+-	u16 quality;
+-	u16 snr;
+-	u16 totalgain;
++	u16 frame_lines = 0;
++	u16 quality = 0;
++	u16 snr = 0;
++	u16 totalgain = 0;
+ 	u8 hw_majorversion = 0, hw_minorversion = 0;
+ 	u8 fw_majorversion = 0, fw_minorversion = 0;
+ 	u16 fw_buildversion = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch b/queue-6.6/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
new file mode 100644
index 0000000000..8a99d8ae31
--- /dev/null
+++ b/queue-6.6/media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
@@ -0,0 +1,42 @@
+From d46a926e025e398f6a77b3abc75dd3123d81d778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jul 2025 15:23:56 +0200
+Subject: media: i2c: Kconfig: Ensure a dependency on HAVE_CLK for
+ VIDEO_CAMERA_SENSOR
+
+From: Mehdi Djait <mehdi.djait@linux.intel.com>
+
+[ Upstream commit 2d240b124cc9df62ccccee6054bc3d1d19018758 ]
+
+Both ACPI and DT-based systems are required to obtain the external
+camera sensor clock using the new devm_v4l2_sensor_clk_get() helper
+function.
+
+Ensure a dependency on HAVE_CLK when config VIDEO_CAMERA_SENSOR is
+enabled.
+
+Signed-off-by: Mehdi Djait <mehdi.djait@linux.intel.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 53b443be5a59e..d4082a86fcedb 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -27,7 +27,7 @@ config VIDEO_IR_I2C
+ 
+ menuconfig VIDEO_CAMERA_SENSOR
+ 	bool "Camera sensor devices"
+-	depends on MEDIA_CAMERA_SUPPORT && I2C
++	depends on MEDIA_CAMERA_SUPPORT && I2C && HAVE_CLK
+ 	select MEDIA_CONTROLLER
+ 	select V4L2_FWNODE
+ 	select VIDEO_V4L2_SUBDEV_API
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch b/queue-6.6/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
new file mode 100644
index 0000000000..12a39ce207
--- /dev/null
+++ b/queue-6.6/media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
@@ -0,0 +1,59 @@
+From ce338dcc40471a28e875f38a7be2375a94b1483e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 16:22:06 +0300
+Subject: media: i2c: og01a1b: Specify monochrome media bus format instead of
+ Bayer
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit bfbd5aa5347fbd11ade188b316b800bfb27d9e22 ]
+
+The OmniVision OG01A1B image sensor is a monochrome sensor, it supports
+8-bit and 10-bit RAW output formats only.
+
+That said the planar greyscale Y8/Y10 media formats are more appropriate
+for the sensor instead of the originally and arbitrary selected SGRBG one,
+since there is no red, green or blue color components.
+
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/og01a1b.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/og01a1b.c b/drivers/media/i2c/og01a1b.c
+index 365ce56845836..9bd204911651e 100644
+--- a/drivers/media/i2c/og01a1b.c
++++ b/drivers/media/i2c/og01a1b.c
+@@ -676,7 +676,7 @@ static void og01a1b_update_pad_format(const struct og01a1b_mode *mode,
+ {
+ 	fmt->width = mode->width;
+ 	fmt->height = mode->height;
+-	fmt->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	fmt->code = MEDIA_BUS_FMT_Y10_1X10;
+ 	fmt->field = V4L2_FIELD_NONE;
+ }
+ 
+@@ -867,7 +867,7 @@ static int og01a1b_enum_mbus_code(struct v4l2_subdev *sd,
+ 	if (code->index > 0)
+ 		return -EINVAL;
+ 
+-	code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++	code->code = MEDIA_BUS_FMT_Y10_1X10;
+ 
+ 	return 0;
+ }
+@@ -879,7 +879,7 @@ static int og01a1b_enum_frame_size(struct v4l2_subdev *sd,
+ 	if (fse->index >= ARRAY_SIZE(supported_modes))
+ 		return -EINVAL;
+ 
+-	if (fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++	if (fse->code != MEDIA_BUS_FMT_Y10_1X10)
+ 		return -EINVAL;
+ 
+ 	fse->min_width = supported_modes[fse->index].width;
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-imon-make-send_packet-more-robust.patch b/queue-6.6/media-imon-make-send_packet-more-robust.patch
new file mode 100644
index 0000000000..31b47d8622
--- /dev/null
+++ b/queue-6.6/media-imon-make-send_packet-more-robust.patch
@@ -0,0 +1,184 @@
+From 63940afe69cc67656ef342535e46daa72294e30f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jul 2025 23:21:55 +0900
+Subject: media: imon: make send_packet() more robust
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
+
+syzbot is reporting that imon has three problems which result in
+hung tasks due to forever holding device lock [1].
+
+First problem is that when usb_rx_callback_intf0() once got -EPROTO error
+after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
+resubmits urb after printk(), and resubmitted urb causes
+usb_rx_callback_intf0() to again get -EPROTO error. This results in
+printk() flooding (RCU stalls).
+
+Alan Stern commented [2] that
+
+  In theory it's okay to resubmit _if_ the driver has a robust
+  error-recovery scheme (such as giving up after some fixed limit on the
+  number of errors or after some fixed time has elapsed, perhaps with a
+  time delay to prevent a flood of errors).  Most drivers don't bother to
+  do this; they simply give up right away.  This makes them more
+  vulnerable to short-term noise interference during USB transfers, but in
+  reality such interference is quite rare.  There's nothing really wrong
+  with giving up right away.
+
+but imon has a poor error-recovery scheme which just retries forever;
+this behavior should be fixed.
+
+Since I'm not sure whether it is safe for imon users to give up upon any
+error code, this patch takes care of only union of error codes chosen from
+modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
+ir_toy, mceusb and igorplugusb).
+
+Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
+before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
+resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
+hardware after early callbacks"). Move the ictx->dev_present_intf0 test
+introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
+until intf configured") to immediately before imon_incoming_packet(), or
+the first problem explained above happens without printk() flooding (i.e.
+hung task).
+
+Third problem is that when usb_rx_callback_intf0() is not called for some
+reason (e.g. flaky hardware; the reproducer for this problem sometimes
+prevents usb_rx_callback_intf0() from being called),
+wait_for_completion_interruptible() in send_packet() never returns (i.e.
+hung task). As a workaround for such situation, change send_packet() to
+wait for completion with timeout of 10 seconds.
+
+Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
+Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
+index f4deca8894e0f..bb4aabb08c06e 100644
+--- a/drivers/media/rc/imon.c
++++ b/drivers/media/rc/imon.c
+@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
+ 		smp_rmb(); /* ensure later readers know we're not busy */
+ 		pr_err_ratelimited("error submitting urb(%d)\n", retval);
+ 	} else {
+-		/* Wait for transmission to complete (or abort) */
+-		retval = wait_for_completion_interruptible(
+-				&ictx->tx.finished);
+-		if (retval) {
++		/* Wait for transmission to complete (or abort or timeout) */
++		retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
++		if (retval <= 0) {
+ 			usb_kill_urb(ictx->tx_urb);
+ 			pr_err_ratelimited("task interrupted\n");
++			if (retval < 0)
++				ictx->tx.status = retval;
++			else
++				ictx->tx.status = -ETIMEDOUT;
+ 		}
+ 
+ 		ictx->tx.busy = false;
+@@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf0)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf0)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
+ }
+ 
+@@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 	if (!ictx)
+ 		return;
+ 
+-	/*
+-	 * if we get a callback before we're done configuring the hardware, we
+-	 * can't yet process the data, as there's nowhere to send it, but we
+-	 * still need to submit a new rx URB to avoid wedging the hardware
+-	 */
+-	if (!ictx->dev_present_intf1)
+-		goto out;
+-
+ 	switch (urb->status) {
+ 	case -ENOENT:		/* usbcore unlink successful! */
+ 		return;
+@@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
+ 		break;
+ 
+ 	case 0:
+-		imon_incoming_packet(ictx, urb, intfnum);
++		/*
++		 * if we get a callback before we're done configuring the hardware, we
++		 * can't yet process the data, as there's nowhere to send it, but we
++		 * still need to submit a new rx URB to avoid wedging the hardware
++		 */
++		if (ictx->dev_present_intf1)
++			imon_incoming_packet(ictx, urb, intfnum);
+ 		break;
+ 
++	case -ECONNRESET:
++	case -EILSEQ:
++	case -EPROTO:
++	case -EPIPE:
++		dev_warn(ictx->dev, "imon %s: status(%d)\n",
++			 __func__, urb->status);
++		return;
++
+ 	default:
+ 		dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
+ 			 __func__, urb->status);
+ 		break;
+ 	}
+ 
+-out:
+ 	usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-ov08x40-fix-the-horizontal-flip-control.patch b/queue-6.6/media-ov08x40-fix-the-horizontal-flip-control.patch
new file mode 100644
index 0000000000..e09918be2c
--- /dev/null
+++ b/queue-6.6/media-ov08x40-fix-the-horizontal-flip-control.patch
@@ -0,0 +1,39 @@
+From aeefde606db8c0090470e0ea8f1b0caed55cae67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Apr 2025 12:33:25 +0800
+Subject: media: ov08x40: Fix the horizontal flip control
+
+From: Hao Yao <hao.yao@intel.com>
+
+[ Upstream commit c7df6f339af94689fdc433887f9fbb480bf8a4ed ]
+
+The datasheet of ov08x40 doesn't match the hardware behavior.
+0x3821[2] == 1 is the original state and 0 the horizontal flip enabled.
+
+Signed-off-by: Hao Yao <hao.yao@intel.com>
+Reviewed-by: Hans de Goede <hansg@kernel.org>
+Tested-by: Hans de Goede <hansg@kernel.org> # ThinkPad X1 Carbon Gen 12 & Gen 13
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov08x40.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov08x40.c b/drivers/media/i2c/ov08x40.c
+index 637da4df69011..4d15fa6ac311e 100644
+--- a/drivers/media/i2c/ov08x40.c
++++ b/drivers/media/i2c/ov08x40.c
+@@ -2643,7 +2643,7 @@ static int ov08x40_set_ctrl_hflip(struct ov08x40 *ov08x, u32 ctrl_val)
+ 
+ 	return ov08x40_write_reg(ov08x, OV08X40_REG_MIRROR,
+ 				 OV08X40_REG_VALUE_08BIT,
+-				 ctrl_val ? val | BIT(2) : val & ~BIT(2));
++				 ctrl_val ? val & ~BIT(2) : val | BIT(2));
+ }
+ 
+ static int ov08x40_set_ctrl_vflip(struct ov08x40 *ov08x, u32 ctrl_val)
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch b/queue-6.6/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
new file mode 100644
index 0000000000..45c4498aa8
--- /dev/null
+++ b/queue-6.6/media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
@@ -0,0 +1,180 @@
+From 7a064fa5485bcc9e019aa211b4fbabe94e16def4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:29:54 +0300
+Subject: media: pci: ivtv: Don't create fake v4l2_fh
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
+
+The ivtv driver has a structure named ivtv_open_id that models an open
+file handle for the device. It embeds a v4l2_fh instance for file
+handles that correspond to a V4L2 video device, and stores a pointer to
+that v4l2_fh in struct ivtv_stream to identify which open file handle
+owns a particular stream.
+
+In addition to video devices, streams can be owned by ALSA PCM devices.
+Those devices do not make use of the v4l2_fh instance for obvious
+reasons, but the snd_ivtv_pcm_capture_open() function still initializes
+a "fake" v4l2_fh for the sole purpose of using it as an open file handle
+identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
+device is closed, leading to possible resource leaks.
+
+Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
+accessed, only the pointer value is used for comparison. Replace it with
+a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
+don't initialize the v4l2_fh for ALSA PCM devices.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-alsa-pcm.c |  2 --
+ drivers/media/pci/ivtv/ivtv-driver.h   |  3 ++-
+ drivers/media/pci/ivtv/ivtv-fileops.c  | 18 +++++++++---------
+ drivers/media/pci/ivtv/ivtv-irq.c      |  4 ++--
+ 4 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+index 8f346d7da9c8d..269a799ec046c 100644
+--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
++++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
+ 
+ 	s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
+ 
+-	v4l2_fh_init(&item.fh, &s->vdev);
+ 	item.itv = itv;
+ 	item.type = s->type;
+ 
+ 	/* See if the stream is available */
+ 	if (ivtv_claim_stream(&item, item.type)) {
+ 		/* No, it's already in use */
+-		v4l2_fh_exit(&item.fh);
+ 		snd_ivtv_unlock(itvsc);
+ 		return -EBUSY;
+ 	}
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
+index ce3a7ca51736e..df2dcef1af3f0 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.h
++++ b/drivers/media/pci/ivtv/ivtv-driver.h
+@@ -322,6 +322,7 @@ struct ivtv_queue {
+ };
+ 
+ struct ivtv;				/* forward reference */
++struct ivtv_open_id;
+ 
+ struct ivtv_stream {
+ 	/* These first four fields are always set, even if the stream
+@@ -331,7 +332,7 @@ struct ivtv_stream {
+ 	const char *name;		/* name of the stream */
+ 	int type;			/* stream type */
+ 
+-	struct v4l2_fh *fh;		/* pointer to the streaming filehandle */
++	struct ivtv_open_id *id;	/* pointer to the streaming ivtv_open_id */
+ 	spinlock_t qlock;		/* locks access to the queues */
+ 	unsigned long s_flags;		/* status flags, see above */
+ 	int dma;			/* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 4202c3a47d33e..7ed0d2d85253e 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 
+ 	if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
+ 		/* someone already claimed this stream */
+-		if (s->fh == &id->fh) {
++		if (s->id == id) {
+ 			/* yes, this file descriptor did. So that's OK. */
+ 			return 0;
+ 		}
+-		if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
++		if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ 					 type == IVTV_ENC_STREAM_TYPE_VBI)) {
+ 			/* VBI is handled already internally, now also assign
+ 			   the file descriptor to this stream for external
+ 			   reading of the stream. */
+-			s->fh = &id->fh;
++			s->id = id;
+ 			IVTV_DEBUG_INFO("Start Read VBI\n");
+ 			return 0;
+ 		}
+@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
+ 		IVTV_DEBUG_INFO("Stream %d is busy\n", type);
+ 		return -EBUSY;
+ 	}
+-	s->fh = &id->fh;
++	s->id = id;
+ 	if (type == IVTV_DEC_STREAM_TYPE_VBI) {
+ 		/* Enable reinsertion interrupt */
+ 		ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
+@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 	struct ivtv *itv = s->itv;
+ 	struct ivtv_stream *s_vbi;
+ 
+-	s->fh = NULL;
++	s->id = NULL;
+ 	if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 		/* this stream is still in use internally */
+@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
+ 		/* was already cleared */
+ 		return;
+ 	}
+-	if (s_vbi->fh) {
++	if (s_vbi->id) {
+ 		/* VBI stream still claimed by a file descriptor */
+ 		return;
+ 	}
+@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
+ 	size_t tot_written = 0;
+ 	int single_frame = 0;
+ 
+-	if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
++	if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
+ 		/* shouldn't happen */
+ 		IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
+ 		return -EIO;
+@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
+ 		     id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
+ 		    test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
+ 			/* Also used internally, don't stop capturing */
+-			s->fh = NULL;
++			s->id = NULL;
+ 		}
+ 		else {
+ 			ivtv_stop_v4l2_encode_stream(s, gop_end);
+@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
+ 	v4l2_fh_exit(fh);
+ 
+ 	/* Easy case first: this stream was never claimed by us */
+-	if (s->fh != &id->fh)
++	if (s->id != id)
+ 		goto close_done;
+ 
+ 	/* 'Unclaim' this stream */
+diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
+index e39bf64c5c715..404335e5aff4e 100644
+--- a/drivers/media/pci/ivtv/ivtv-irq.c
++++ b/drivers/media/pci/ivtv/ivtv-irq.c
+@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
+ 			ivtv_process_vbi_data(itv, buf, 0, s->type);
+ 			s->q_dma.bytesused += buf->bytesused;
+ 		}
+-		if (s->fh == NULL) {
++		if (s->id == NULL) {
+ 			ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
+ 			return;
+ 		}
+@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
+ 		set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
+ 	}
+ 
+-	if (s->fh)
++	if (s->id)
+ 		wake_up(&s->waitq);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-redrat3-use-int-type-to-store-negative-error-c.patch b/queue-6.6/media-redrat3-use-int-type-to-store-negative-error-c.patch
new file mode 100644
index 0000000000..ce8613bec6
--- /dev/null
+++ b/queue-6.6/media-redrat3-use-int-type-to-store-negative-error-c.patch
@@ -0,0 +1,40 @@
+From de0c30d2f5a138df8387307e992a6bbf457466d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 20:39:13 +0800
+Subject: media: redrat3: use int type to store negative error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
+
+Change "ret" from u8 to int type in redrat3_enable_detector() to store
+negative error codes or zero returned by redrat3_send_cmd() and
+usb_submit_urb() - this better aligns with the coding standards and
+maintains code consistency.
+
+No effect on runtime.
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/redrat3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
+index 9f2947af33aa7..880981e1c507e 100644
+--- a/drivers/media/rc/redrat3.c
++++ b/drivers/media/rc/redrat3.c
+@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
+ static int redrat3_enable_detector(struct redrat3_dev *rr3)
+ {
+ 	struct device *dev = rr3->dev;
+-	u8 ret;
++	int ret;
+ 
+ 	ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
+ 	if (ret != 0)
+-- 
+2.51.0
+
diff --git a/queue-6.6/media-verisilicon-explicitly-disable-selection-api-i.patch b/queue-6.6/media-verisilicon-explicitly-disable-selection-api-i.patch
new file mode 100644
index 0000000000..bebb2fa452
--- /dev/null
+++ b/queue-6.6/media-verisilicon-explicitly-disable-selection-api-i.patch
@@ -0,0 +1,64 @@
+From a353fced7edf8ec9a474ff30d19b1c1c2bdbc3ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 15:49:18 +0200
+Subject: media: verisilicon: Explicitly disable selection api ioctls for
+ decoders
+
+From: Paul Kocialkowski <paulk@sys-base.io>
+
+[ Upstream commit 73d50aa92f28ee8414fbfde011974fce970b82cc ]
+
+Call the dedicated v4l2_disable_ioctl helper instead of manually
+checking whether the current context is an encoder for the selection
+api ioctls.
+
+Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
+Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 6 ++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index 1874c976081f8..35833ee8beb51 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -910,6 +910,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+ 		v4l2_disable_ioctl(vfd, VIDIOC_ENCODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_G_SELECTION);
++		v4l2_disable_ioctl(vfd, VIDIOC_S_SELECTION);
+ 	}
+ 
+ 	video_set_drvdata(vfd, vpu);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index db145519fc5d3..52009c5b0db4b 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -655,8 +655,7 @@ static int vidioc_g_selection(struct file *file, void *priv,
+ 	struct hantro_ctx *ctx = fh_to_ctx(priv);
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	switch (sel->target) {
+@@ -688,8 +687,7 @@ static int vidioc_s_selection(struct file *file, void *priv,
+ 	struct vb2_queue *vq;
+ 
+ 	/* Crop only supported on source. */
+-	if (!ctx->is_encoder ||
+-	    sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
++	if (sel->type != V4L2_BUF_TYPE_VIDEO_OUTPUT)
+ 		return -EINVAL;
+ 
+ 	/* Change not allowed if the queue is streaming. */
+-- 
+2.51.0
+
diff --git a/queue-6.6/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch b/queue-6.6/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
new file mode 100644
index 0000000000..43c0b8e6bc
--- /dev/null
+++ b/queue-6.6/mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
@@ -0,0 +1,36 @@
+From 034560077a4339f11ac4c42c99adcdcc3ae1a153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:34:13 +0200
+Subject: mips: lantiq: danube: add missing device_type in pci node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
+	from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 0a942bc091436..650400bd5725f 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -104,6 +104,8 @@
+ 				  0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
+ 			reg = <0x7000000 0x8000		/* config space */
+ 				0xe105400 0x400>;	/* pci bridge */
++
++			device_type = "pci";
+ 		};
+ 	};
+ };
+-- 
+2.51.0
+
diff --git a/queue-6.6/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch b/queue-6.6/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
new file mode 100644
index 0000000000..0423cb902e
--- /dev/null
+++ b/queue-6.6/mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
@@ -0,0 +1,44 @@
+From 680524eab0834fb4c84c8fac7eb76e15ae930767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 13:58:15 +0200
+Subject: mips: lantiq: danube: add missing properties to cpu node
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
+
+This fixes the following warnings:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
+	from schema $id: http://devicetree.org/schemas/cpus.yaml#
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
+	from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
+index 7a7ba66aa5349..0a942bc091436 100644
+--- a/arch/mips/boot/dts/lantiq/danube.dtsi
++++ b/arch/mips/boot/dts/lantiq/danube.dtsi
+@@ -5,8 +5,12 @@
+ 	compatible = "lantiq,xway", "lantiq,danube";
+ 
+ 	cpus {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
+ 		cpu@0 {
+ 			compatible = "mips,mips24Kc";
++			reg = <0>;
+ 		};
+ 	};
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/mips-lantiq-danube-add-model-to-easy50712-dts.patch b/queue-6.6/mips-lantiq-danube-add-model-to-easy50712-dts.patch
new file mode 100644
index 0000000000..7dc042afd9
--- /dev/null
+++ b/queue-6.6/mips-lantiq-danube-add-model-to-easy50712-dts.patch
@@ -0,0 +1,36 @@
+From c520cefc93297d793d65971b8274b49e97221c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 16:06:04 +0200
+Subject: mips: lantiq: danube: add model to EASY50712 dts
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit cb96fd880ef78500b34d10fa76ddd3fa070287d6 ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: / (lantiq,xway): 'model' is a required property
+	from schema $id: http://devicetree.org/schemas/root-node.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index c4d7aa5753b04..ab70028dbefcf 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -4,6 +4,8 @@
+ /include/ "danube.dtsi"
+ 
+ / {
++	model = "Intel EASY50712";
++
+ 	chosen {
+ 		bootargs = "console=ttyLTQ0,115200 init=/etc/preinit";
+ 	};
+-- 
+2.51.0
+
diff --git a/queue-6.6/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch b/queue-6.6/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
new file mode 100644
index 0000000000..11d93c6449
--- /dev/null
+++ b/queue-6.6/mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
@@ -0,0 +1,36 @@
+From 98f331e2877a89afc1d88b628f51d1356021f41c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:24 +0200
+Subject: mips: lantiq: danube: rename stp node on EASY50712 reference board
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit 2b9706ce84be9cb26be03e1ad2e43ec8bc3986be ]
+
+This fixes the following warning:
+arch/mips/boot/dts/lantiq/danube_easy50712.dtb: stp@e100bb0 (lantiq,gpio-stp-xway): $nodename:0: 'stp@e100bb0' does not match '^gpio@[0-9a-f]+$'
+	from schema $id: http://devicetree.org/schemas/gpio/gpio-stp-xway.yaml#
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+index ab70028dbefcf..c9f7886f57b8c 100644
+--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
++++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+@@ -96,7 +96,7 @@
+ 			lantiq,tx-burst-length = <4>;
+ 		};
+ 
+-		stp0: stp@e100bb0 {
++		stp0: gpio@e100bb0 {
+ 			#gpio-cells = <2>;
+ 			compatible = "lantiq,gpio-stp-xway";
+ 			gpio-controller;
+-- 
+2.51.0
+
diff --git a/queue-6.6/mips-lantiq-xway-sysctrl-rename-stp-clock.patch b/queue-6.6/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
new file mode 100644
index 0000000000..be7a4d4287
--- /dev/null
+++ b/queue-6.6/mips-lantiq-xway-sysctrl-rename-stp-clock.patch
@@ -0,0 +1,38 @@
+From 5d9a0b0a00e6409f31efb713f3ebda2be2b39fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 14:12:23 +0200
+Subject: mips: lantiq: xway: sysctrl: rename stp clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+
+[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
+
+Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
+changes the clock name from “stp” to “gpio”.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/lantiq/xway/sysctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index 4c72b59fdf98c..492f375bf1290 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -466,7 +466,7 @@ void __init ltq_soc_init(void)
+ 	/* add our generic xway clocks */
+ 	clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
+ 	clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
+-	clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
++	clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
+ 	clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
+ 	clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
+ 	clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch b/queue-6.6/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
new file mode 100644
index 0000000000..8739393bab
--- /dev/null
+++ b/queue-6.6/net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
@@ -0,0 +1,82 @@
+From 8e380a4348d2a2362d968bcf9f20729181b1037b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 16:14:48 +0200
+Subject: net: bridge: Install FDB for bridge MAC on VLAN 0
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit cd9a9562b2559973aa1b68c3af63021a2c5fd022 ]
+
+Currently, after the bridge is created, the FDB does not hold an FDB entry
+for the bridge MAC on VLAN 0:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        92:19:8c:4e:01:ed <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb show | grep 92:19:8c:4e:01:ed
+ 92:19:8c:4e:01:ed dev br vlan 1 master br permanent
+
+Later when the bridge MAC is changed, or in fact when the address is given
+during netdevice creation, the entry appears:
+
+ # ip link add name br up address 00:11:22:33:44:55 type bridge
+ # bridge fdb show | grep 00:11:22:33:44:55
+ 00:11:22:33:44:55 dev br vlan 1 master br permanent
+ 00:11:22:33:44:55 dev br master br permanent
+
+However when the bridge address is set by the user to the current bridge
+address before the first port is enslaved, none of the address handlers
+gets invoked, because the address is not actually changed. The address is
+however marked as NET_ADDR_SET. Then when a port is enslaved, the address
+is not changed, because it is NET_ADDR_SET. Thus the VLAN 0 entry is not
+added, and it has not been added previously either:
+
+ # ip link add name br up type bridge
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # ip link set dev br addr 7e:f0:a8:1a:be:c2
+ # ip link add name v up type veth
+ # ip link set dev v master br
+ # ip -br link show dev br
+ br               UNKNOWN        7e:f0:a8:1a:be:c2 <BROADCAST,MULTICAST,UP,LOWER_UP>
+ # bridge fdb | grep 7e:f0:a8:1a:be:c2
+ 7e:f0:a8:1a:be:c2 dev br vlan 1 master br permanent
+
+Then when the bridge MAC is used as DMAC, and br_handle_frame_finish()
+looks up an FDB entry with VLAN=0, it doesn't find any, and floods the
+traffic instead of passing it up.
+
+Fix this by simply adding the VLAN 0 FDB entry for the bridge itself always
+on netdevice creation. This also makes the behavior consistent with how
+ports are treated: ports always have an FDB entry for each member VLAN as
+well as VLAN 0.
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/415202b2d1b9b0899479a502bbe2ba188678f192.1758550408.git.petrm@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/br.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index a45db67197226..d466febcf9abe 100644
+--- a/net/bridge/br.c
++++ b/net/bridge/br.c
+@@ -37,6 +37,11 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
+ 	int err;
+ 
+ 	if (netif_is_bridge_master(dev)) {
++		struct net_bridge *br = netdev_priv(dev);
++
++		if (event == NETDEV_REGISTER)
++			br_fdb_change_mac_address(br, dev->dev_addr);
++
+ 		err = br_vlan_bridge_event(dev, event, ptr);
+ 		if (err)
+ 			return notifier_from_errno(err);
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-call-cond_resched-less-often-in-__release_sock.patch b/queue-6.6/net-call-cond_resched-less-often-in-__release_sock.patch
new file mode 100644
index 0000000000..846d545821
--- /dev/null
+++ b/queue-6.6/net-call-cond_resched-less-often-in-__release_sock.patch
@@ -0,0 +1,109 @@
+From e7a494737185a7bfefa2d5e57787a2e59600f271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 17:48:10 +0000
+Subject: net: call cond_resched() less often in __release_sock()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
+
+While stress testing TCP I had unexpected retransmits and sack packets
+when a single cpu receives data from multiple high-throughput flows.
+
+super_netperf 4 -H srv -T,10 -l 3000 &
+
+Tcpdump extract:
+
+ 00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
+ 00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
+ 00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
+ 00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
+ 00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
+ 00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
+ 00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
+ 00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
+
+After analysis, it appears this is because of the cond_resched()
+call from  __release_sock().
+
+When current thread is yielding, while still holding the TCP socket lock,
+it might regain the cpu after a very long time.
+
+Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
+while the initial copy is waiting in the socket backlog or receive queue.
+
+In this patch, I call cond_resched() only once every 16 packets.
+
+Modern TCP stack now spends less time per packet in the backlog,
+especially because ACK are no longer sent (commit 133c4c0d3717
+"tcp: defer regular ACK while processing socket backlog")
+
+Before:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19046186           0.0
+TcpRetransSegs                  1471               0.0
+TcpExtTCPTimeouts               1397               0.0
+TcpExtTCPLossProbes             1356               0.0
+TcpExtTCPDSACKRecv              1352               0.0
+TcpExtTCPSpuriousRTOs           114                0.0
+TcpExtTCPDSACKRecvSegs          1352               0.0
+
+After:
+
+clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
+TcpOutSegs                      19218936           0.0
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
+Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 23c11c656dafa..91f101231309d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2996,23 +2996,27 @@ void __release_sock(struct sock *sk)
+ 	__acquires(&sk->sk_lock.slock)
+ {
+ 	struct sk_buff *skb, *next;
++	int nb = 0;
+ 
+ 	while ((skb = sk->sk_backlog.head) != NULL) {
+ 		sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
+ 
+ 		spin_unlock_bh(&sk->sk_lock.slock);
+ 
+-		do {
++		while (1) {
+ 			next = skb->next;
+ 			prefetch(next);
+ 			DEBUG_NET_WARN_ON_ONCE(skb_dst_is_noref(skb));
+ 			skb_mark_not_on_list(skb);
+ 			sk_backlog_rcv(sk, skb);
+ 
+-			cond_resched();
+-
+ 			skb = next;
+-		} while (skb != NULL);
++			if (!skb)
++				break;
++
++			if (!(++nb & 15))
++				cond_resched();
++		}
+ 
+ 		spin_lock_bh(&sk->sk_lock.slock);
+ 	}
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch b/queue-6.6/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
new file mode 100644
index 0000000000..378f76a995
--- /dev/null
+++ b/queue-6.6/net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
@@ -0,0 +1,48 @@
+From 2edf4b93f9af6a429cc12a6307c400444af79ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 20:16:12 +0000
+Subject: net: Call trace_sock_exceed_buf_limit() for memcg failure with
+ SK_MEM_RECV.
+
+From: Kuniyuki Iwashima <kuniyu@google.com>
+
+[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
+
+Initially, trace_sock_exceed_buf_limit() was invoked when
+__sk_mem_raise_allocated() failed due to the memcg limit or the
+global limit.
+
+However, commit d6f19938eb031 ("net: expose sk wmem in
+sock_exceed_buf_limit tracepoint") somehow suppressed the event
+only when memcg failed to charge for SK_MEM_RECV, although the
+memcg failure for SK_MEM_SEND still triggers the event.
+
+Let's restore the event for SK_MEM_RECV.
+
+Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 9918a9a337b61..23c11c656dafa 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3141,8 +3141,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ 		}
+ 	}
+ 
+-	if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
+-		trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
++	trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ 
+ 	sk_memory_allocated_sub(sk, amt);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch b/queue-6.6/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
new file mode 100644
index 0000000000..997ba9fe91
--- /dev/null
+++ b/queue-6.6/net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
@@ -0,0 +1,107 @@
+From 849b7eb403dfc64b0186ac254939a045c0328842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 14:29:33 +0800
+Subject: net/cls_cgroup: Fix task_get_classid() during qdisc run
+
+From: Yafang Shao <laoar.shao@gmail.com>
+
+[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
+
+During recent testing with the netem qdisc to inject delays into TCP
+traffic, we observed that our CLS BPF program failed to function correctly
+due to incorrect classid retrieval from task_get_classid(). The issue
+manifests in the following call stack:
+
+        bpf_get_cgroup_classid+5
+        cls_bpf_classify+507
+        __tcf_classify+90
+        tcf_classify+217
+        __dev_queue_xmit+798
+        bond_dev_queue_xmit+43
+        __bond_start_xmit+211
+        bond_start_xmit+70
+        dev_hard_start_xmit+142
+        sch_direct_xmit+161
+        __qdisc_run+102             <<<<< Issue location
+        __dev_xmit_skb+1015
+        __dev_queue_xmit+637
+        neigh_hh_output+159
+        ip_finish_output2+461
+        __ip_finish_output+183
+        ip_finish_output+41
+        ip_output+120
+        ip_local_out+94
+        __ip_queue_xmit+394
+        ip_queue_xmit+21
+        __tcp_transmit_skb+2169
+        tcp_write_xmit+959
+        __tcp_push_pending_frames+55
+        tcp_push+264
+        tcp_sendmsg_locked+661
+        tcp_sendmsg+45
+        inet_sendmsg+67
+        sock_sendmsg+98
+        sock_write_iter+147
+        vfs_write+786
+        ksys_write+181
+        __x64_sys_write+25
+        do_syscall_64+56
+        entry_SYSCALL_64_after_hwframe+100
+
+The problem occurs when multiple tasks share a single qdisc. In such cases,
+__qdisc_run() may transmit skbs created by different tasks. Consequently,
+task_get_classid() retrieves an incorrect classid since it references the
+current task's context rather than the skb's originating task.
+
+Given that dev_queue_xmit() always executes with bh disabled, we can use
+softirq_count() instead to obtain the correct classid.
+
+The simple steps to reproduce this issue:
+1. Add network delay to the network interface:
+  such as: tc qdisc add dev bond0 root netem delay 1.5ms
+2. Build two distinct net_cls cgroups, each with a network-intensive task
+3. Initiate parallel TCP streams from both tasks to external servers.
+
+Under this specific condition, the issue reliably occurs. The kernel
+eventually dequeues an SKB that originated from Task-A while executing in
+the context of Task-B.
+
+It is worth noting that it will change the established behavior for a
+slightly different scenario:
+
+  <sock S is created by task A>
+  <class ID for task A is changed>
+  <skb is created by sock S xmit and classified>
+
+prior to this patch the skb will be classified with the 'new' task A
+classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
+function is a more appropriate choice for this case.
+
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Thomas Graf <tgraf@suug.ch>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Nikolay Aleksandrov <razor@blackwall.org>
+Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cls_cgroup.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
+index 7e78e7d6f0152..668aeee9b3f66 100644
+--- a/include/net/cls_cgroup.h
++++ b/include/net/cls_cgroup.h
+@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
+ 	 * calls by looking at the number of nested bh disable calls because
+ 	 * softirqs always disables bh.
+ 	 */
+-	if (in_serving_softirq()) {
++	if (softirq_count()) {
+ 		struct sock *sk = skb_to_full_sk(skb);
+ 
+ 		/* If there is an sock_cgroup_classid we'll use that. */
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-ethernet-microchip-sparx5-make-it-selectable-for.patch b/queue-6.6/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
new file mode 100644
index 0000000000..f6538429e9
--- /dev/null
+++ b/queue-6.6/net-ethernet-microchip-sparx5-make-it-selectable-for.patch
@@ -0,0 +1,37 @@
+From 824bde630479a3c7048d5bb95f553daf271b1ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 13:00:24 +0200
+Subject: net: ethernet: microchip: sparx5: make it selectable for ARCH_LAN969X
+
+From: Robert Marko <robert.marko@sartura.hr>
+
+[ Upstream commit 6287982aa54946449bccff3e6488d3a15e458392 ]
+
+LAN969x switchdev support depends on the SparX-5 core,so make it selectable
+for ARCH_LAN969X.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
+Link: https://patch.msgid.link/20250917110106.55219-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/microchip/sparx5/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/microchip/sparx5/Kconfig b/drivers/net/ethernet/microchip/sparx5/Kconfig
+index f58c506bda228..15b27fc57aedd 100644
+--- a/drivers/net/ethernet/microchip/sparx5/Kconfig
++++ b/drivers/net/ethernet/microchip/sparx5/Kconfig
+@@ -3,7 +3,7 @@ config SPARX5_SWITCH
+ 	depends on NET_SWITCHDEV
+ 	depends on HAS_IOMEM
+ 	depends on OF
+-	depends on ARCH_SPARX5 || COMPILE_TEST
++	depends on ARCH_SPARX5 || ARCH_LAN969X || COMPILE_TEST
+ 	depends on PTP_1588_CLOCK_OPTIONAL
+ 	depends on BRIDGE || BRIDGE=n
+ 	select PHYLINK
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch b/queue-6.6/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
new file mode 100644
index 0000000000..90fb517a07
--- /dev/null
+++ b/queue-6.6/net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
@@ -0,0 +1,92 @@
+From 42b05745ed611792b1b256b804bbd46d4ba79b0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 12:54:22 +0530
+Subject: net: intel: fm10k: Fix parameter idx set but not used
+
+From: Brahmajit Das <listout@listout.xyz>
+
+[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
+
+Variable idx is set in the loop, but is never used resulting in dead
+code. Building with GCC 16, which enables
+-Werror=unused-but-set-parameter= by default results in build error.
+This patch removes the idx parameter, since all the callers of the
+fm10k_unbind_hw_stats_q as 0 as idx anyways.
+
+Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: Brahmajit Das <listout@listout.xyz>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
+ drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_pf.c     | 2 +-
+ drivers/net/ethernet/intel/fm10k/fm10k_vf.c     | 2 +-
+ 4 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+index f51a63fca513e..1f919a50c7653 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ /**
+  *  fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
+  *  @q: pointer to the ring of hardware statistics queue
+- *  @idx: index pointing to the start of the ring iteration
+  *  @count: number of queues to iterate over
+  *
+  *  Function invalidates the index values for the queues so any updates that
+  *  may have happened are ignored and the base for the queue stats is reset.
+  **/
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
+ {
+ 	u32 i;
+ 
+-	for (i = 0; i < count; i++, idx++, q++) {
++	for (i = 0; i < count; i++, q++) {
+ 		q->rx_stats_idx = 0;
+ 		q->tx_stats_idx = 0;
+ 	}
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+index 4c48fb73b3e78..13fca6a91a01b 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
+ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
+ 			     u32 idx, u32 count);
+ #define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
+-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
++void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
+ s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
+ #endif /* _FM10K_COMMON_H_ */
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+index aed5e0bf6313e..b51b6003ad032 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+@@ -1510,7 +1510,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
+ 	fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
+ 
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_pf(hw, stats);
+diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+index 7fb1961f29210..6861a0bdc14e1 100644
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
+ 				     struct fm10k_hw_stats *stats)
+ {
+ 	/* Unbind Queue Statistics */
+-	fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
++	fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
+ 
+ 	/* Reinitialize bases for all stats */
+ 	fm10k_update_hw_stats_vf(hw, stats);
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch b/queue-6.6/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
new file mode 100644
index 0000000000..6bd4eaeae9
--- /dev/null
+++ b/queue-6.6/net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
@@ -0,0 +1,117 @@
+From 414d48aaa2c0d586f230c49be1927114aa0330cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:51:25 +0000
+Subject: net: ipv6: fix field-spanning memcpy warning in AH output
+
+From: Charalampos Mitrodimas <charmitro@posteo.net>
+
+[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
+
+Fix field-spanning memcpy warnings in ah6_output() and
+ah6_output_done() where extension headers are copied to/from IPv6
+address fields, triggering fortify-string warnings about writes beyond
+the 16-byte address fields.
+
+  memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
+  WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
+
+The warnings are false positives as the extension headers are
+intentionally placed after the IPv6 header in memory. Fix by properly
+copying addresses and extension headers separately, and introduce
+helper functions to avoid code duplication.
+
+Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
+Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 01005035ad101..5361e2107458f 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -46,6 +46,34 @@ struct ah_skb_cb {
+ 
+ #define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+ 
++/* Helper to save IPv6 addresses and extension headers to temporary storage */
++static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
++				 struct ipv6hdr *top_iph, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	iph_ext->saddr = top_iph->saddr;
++#endif
++	iph_ext->daddr = top_iph->daddr;
++	memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
++}
++
++/* Helper to restore IPv6 addresses and extension headers from temporary storage */
++static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
++				    struct tmp_ext *iph_ext, int extlen)
++{
++	if (!extlen)
++		return;
++
++#if IS_ENABLED(CONFIG_IPV6_MIP6)
++	top_iph->saddr = iph_ext->saddr;
++#endif
++	top_iph->daddr = iph_ext->daddr;
++	memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
++}
++
+ static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+ 			  unsigned int size)
+ {
+@@ -304,13 +332,7 @@ static void ah6_output_done(void *data, int err)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ 	kfree(AH_SKB_CB(skb)->tmp);
+ 	xfrm_output_resume(skb->sk, skb, err);
+@@ -381,12 +403,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	 */
+ 	memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ 
++	ah6_save_hdrs(iph_ext, top_iph, extlen);
+ 	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(iph_ext, &top_iph->saddr, extlen);
+-#else
+-		memcpy(iph_ext, &top_iph->daddr, extlen);
+-#endif
+ 		err = ipv6_clear_mutable_options(top_iph,
+ 						 extlen - sizeof(*iph_ext) +
+ 						 sizeof(*top_iph),
+@@ -437,13 +455,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ 	memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+ 	memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+ 
+-	if (extlen) {
+-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+-		memcpy(&top_iph->saddr, iph_ext, extlen);
+-#else
+-		memcpy(&top_iph->daddr, iph_ext, extlen);
+-#endif
+-	}
++	ah6_restore_hdrs(top_iph, iph_ext, extlen);
+ 
+ out_free:
+ 	kfree(iph_base);
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch b/queue-6.6/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
new file mode 100644
index 0000000000..7ffc2b82c5
--- /dev/null
+++ b/queue-6.6/net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
@@ -0,0 +1,57 @@
+From fdc32e94d9ba5396acdc94a5edc35b41b021c988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Sep 2025 18:00:27 +0200
+Subject: net: macb: avoid dealing with endianness in macb_set_hwaddr()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
+
+bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
+pointer and dereferencing implies dealing manually with endianness,
+which is error-prone.
+
+Replace by calls to get_unaligned_le32|le16() helpers.
+
+This was found using sparse:
+   ⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
+   warning: incorrect type in assignment (different base types)
+      expected unsigned int [usertype] bottom
+      got restricted __le32 [usertype]
+   warning: incorrect type in assignment (different base types)
+      expected unsigned short [usertype] top
+      got restricted __le16 [usertype]
+   ...
+
+Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index b836ab2a649a2..7593255e6e53d 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -281,9 +281,9 @@ static void macb_set_hwaddr(struct macb *bp)
+ 	u32 bottom;
+ 	u16 top;
+ 
+-	bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
++	bottom = get_unaligned_le32(bp->dev->dev_addr);
+ 	macb_or_gem_writel(bp, SA1B, bottom);
+-	top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
++	top = get_unaligned_le16(bp->dev->dev_addr + 4);
+ 	macb_or_gem_writel(bp, SA1T, top);
+ 
+ 	if (gem_has_ptp(bp)) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch b/queue-6.6/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
new file mode 100644
index 0000000000..8c3826ea78
--- /dev/null
+++ b/queue-6.6/net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
@@ -0,0 +1,66 @@
+From bdcde1c78ed2c813187cccdbbb6575edd54275f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Sep 2025 12:40:34 +0000
+Subject: net/mlx5e: Don't query FEC statistics when FEC is disabled
+
+From: Carolina Jubran <cjubran@nvidia.com>
+
+[ Upstream commit 6b81b8a0b1978284e007566d7a1607b47f92209f ]
+
+Update mlx5e_stats_fec_get() to check the active FEC mode and skip
+statistics collection when FEC is disabled.
+
+Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
+Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Yael Chemla <ychemla@nvidia.com>
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
+Link: https://patch.msgid.link/20250924124037.1508846-3-vadim.fedorenko@linux.dev
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 4b96ad657145b..1c69244e00d75 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -1339,16 +1339,13 @@ static void fec_set_rs_stats(struct ethtool_fec_stats *fec_stats, u32 *ppcnt)
+ }
+ 
+ static void fec_set_block_stats(struct mlx5e_priv *priv,
++				int mode,
+ 				struct ethtool_fec_stats *fec_stats)
+ {
+ 	struct mlx5_core_dev *mdev = priv->mdev;
+ 	u32 out[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	u32 in[MLX5_ST_SZ_DW(ppcnt_reg)] = {};
+ 	int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+-	int mode = fec_active_mode(mdev);
+-
+-	if (mode == MLX5E_FEC_NOFEC)
+-		return;
+ 
+ 	MLX5_SET(ppcnt_reg, in, local_port, 1);
+ 	MLX5_SET(ppcnt_reg, in, grp, MLX5_PHYSICAL_LAYER_COUNTERS_GROUP);
+@@ -1389,11 +1386,14 @@ static void fec_set_corrected_bits_total(struct mlx5e_priv *priv,
+ void mlx5e_stats_fec_get(struct mlx5e_priv *priv,
+ 			 struct ethtool_fec_stats *fec_stats)
+ {
+-	if (!MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
++	int mode = fec_active_mode(priv->mdev);
++
++	if (mode == MLX5E_FEC_NOFEC ||
++	    !MLX5_CAP_PCAM_FEATURE(priv->mdev, ppcnt_statistical_group))
+ 		return;
+ 
+ 	fec_set_corrected_bits_total(priv, fec_stats);
+-	fec_set_block_stats(priv, fec_stats);
++	fec_set_block_stats(priv, mode, fec_stats);
+ }
+ 
+ #define PPORT_ETH_EXT_OFF(c) \
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch b/queue-6.6/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
new file mode 100644
index 0000000000..d3e672548c
--- /dev/null
+++ b/queue-6.6/net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
@@ -0,0 +1,47 @@
+From 67e0f293e736a84d3084e74fc9a10a9cb85dc744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 13:36:28 +0200
+Subject: net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juraj Å arinay <juraj@sarinay.com>
+
+[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
+
+An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
+A delay of 700 ms is not sufficient for cryptographic operations on smart
+cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
+or 3072-bit RSA. To prevent brute-force attacks, passports and similar
+documents introduce even longer delays into access control protocols
+(BAC/PACE).
+
+The timeout should be higher, but not too much. The expiration allows
+us to detect that a NFC target has disappeared.
+
+Signed-off-by: Juraj Å arinay <juraj@sarinay.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/nfc/nci_core.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
+index ea8595651c384..e066bdbc807be 100644
+--- a/include/net/nfc/nci_core.h
++++ b/include/net/nfc/nci_core.h
+@@ -52,7 +52,7 @@ enum nci_state {
+ #define NCI_RF_DISC_SELECT_TIMEOUT		5000
+ #define NCI_RF_DEACTIVATE_TIMEOUT		30000
+ #define NCI_CMD_TIMEOUT				5000
+-#define NCI_DATA_TIMEOUT			700
++#define NCI_DATA_TIMEOUT			3000
+ 
+ struct nci_dev;
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-phy-clear-link-parameters-on-admin-link-down.patch b/queue-6.6/net-phy-clear-link-parameters-on-admin-link-down.patch
new file mode 100644
index 0000000000..247db09c97
--- /dev/null
+++ b/queue-6.6/net-phy-clear-link-parameters-on-admin-link-down.patch
@@ -0,0 +1,62 @@
+From a6dcbd07bc42d6d44127d137f22468bda1a137b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Sep 2025 11:47:51 +0200
+Subject: net: phy: clear link parameters on admin link down
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 60f887b1290b43a4f5a3497982a725687b193fa4 ]
+
+When a PHY is halted (e.g. `ip link set dev lan2 down`), several
+fields in struct phy_device may still reflect the last active
+connection. This leads to ethtool showing stale values even though
+the link is down.
+
+Reset selected fields in _phy_state_machine() when transitioning
+to PHY_HALTED and the link was previously up:
+
+- speed/duplex -> UNKNOWN, but only in autoneg mode (in forced mode
+  these fields carry configuration, not status)
+- master_slave_state -> UNKNOWN if previously supported
+- mdix -> INVALID (state only, same meaning as "unknown")
+- lp_advertising -> always cleared
+
+The cleanup is skipped if the PHY is in PHY_ERROR state, so the
+last values remain available for diagnostics.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250917094751.2101285-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index df54c137c5f5f..cf171bdd667aa 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -1482,6 +1482,19 @@ void phy_state_machine(struct work_struct *work)
+ 		}
+ 		break;
+ 	case PHY_HALTED:
++		if (phydev->link) {
++			if (phydev->autoneg == AUTONEG_ENABLE) {
++				phydev->speed = SPEED_UNKNOWN;
++				phydev->duplex = DUPLEX_UNKNOWN;
++			}
++			if (phydev->master_slave_state !=
++						MASTER_SLAVE_STATE_UNSUPPORTED)
++				phydev->master_slave_state =
++						MASTER_SLAVE_STATE_UNKNOWN;
++			phydev->mdix = ETH_TP_MDI_INVALID;
++			linkmode_zero(phydev->lp_advertising);
++		}
++		fallthrough;
+ 	case PHY_ERROR:
+ 		if (phydev->link) {
+ 			phydev->link = 0;
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch b/queue-6.6/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
new file mode 100644
index 0000000000..9067405c95
--- /dev/null
+++ b/queue-6.6/net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
@@ -0,0 +1,74 @@
+From 3bd838ba33725c9f72b5aa244b71afd752fd5844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Aug 2025 23:25:05 +0200
+Subject: net: phy: fixed_phy: let fixed_phy_unregister free the phy_device
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit a0f849c1cc6df0db9083b4c81c05a5456b1ed0fb ]
+
+fixed_phy_register() creates and registers the phy_device. To be
+symmetric, we should not only unregister, but also free the phy_device
+in fixed_phy_unregister(). This allows to simplify code in users.
+
+Note wrt of_phy_deregister_fixed_link():
+put_device(&phydev->mdio.dev) and phy_device_free(phydev) are identical.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Link: https://patch.msgid.link/ad8dda9a-10ed-4060-916b-3f13bdbb899d@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/dsa_loop.c  | 9 +++------
+ drivers/net/mdio/of_mdio.c  | 1 -
+ drivers/net/phy/fixed_phy.c | 1 +
+ 3 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/dsa_loop.c b/drivers/net/dsa/dsa_loop.c
+index 5b139f2206b6e..48cf9d300bbf5 100644
+--- a/drivers/net/dsa/dsa_loop.c
++++ b/drivers/net/dsa/dsa_loop.c
+@@ -378,13 +378,10 @@ static struct mdio_driver dsa_loop_drv = {
+ 
+ static void dsa_loop_phydevs_unregister(void)
+ {
+-	unsigned int i;
+-
+-	for (i = 0; i < NUM_FIXED_PHYS; i++)
+-		if (!IS_ERR(phydevs[i])) {
++	for (int i = 0; i < NUM_FIXED_PHYS; i++) {
++		if (!IS_ERR(phydevs[i]))
+ 			fixed_phy_unregister(phydevs[i]);
+-			phy_device_free(phydevs[i]);
+-		}
++	}
+ }
+ 
+ static int __init dsa_loop_init(void)
+diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c
+index 7eb32ebb846d8..15b72203a2584 100644
+--- a/drivers/net/mdio/of_mdio.c
++++ b/drivers/net/mdio/of_mdio.c
+@@ -440,6 +440,5 @@ void of_phy_deregister_fixed_link(struct device_node *np)
+ 	fixed_phy_unregister(phydev);
+ 
+ 	put_device(&phydev->mdio.dev);	/* of_phy_find_device() */
+-	phy_device_free(phydev);	/* fixed_phy_register() */
+ }
+ EXPORT_SYMBOL(of_phy_deregister_fixed_link);
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index aef739c20ac4d..4694fb3eaa2ff 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -329,6 +329,7 @@ void fixed_phy_unregister(struct phy_device *phy)
+ 	phy_device_remove(phy);
+ 	of_node_put(phy->mdio.dev.of_node);
+ 	fixed_phy_del(phy->mdio.addr);
++	phy_device_free(phy);
+ }
+ EXPORT_SYMBOL_GPL(fixed_phy_unregister);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch b/queue-6.6/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
new file mode 100644
index 0000000000..3d491e155b
--- /dev/null
+++ b/queue-6.6/net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
@@ -0,0 +1,89 @@
+From 62eabcfd974925e3e65fc74e1455e832b0f3bde7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Sep 2025 10:33:31 +0800
+Subject: net: phy: marvell: Fix 88e1510 downshift counter errata
+
+From: Rohan G Thomas <rohan.g.thomas@altera.com>
+
+[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
+
+The 88e1510 PHY has an erratum where the phy downshift counter is not
+cleared after phy being suspended(BMCR_PDOWN set) and then later
+resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
+intermittently downshift to a lower speed.
+
+Disabling and re-enabling the downshift feature clears the counter,
+allowing the PHY to retry gigabit link negotiation up to the programmed
+retry count times before downshifting. This behavior has been observed
+on copper links.
+
+Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
+Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 38 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
+index eba652a4c1d88..760d0d2f791ca 100644
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -1802,6 +1802,43 @@ static int marvell_resume(struct phy_device *phydev)
+ 	return err;
+ }
+ 
++/* m88e1510_resume
++ *
++ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
++ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
++ * cleared). This can cause the link to intermittently downshift to a lower speed.
++ *
++ * Disabling and re-enabling the downshift feature clears the counter, allowing
++ * the PHY to retry gigabit link negotiation up to the programmed retry count
++ * before downshifting. This behavior has been observed on copper links.
++ */
++static int m88e1510_resume(struct phy_device *phydev)
++{
++	int err;
++	u8 cnt = 0;
++
++	err = marvell_resume(phydev);
++	if (err < 0)
++		return err;
++
++	/* read downshift counter value */
++	err = m88e1011_get_downshift(phydev, &cnt);
++	if (err < 0)
++		return err;
++
++	if (cnt) {
++		/* downshift disabled */
++		err = m88e1011_set_downshift(phydev, 0);
++		if (err < 0)
++			return err;
++
++		/* downshift enabled, with previous counter value */
++		err = m88e1011_set_downshift(phydev, cnt);
++	}
++
++	return err;
++}
++
+ static int marvell_aneg_done(struct phy_device *phydev)
+ {
+ 	int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
+@@ -3506,7 +3543,7 @@ static struct phy_driver marvell_drivers[] = {
+ 		.handle_interrupt = marvell_handle_interrupt,
+ 		.get_wol = m88e1318_get_wol,
+ 		.set_wol = m88e1318_set_wol,
+-		.resume = marvell_resume,
++		.resume = m88e1510_resume,
+ 		.suspend = marvell_suspend,
+ 		.read_page = marvell_read_page,
+ 		.write_page = marvell_write_page,
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-sh_eth-disable-wol-if-system-can-not-suspend.patch b/queue-6.6/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
new file mode 100644
index 0000000000..4fbb298a8f
--- /dev/null
+++ b/queue-6.6/net-sh_eth-disable-wol-if-system-can-not-suspend.patch
@@ -0,0 +1,59 @@
+From 0d4946f766923668f4fa33523772e9a46e0044f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 10:58:49 +0200
+Subject: net: sh_eth: Disable WoL if system can not suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
+
+The MAC can't facilitate WoL if the system can't go to sleep. Gate the
+WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 0c0fd68ded423..4597c4e9b297b 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2360,6 +2360,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
+ static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ {
+ 	struct sh_eth_private *mdp = netdev_priv(ndev);
+@@ -2386,6 +2387,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
+ 
+ 	return 0;
+ }
++#endif
+ 
+ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.get_regs_len	= sh_eth_get_regs_len,
+@@ -2401,8 +2403,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
+ 	.set_ringparam	= sh_eth_set_ringparam,
+ 	.get_link_ksettings = phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings = phy_ethtool_set_link_ksettings,
++#ifdef CONFIG_PM_SLEEP
+ 	.get_wol	= sh_eth_get_wol,
+ 	.set_wol	= sh_eth_set_wol,
++#endif
+ };
+ 
+ /* network device open function */
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch b/queue-6.6/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
new file mode 100644
index 0000000000..bb3622ae3f
--- /dev/null
+++ b/queue-6.6/net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
@@ -0,0 +1,46 @@
+From 4b42a5f2b4e135d88e9a910777948dd2dc5b1c66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 15:35:04 +0800
+Subject: net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
+
+stmmac_hw_setup() may return 0 on success and an appropriate negative
+integer as defined in errno.h file on failure, just check it and then
+return early if failed in stmmac_resume().
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
+Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index f3155d69a013c..5096b70f82e1a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7901,7 +7901,14 @@ int stmmac_resume(struct device *dev)
+ 	stmmac_free_tx_skbufs(priv);
+ 	stmmac_clear_descriptors(priv, &priv->dma_conf);
+ 
+-	stmmac_hw_setup(ndev, false);
++	ret = stmmac_hw_setup(ndev, false);
++	if (ret < 0) {
++		netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
++		mutex_unlock(&priv->lock);
++		rtnl_unlock();
++		return ret;
++	}
++
+ 	stmmac_init_coalesce(priv);
+ 	stmmac_set_rx_mode(ndev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch b/queue-6.6/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
new file mode 100644
index 0000000000..bebd40a205
--- /dev/null
+++ b/queue-6.6/net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
@@ -0,0 +1,49 @@
+From 44d0c9ade8793cf680ff21f9adeb423b0d257fad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:02:15 +0200
+Subject: net: stmmac: Correctly handle Rx checksum offload errors
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit ee0aace5f844ef59335148875d05bec8764e71e8 ]
+
+The stmmac_rx function would previously set skb->ip_summed to
+CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
+and the packet was of a known IP ethertype.
+
+However, this logic failed to check if the hardware had actually
+reported a checksum error. The hardware status, indicating a header or
+payload checksum failure, was being ignored at this stage. This could
+cause corrupt packets to be passed up the network stack as valid.
+
+This patch corrects the logic by checking the `csum_none` status flag,
+which is set when the hardware reports a checksum error. If this flag
+is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
+ensuring the kernel's network stack will perform its own validation and
+properly handle the corrupt packet.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://patch.msgid.link/20250818090217.2789521-2-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 5096b70f82e1a..c5d08d042f223 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -5527,7 +5527,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+ 		stmmac_rx_vlan(priv->dev, skb);
+ 		skb->protocol = eth_type_trans(skb, priv->dev);
+ 
+-		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb))
++		if (unlikely(!coe) || !stmmac_has_ip_ethertype(skb) ||
++		    (status & csum_none))
+ 			skb_checksum_none_assert(skb);
+ 		else
+ 			skb->ip_summed = CHECKSUM_UNNECESSARY;
+-- 
+2.51.0
+
diff --git a/queue-6.6/net-when-removing-nexthops-don-t-call-synchronize_ne.patch b/queue-6.6/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
new file mode 100644
index 0000000000..930286dac2
--- /dev/null
+++ b/queue-6.6/net-when-removing-nexthops-don-t-call-synchronize_ne.patch
@@ -0,0 +1,98 @@
+From 3d6e3153676ea68543f3ecb7ce089cd1903dfa70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Aug 2025 16:12:49 -0700
+Subject: net: When removing nexthops, don't call synchronize_net if it is not
+ necessary
+
+From: Christoph Paasch <cpaasch@openai.com>
+
+[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
+
+When removing a nexthop, commit
+90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
+call to synchronize_rcu() (later changed to _net()) to make sure
+everyone sees the new nexthop-group before the rtnl-lock is released.
+
+When one wants to delete a large number of groups and nexthops, it is
+fastest to first flush the groups (ip nexthop flush groups) and then
+flush the nexthops themselves (ip -6 nexthop flush). As that way the
+groups don't need to be rebalanced.
+
+However, `ip -6 nexthop flush` will still take a long time if there is
+a very large number of nexthops because of the call to
+synchronize_net(). Now, if there are no more groups, there is no point
+in calling synchronize_net(). So, let's skip that entirely by checking
+if nh->grp_list is empty.
+
+This gives us a nice speedup:
+
+BEFORE:
+=======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	1m45.345s
+user	0m0.001s
+sys	0m0.005s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	3m10.430s
+user	0m0.002s
+sys	0m0.004s
+
+AFTER:
+======
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 2097152 nexthops
+
+real	0m17.545s
+user	0m0.003s
+sys	0m0.003s
+
+$ time sudo ip -6 nexthop flush
+Dump was interrupted and may be inconsistent.
+Flushed 4194304 nexthops
+
+real	0m35.823s
+user	0m0.002s
+sys	0m0.004s
+
+Signed-off-by: Christoph Paasch <cpaasch@openai.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/nexthop.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
+index fab550633ec9f..99385fe34a1e5 100644
+--- a/net/ipv4/nexthop.c
++++ b/net/ipv4/nexthop.c
+@@ -1835,6 +1835,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
+ {
+ 	struct nh_grp_entry *nhge, *tmp;
+ 
++	/* If there is nothing to do, let's avoid the costly call to
++	 * synchronize_net()
++	 */
++	if (list_empty(&nh->grp_list))
++		return;
++
+ 	list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
+ 		remove_nh_grp_entry(net, nhge, nlinfo);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch b/queue-6.6/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
new file mode 100644
index 0000000000..15cba9f171
--- /dev/null
+++ b/queue-6.6/netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
@@ -0,0 +1,129 @@
+From 154c60c1e55cd14ec8e437027f661282ad89044b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Aug 2025 17:01:02 +0200
+Subject: netfilter: nf_reject: don't reply to icmp error messages
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit db99b2f2b3e2cd8227ac9990ca4a8a31a1e95e56 ]
+
+tcp reject code won't reply to a tcp reset.
+
+But the icmp reject 'netdev' family versions will reply to icmp
+dst-unreach errors, unlike icmp_send() and icmp6_send() which are used
+by the inet family implementation (and internally by the REJECT target).
+
+Check for the icmp(6) type and do not respond if its an unreachable error.
+
+Without this, something like 'ip protocol icmp reject', when used
+in a netdev chain attached to 'lo', cause a packet loop.
+
+Same for two hosts that both use such a rule: each error packet
+will be replied to.
+
+Such situation persist until the (bogus) rule is amended to ratelimit or
+checks the icmp type before the reject statement.
+
+As the inet versions don't do this make the netdev ones follow along.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/netfilter/nf_reject_ipv4.c | 25 ++++++++++++++++++++++++
+ net/ipv6/netfilter/nf_reject_ipv6.c | 30 +++++++++++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index 2d663fe50f876..2064b40130412 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -71,6 +71,27 @@ struct sk_buff *nf_reject_skb_v4_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v4_tcp_reset);
+ 
++static bool nf_skb_is_icmp_unreach(const struct sk_buff *skb)
++{
++	const struct iphdr *iph = ip_hdr(skb);
++	u8 *tp, _type;
++	int thoff;
++
++	if (iph->protocol != IPPROTO_ICMP)
++		return false;
++
++	thoff = skb_network_offset(skb) + sizeof(*iph);
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmphdr, type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMP_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -91,6 +112,10 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net,
+ 	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+ 		return NULL;
+ 
++	/* don't reply to ICMP_DEST_UNREACH with ICMP_DEST_UNREACH. */
++	if (nf_skb_is_icmp_unreach(oldskb))
++		return NULL;
++
+ 	/* RFC says return as much as we can without exceeding 576 bytes. */
+ 	len = min_t(unsigned int, 536, oldskb->len);
+ 
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index f3579bccf0a51..a19ca1907de36 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -91,6 +91,32 @@ struct sk_buff *nf_reject_skb_v6_tcp_reset(struct net *net,
+ }
+ EXPORT_SYMBOL_GPL(nf_reject_skb_v6_tcp_reset);
+ 
++static bool nf_skb_is_icmp6_unreach(const struct sk_buff *skb)
++{
++	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
++	u8 proto = ip6h->nexthdr;
++	u8 _type, *tp;
++	int thoff;
++	__be16 fo;
++
++	thoff = ipv6_skip_exthdr(skb, ((u8 *)(ip6h + 1) - skb->data), &proto, &fo);
++
++	if (thoff < 0 || thoff >= skb->len || fo != 0)
++		return false;
++
++	if (proto != IPPROTO_ICMPV6)
++		return false;
++
++	tp = skb_header_pointer(skb,
++				thoff + offsetof(struct icmp6hdr, icmp6_type),
++				sizeof(_type), &_type);
++
++	if (!tp)
++		return false;
++
++	return *tp == ICMPV6_DEST_UNREACH;
++}
++
+ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 					 struct sk_buff *oldskb,
+ 					 const struct net_device *dev,
+@@ -104,6 +130,10 @@ struct sk_buff *nf_reject_skb_v6_unreach(struct net *net,
+ 	if (!nf_reject_ip6hdr_validate(oldskb))
+ 		return NULL;
+ 
++	/* Don't reply to ICMPV6_DEST_UNREACH with ICMPV6_DEST_UNREACH */
++	if (nf_skb_is_icmp6_unreach(oldskb))
++		return NULL;
++
+ 	/* Include "As much of invoking packet as possible without the ICMPv6
+ 	 * packet exceeding the minimum IPv6 MTU" in the ICMP payload.
+ 	 */
+-- 
+2.51.0
+
diff --git a/queue-6.6/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch b/queue-6.6/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
new file mode 100644
index 0000000000..a3c77d3f9f
--- /dev/null
+++ b/queue-6.6/nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
@@ -0,0 +1,41 @@
+From 946cfac181e441f1bed5d3c0d5ec7b16bd780668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:22:45 +0100
+Subject: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode
+ dereferencing
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
+
+Theoretically it's an oopsable race, but I don't believe one can manage
+to hit it on real hardware; might become doable on a KVM, but it still
+won't be easy to attack.
+
+Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
+put_unaligned_be64(), we can put that under ->d_lock and be done with that.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index cfeef23ac9412..92e40e41443cd 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -362,7 +362,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
+ 	*p++ = htonl(attrs);                           /* bitmap */
+ 	*p++ = htonl(12);             /* attribute buffer length */
+ 	*p++ = htonl(NF4DIR);
++	spin_lock(&dentry->d_lock);
+ 	p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
++	spin_unlock(&dentry->d_lock);
+ 
+ 	readdir->pgbase = (char *)p - (char *)start;
+ 	readdir->count -= readdir->pgbase;
+-- 
+2.51.0
+
diff --git a/queue-6.6/nfsv4-handle-err_grace-on-delegation-recalls.patch b/queue-6.6/nfsv4-handle-err_grace-on-delegation-recalls.patch
new file mode 100644
index 0000000000..31998ce441
--- /dev/null
+++ b/queue-6.6/nfsv4-handle-err_grace-on-delegation-recalls.patch
@@ -0,0 +1,39 @@
+From 03e8335472f417a52593051b360986ee30562fd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 14:18:48 -0400
+Subject: NFSv4: handle ERR_GRACE on delegation recalls
+
+From: Olga Kornievskaia <okorniev@redhat.com>
+
+[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
+
+RFC7530 states that clients should be prepared for the return of
+NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
+
+Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 94a1caf326699..cfeef23ac9412 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7658,10 +7658,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
+ 		return err;
+ 	do {
+ 		err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
+-		if (err != -NFS4ERR_DELAY)
++		if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
+ 			break;
+ 		ssleep(1);
+-	} while (err == -NFS4ERR_DELAY);
++	} while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
+ 	return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/nfsv4.1-fix-mount-hang-after-create_session-failure.patch b/queue-6.6/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
new file mode 100644
index 0000000000..147a7be10c
--- /dev/null
+++ b/queue-6.6/nfsv4.1-fix-mount-hang-after-create_session-failure.patch
@@ -0,0 +1,49 @@
+From a3b5122cef990815fd03997b96a63489f4510afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Aug 2025 11:00:47 +0200
+Subject: NFSv4.1: fix mount hang after CREATE_SESSION failure
+
+From: Anthony Iliopoulos <ailiop@suse.com>
+
+[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
+
+When client initialization goes through server trunking discovery, it
+schedules the state manager and then sleeps waiting for nfs_client
+initialization completion.
+
+The state manager can fail during state recovery, and specifically in
+lease establishment as nfs41_init_clientid() will bail out in case of
+errors returned from nfs4_proc_create_session(), without ever marking
+the client ready. The session creation can fail for a variety of reasons
+e.g. during backchannel parameter negotiation, with status -EINVAL.
+
+The error status will propagate all the way to the nfs4_state_manager
+but the client status will not be marked, and thus the mount process
+will remain blocked waiting.
+
+Fix it by adding -EINVAL error handling to nfs4_state_manager().
+
+Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 9fc71dc090c25..78d52c2006dcc 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2746,6 +2746,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ 	case -ENETUNREACH:
+ 		nfs_mark_client_ready(clp, -EIO);
+ 		break;
++	case -EINVAL:
++		nfs_mark_client_ready(clp, status);
++		break;
+ 	default:
+ 		ssleep(1);
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.6/ntfs3-pretend-extend-records-as-regular-files.patch b/queue-6.6/ntfs3-pretend-extend-records-as-regular-files.patch
new file mode 100644
index 0000000000..9f4141881a
--- /dev/null
+++ b/queue-6.6/ntfs3-pretend-extend-records-as-regular-files.patch
@@ -0,0 +1,37 @@
+From 8a1011c67df146e07760d192545b66b990f9b46f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 19:43:24 +0900
+Subject: ntfs3: pretend $Extend records as regular files
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 4e8011ffec79717e5fdac43a7e79faf811a384b7 ]
+
+Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
+requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
+S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.
+
+Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c
+index 0150a22102098..a967babea8a59 100644
+--- a/fs/ntfs3/inode.c
++++ b/fs/ntfs3/inode.c
+@@ -464,6 +464,7 @@ static struct inode *ntfs_read_mft(struct inode *inode,
+ 		   fname->home.seq == cpu_to_le16(MFT_REC_EXTEND)) {
+ 		/* Records in $Extend are not a files or general directories. */
+ 		inode->i_op = &ntfs_file_inode_operations;
++		mode = S_IFREG;
+ 	} else {
+ 		err = -EINVAL;
+ 		goto out;
+-- 
+2.51.0
+
diff --git a/queue-6.6/orangefs-fix-xattr-related-buffer-overflow.patch b/queue-6.6/orangefs-fix-xattr-related-buffer-overflow.patch
new file mode 100644
index 0000000000..36d4ae5c1b
--- /dev/null
+++ b/queue-6.6/orangefs-fix-xattr-related-buffer-overflow.patch
@@ -0,0 +1,86 @@
+From 14b28b4e260553730aa72e735a80ec7ff01b0ecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:40:46 -0400
+Subject: orangefs: fix xattr related buffer overflow...
+
+From: Mike Marshall <hubcap@omnibond.com>
+
+[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
+
+Willy Tarreau <w@1wt.eu> forwarded me a message from
+Disclosure <disclosure@aisle.com> with the following
+warning:
+
+> The helper `xattr_key()` uses the pointer variable in the loop condition
+> rather than dereferencing it. As `key` is incremented, it remains non-NULL
+> (until it runs into unmapped memory), so the loop does not terminate on
+> valid C strings and will walk memory indefinitely, consuming CPU or hanging
+> the thread.
+
+I easily reproduced this with setfattr and getfattr, causing a kernel
+oops, hung user processes and corrupted orangefs files. Disclosure
+sent along a diff (not a patch) with a suggested fix, which I based
+this patch on.
+
+After xattr_key started working right, xfstest generic/069 exposed an
+xattr related memory leak that lead to OOM. xattr_key returns
+a hashed key.  When adding xattrs to the orangefs xattr cache, orangefs
+used hash_add, a kernel hashing macro. hash_add also hashes the key using
+hash_log which resulted in additions to the xattr cache going to the wrong
+hash bucket. generic/069 tortures a single file and orangefs does a
+getattr for the xattr "security.capability" every time. Orangefs
+negative caches on xattrs which includes a kmalloc. Since adds to the
+xattr cache were going to the wrong bucket, every getattr for
+"security.capability" resulted in another kmalloc, none of which were
+ever freed.
+
+I changed the two uses of hash_add to hlist_add_head instead
+and the memory leak ceased and generic/069 quit throwing furniture.
+
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/xattr.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
+index 68b62689a63e2..15738379f5511 100644
+--- a/fs/orangefs/xattr.c
++++ b/fs/orangefs/xattr.c
+@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
+ static unsigned int xattr_key(const char *key)
+ {
+ 	unsigned int i = 0;
+-	while (key)
++	if (!key)
++		return 0;
++	while (*key)
+ 		i += *key++;
+ 	return i % 16;
+ }
+@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 				cx->length = -1;
+ 				cx->timeout = jiffies +
+ 				    orangefs_getattr_timeout_msecs*HZ/1000;
+-				hash_add(orangefs_inode->xattr_cache, &cx->node,
+-				    xattr_key(cx->key));
++				hlist_add_head( &cx->node,
++                                   &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 			}
+ 		}
+ 		goto out_release_op;
+@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
+ 			memcpy(cx->val, buffer, length);
+ 			cx->length = length;
+ 			cx->timeout = jiffies + HZ;
+-			hash_add(orangefs_inode->xattr_cache, &cx->node,
+-			    xattr_key(cx->key));
++			hlist_add_head(&cx->node,
++				&orangefs_inode->xattr_cache[xattr_key(cx->key)]);
+ 		}
+ 	}
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch b/queue-6.6/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
new file mode 100644
index 0000000000..386b4dd9cd
--- /dev/null
+++ b/queue-6.6/page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
@@ -0,0 +1,43 @@
+From 233cee304dbbe4cf5a4472cf1401951de3d7828a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 09:17:03 -0700
+Subject: page_pool: always add GFP_NOWARN for ATOMIC allocations
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit f3b52167a0cb23b27414452fbc1278da2ee884fc ]
+
+Driver authors often forget to add GFP_NOWARN for page allocation
+from the datapath. This is annoying to users as OOMs are a fact
+of life, and we pretty much expect network Rx to hit page allocation
+failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations
+by default.
+
+Reviewed-by: Mina Almasry <almasrymina@google.com>
+Link: https://patch.msgid.link/20250912161703.361272-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index 2f2f63c8cf4b0..b78c742052947 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -422,6 +422,12 @@ static struct page *__page_pool_alloc_pages_slow(struct page_pool *pool,
+ 	struct page *page;
+ 	int i, nr_pages;
+ 
++	/* Unconditionally set NOWARN if allocating from NAPI.
++	 * Drivers forget to set it, and OOM reports on packet Rx are useless.
++	 */
++	if ((gfp & GFP_ATOMIC) == GFP_ATOMIC)
++		gfp |= __GFP_NOWARN;
++
+ 	/* Don't support bulk alloc for high-order pages */
+ 	if (unlikely(pp_order))
+ 		return __page_pool_alloc_page_order(pool, gfp);
+-- 
+2.51.0
+
diff --git a/queue-6.6/page_pool-clamp-pool-size-to-max-16k-pages.patch b/queue-6.6/page_pool-clamp-pool-size-to-max-16k-pages.patch
new file mode 100644
index 0000000000..a2fcda5350
--- /dev/null
+++ b/queue-6.6/page_pool-clamp-pool-size-to-max-16k-pages.patch
@@ -0,0 +1,52 @@
+From 0584297ec875d4d9a2e5fc62cecc3e1c6038c835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Sep 2025 16:16:05 +0300
+Subject: page_pool: Clamp pool size to max 16K pages
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
+
+page_pool_init() returns E2BIG when the page_pool size goes above 32K
+pages. As some drivers are configuring the page_pool size according to
+the MTU and ring size, there are cases where this limit is exceeded and
+the queue creation fails.
+
+The page_pool size doesn't have to cover a full queue, especially for
+larger ring size. So clamp the size instead of returning an error. Do
+this in the core to avoid having each driver do the clamping.
+
+The current limit was deemed to high [1] so it was reduced to 16K to avoid
+page waste.
+
+[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
+
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/page_pool.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/net/core/page_pool.c b/net/core/page_pool.c
+index b78c742052947..0188d7f007857 100644
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -180,11 +180,7 @@ static int page_pool_init(struct page_pool *pool,
+ 		return -EINVAL;
+ 
+ 	if (pool->p.pool_size)
+-		ring_qsize = pool->p.pool_size;
+-
+-	/* Sanity limit mem that can be pinned down */
+-	if (ring_qsize > 32768)
+-		return -E2BIG;
++		ring_qsize = min(pool->p.pool_size, 16384);
+ 
+ 	/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
+ 	 * DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
+-- 
+2.51.0
+
diff --git a/queue-6.6/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch b/queue-6.6/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
new file mode 100644
index 0000000000..93e92e3779
--- /dev/null
+++ b/queue-6.6/pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
@@ -0,0 +1,94 @@
+From c138996a1f0c59ee7759e7f8ab62c9523a5b8792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Sep 2025 10:36:01 +0800
+Subject: PCI: cadence: Check for the existence of cdns_pcie::ops before using
+ it
+
+From: Chen Wang <unicorn_wang@outlook.com>
+
+[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
+
+cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
+is going to be true for the upcoming Sophgo platform which doesn't set the
+ops.
+
+Hence, add a check to prevent NULL pointer dereference.
+
+Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
+ drivers/pci/controller/cadence/pcie-cadence.c      | 4 ++--
+ drivers/pci/controller/cadence/pcie-cadence.h      | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
+index 741e10a575ec7..675b7ea6ff784 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
++++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
+@@ -452,7 +452,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
+ 
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
+index 4251fac5e3106..a1b66dbfc10f8 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.c
++++ b/drivers/pci/controller/cadence/pcie-cadence.c
+@@ -90,7 +90,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
+ 	cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
+@@ -120,7 +120,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
+ 	}
+ 
+ 	/* Set the CPU address */
+-	if (pcie->ops->cpu_addr_fixup)
++	if (pcie->ops && pcie->ops->cpu_addr_fixup)
+ 		cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
+ 
+ 	addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
+diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
+index 9efb71cbe6996..d2c310b7fc99b 100644
+--- a/drivers/pci/controller/cadence/pcie-cadence.h
++++ b/drivers/pci/controller/cadence/pcie-cadence.h
+@@ -494,7 +494,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
+ 
+ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->start_link)
++	if (pcie->ops && pcie->ops->start_link)
+ 		return pcie->ops->start_link(pcie);
+ 
+ 	return 0;
+@@ -502,13 +502,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
+ 
+ static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->stop_link)
++	if (pcie->ops && pcie->ops->stop_link)
+ 		pcie->ops->stop_link(pcie);
+ }
+ 
+ static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
+ {
+-	if (pcie->ops->link_up)
++	if (pcie->ops && pcie->ops->link_up)
+ 		return pcie->ops->link_up(pcie);
+ 
+ 	return true;
+-- 
+2.51.0
+
diff --git a/queue-6.6/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch b/queue-6.6/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
new file mode 100644
index 0000000000..d3db2bde56
--- /dev/null
+++ b/queue-6.6/pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
@@ -0,0 +1,39 @@
+From 11ffae0aa781974415de08b87fb484a5b6a7475e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jul 2025 01:32:08 +0200
+Subject: PCI: Disable MSI on RDC PCI to PCIe bridges
+
+From: Marcos Del Sol Vives <marcos@orca.pet>
+
+[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
+
+RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
+not support MSIs. If enabled, interrupts generated by PCIe devices never
+reach the processor.
+
+I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
+need to be disabled for them.
+
+Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d67ea16e69e6a..aae702063ba3d 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2712,6 +2712,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
+ 
+ /*
+  * The APC bridge device in AMD 780 family northbridges has some random
+-- 
+2.51.0
+
diff --git a/queue-6.6/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch b/queue-6.6/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
new file mode 100644
index 0000000000..ab6dad99c8
--- /dev/null
+++ b/queue-6.6/pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
@@ -0,0 +1,53 @@
+From 12259bd6489e64067223ba0b12ac3156bfa01de1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 18:59:15 +0200
+Subject: PCI: dwc: Verify the single eDMA IRQ in dw_pcie_edma_irq_verify()
+
+From: Niklas Cassel <cassel@kernel.org>
+
+[ Upstream commit 09fefb24ed5e15f3b112f6c04b21a90ea23eaf8b ]
+
+dw_pcie_edma_irq_verify() is supposed to verify the eDMA IRQs in devicetree
+by fetching them using either 'dma' or 'dmaX' IRQ names. Former is used
+when the platform uses a single IRQ for all eDMA channels and latter is
+used when the platform uses separate IRQ per channel. But currently,
+dw_pcie_edma_irq_verify() bails out early if edma::nr_irqs is 1, i.e., when
+a single IRQ is used. This gives an impression that the driver could work
+with any single IRQ in devicetree, not necessarily with name 'dma'.
+
+But dw_pcie_edma_irq_vector(), which actually requests the IRQ, does
+require the single IRQ to be named as 'dma'. So this creates inconsistency
+between dw_pcie_edma_irq_verify() and dw_pcie_edma_irq_vector().
+
+Thus, to fix this inconsistency, make sure dw_pcie_edma_irq_verify() also
+verifies the single IRQ name by removing the bail out code.
+
+Signed-off-by: Niklas Cassel <cassel@kernel.org>
+[mani: reworded subject and description]
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+[bhelgaas: fix typos]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Link: https://patch.msgid.link/20250908165914.547002-3-cassel@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/pci/controller/dwc/pcie-designware.c b/drivers/pci/controller/dwc/pcie-designware.c
+index 717af1b757f0a..46b12e157bebe 100644
+--- a/drivers/pci/controller/dwc/pcie-designware.c
++++ b/drivers/pci/controller/dwc/pcie-designware.c
+@@ -927,9 +927,7 @@ static int dw_pcie_edma_irq_verify(struct dw_pcie *pci)
+ 	char name[6];
+ 	int ret;
+ 
+-	if (pci->edma.nr_irqs == 1)
+-		return 0;
+-	else if (pci->edma.nr_irqs > 1)
++	if (pci->edma.nr_irqs > 1)
+ 		return pci->edma.nr_irqs != ch_cnt ? -EINVAL : 0;
+ 
+ 	ret = platform_get_irq_byname_optional(pdev, "dma");
+-- 
+2.51.0
+
diff --git a/queue-6.6/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch b/queue-6.6/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
new file mode 100644
index 0000000000..cc5874cbe2
--- /dev/null
+++ b/queue-6.6/pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
@@ -0,0 +1,45 @@
+From c085488cf487cbd4de902581db8dc2ef168e41d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 19:57:14 +0900
+Subject: PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
+
+From: Sungho Kim <sungho.kim@furiosa.ai>
+
+[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
+
+The error handling path in pci_p2pdma_add_resource() contains a bug in its
+`pgmap_free` label.
+
+Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
+in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
+which is a pointer to a member field within the `p2p_pgmap` struct, not the
+base pointer of the allocation.
+
+Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
+devm_kfree().
+
+Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index b8becc7257cda..0f1e431bbfc20 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -351,7 +351,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
+ pages_free:
+ 	devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+-	devm_kfree(&pdev->dev, pgmap);
++	devm_kfree(&pdev->dev, p2p_pgmap);
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
+-- 
+2.51.0
+
diff --git a/queue-6.6/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch b/queue-6.6/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
new file mode 100644
index 0000000000..1421919569
--- /dev/null
+++ b/queue-6.6/pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
@@ -0,0 +1,60 @@
+From f2bfbeed74b2dec6e228f848703ae7e792e0b039 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 22:19:15 -0500
+Subject: PCI/PM: Skip resuming to D0 if device is disconnected
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 299fad4133677b845ce962f78c9cf75bded63f61 ]
+
+When a device is surprise-removed (e.g., due to a dock unplug), the PCI
+core unconfigures all downstream devices and sets their error state to
+pci_channel_io_perm_failure. This marks them as disconnected via
+pci_dev_is_disconnected().
+
+During device removal, the runtime PM framework may attempt to resume the
+device to D0 via pm_runtime_get_sync(), which calls into pci_power_up().
+Since the device is already disconnected, this resume attempt is
+unnecessary and results in a predictable errors like this, typically when
+undocking from a TBT3 or USB4 dock with PCIe tunneling:
+
+  pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible
+
+Avoid powering up disconnected devices by checking their status early in
+pci_power_up() and returning -EIO.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+[bhelgaas: add typical message]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://patch.msgid.link/20250909031916.4143121-1-superm1@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index df7f7e2ed0064..9a3f6bb60eb4d 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1257,6 +1257,11 @@ int pci_power_up(struct pci_dev *dev)
+ 		return -EIO;
+ 	}
+ 
++	if (pci_dev_is_disconnected(dev)) {
++		dev->current_state = PCI_D3cold;
++		return -EIO;
++	}
++
+ 	pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
+ 	if (PCI_POSSIBLE_ERROR(pmcsr)) {
+ 		pci_err(dev, "Unable to change power state from %s to D0, device inaccessible\n",
+-- 
+2.51.0
+
diff --git a/queue-6.6/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch b/queue-6.6/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
new file mode 100644
index 0000000000..d944ce40ba
--- /dev/null
+++ b/queue-6.6/phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
@@ -0,0 +1,51 @@
+From 931d8f6a2a972f0027ce51e56277b4999e084354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 10:50:02 +0530
+Subject: phy: cadence: cdns-dphy: Enable lower resolutions in dphy
+
+From: Harikrishna Shenoy <h-shenoy@ti.com>
+
+[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
+
+Enable support for data lane rates between 80-160 Mbps cdns dphy
+as mentioned in TRM [0] by setting the pll_opdiv field to 16.
+This change enables lower resolutions like 640x480 at 60Hz.
+
+[0]: https://www.ti.com/lit/zip/spruil1
+(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
+
+Reviewed-by: Udit Kumar <u-kumar1@ti.com>
+Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
+Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
+Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/cadence/cdns-dphy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
+index 8d93a830ab8bf..a24df36e5c376 100644
+--- a/drivers/phy/cadence/cdns-dphy.c
++++ b/drivers/phy/cadence/cdns-dphy.c
+@@ -145,7 +145,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 
+ 	dlane_bps = opts->hs_clk_rate;
+ 
+-	if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
++	if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
+ 		return -EINVAL;
+ 	else if (dlane_bps >= 1250000000)
+ 		cfg->pll_opdiv = 1;
+@@ -155,6 +155,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
+ 		cfg->pll_opdiv = 4;
+ 	else if (dlane_bps >= 160000000)
+ 		cfg->pll_opdiv = 8;
++	else if (dlane_bps >= 80000000)
++		cfg->pll_opdiv = 16;
+ 
+ 	cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
+ 					  cfg->pll_ipdiv,
+-- 
+2.51.0
+
diff --git a/queue-6.6/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch b/queue-6.6/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
new file mode 100644
index 0000000000..6c20198569
--- /dev/null
+++ b/queue-6.6/phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
@@ -0,0 +1,77 @@
+From 4858c76722cd97de94bfd1bde682da8615c7dd2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jul 2025 13:07:24 +0200
+Subject: phy: renesas: r8a779f0-ether-serdes: add new step added to latest
+ datasheet
+
+From: Michael Dege <michael.dege@renesas.com>
+
+[ Upstream commit e4a8db93b5ec9bca1cc66b295544899e3afd5e86 ]
+
+R-Car S4-8 datasheet Rev.1.20 describes some additional register
+settings at the end of the initialization.
+
+Signed-off-by: Michael Dege <michael.dege@renesas.com>
+Link: https://lore.kernel.org/r/20250703-renesas-serdes-update-v4-2-1db5629cac2b@renesas.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/r8a779f0-ether-serdes.c | 28 +++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/phy/renesas/r8a779f0-ether-serdes.c b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+index 683b19bc411a8..59546301a6b9e 100644
+--- a/drivers/phy/renesas/r8a779f0-ether-serdes.c
++++ b/drivers/phy/renesas/r8a779f0-ether-serdes.c
+@@ -49,6 +49,13 @@ static void r8a779f0_eth_serdes_write32(void __iomem *addr, u32 offs, u32 bank,
+ 	iowrite32(data, addr + offs);
+ }
+ 
++static u32 r8a779f0_eth_serdes_read32(void __iomem *addr, u32 offs,  u32 bank)
++{
++	iowrite32(bank, addr + R8A779F0_ETH_SERDES_BANK_SELECT);
++
++	return ioread32(addr + offs);
++}
++
+ static int
+ r8a779f0_eth_serdes_reg_wait(struct r8a779f0_eth_serdes_channel *channel,
+ 			     u32 offs, u32 bank, u32 mask, u32 expected)
+@@ -261,6 +268,7 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ *channel)
+ {
+ 	int ret;
++	u32 val;
+ 
+ 	ret = r8a779f0_eth_serdes_chan_setting(channel);
+ 	if (ret)
+@@ -274,6 +282,26 @@ static int r8a779f0_eth_serdes_hw_init_late(struct r8a779f0_eth_serdes_channel
+ 
+ 	r8a779f0_eth_serdes_write32(channel->addr, 0x03d0, 0x380, 0x0000);
+ 
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x00c0, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val | BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x00c0, 0x180, val & ~BIT(8));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0100, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
++	val = r8a779f0_eth_serdes_read32(channel->addr, 0x0144, 0x180);
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val | BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 1);
++	if (ret)
++		return ret;
++	r8a779f0_eth_serdes_write32(channel->addr, 0x0144, 0x180, val & ~BIT(4));
++	ret = r8a779f0_eth_serdes_reg_wait(channel, 0x0180, 0x180, BIT(0), 0);
++	if (ret)
++		return ret;
++
+ 	return r8a779f0_eth_serdes_monitor_linkup(channel);
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch b/queue-6.6/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
new file mode 100644
index 0000000000..970b69b58e
--- /dev/null
+++ b/queue-6.6/phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
@@ -0,0 +1,55 @@
+From 1acc0436915d0b4d823e51415b3eeb196d0e3093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 19:04:52 +0200
+Subject: phy: rockchip: phy-rockchip-inno-csidphy: allow writes to grf
+ register 0
+
+From: Michael Riesch <michael.riesch@collabora.com>
+
+[ Upstream commit 8c7c19466c854fa86b82d2148eaa9bf0e6531423 ]
+
+The driver for the Rockchip MIPI CSI-2 DPHY uses GRF register offset
+value 0 to sort out undefined registers. However, the RK3588 CSIDPHY GRF
+this offset is perfectly fine (in fact, register 0 is the only one in
+this register file).
+Introduce a boolean variable to indicate valid registers and allow writes
+to register 0.
+
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Michael Riesch <michael.riesch@collabora.com>
+Link: https://lore.kernel.org/r/20250616-rk3588-csi-dphy-v4-4-a4f340a7f0cf@collabora.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+index 98c92d6c482fe..279e19e7546b6 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-csidphy.c
+@@ -87,10 +87,11 @@ struct dphy_reg {
+ 	u32 offset;
+ 	u32 mask;
+ 	u32 shift;
++	u8 valid;
+ };
+ 
+ #define PHY_REG(_offset, _width, _shift) \
+-	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, }
++	{ .offset = _offset, .mask = BIT(_width) - 1, .shift = _shift, .valid = 1, }
+ 
+ static const struct dphy_reg rk1808_grf_dphy_regs[] = {
+ 	[GRF_DPHY_CSIPHY_FORCERXMODE] = PHY_REG(RK1808_GRF_PD_VI_CON_OFFSET, 4, 0),
+@@ -145,7 +146,7 @@ static inline void write_grf_reg(struct rockchip_inno_csidphy *priv,
+ 	const struct dphy_drv_data *drv_data = priv->drv_data;
+ 	const struct dphy_reg *reg = &drv_data->grf_regs[index];
+ 
+-	if (reg->offset)
++	if (reg->valid)
+ 		regmap_write(priv->grf, reg->offset,
+ 			     HIWORD_UPDATE(value, reg->mask, reg->shift));
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/powerpc-eeh-use-result-of-error_detected-in-uevent.patch b/queue-6.6/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
new file mode 100644
index 0000000000..dd7cdf8c53
--- /dev/null
+++ b/queue-6.6/powerpc-eeh-use-result-of-error_detected-in-uevent.patch
@@ -0,0 +1,48 @@
+From 973946f7552b627880c655e0b0069935eae25698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:40 +0200
+Subject: powerpc/eeh: Use result of error_detected() in uevent
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
+
+Ever since uevent support was added for AER and EEH with commit
+856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
+reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
+
+Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
+udev") subsequently amended AER to report the actual return value of
+error_detected().
+
+Make the same change to EEH to align it with AER and s390.
+
+Suggested-by: Lukas Wunner <lukas@wunner.de>
+Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index 9ba4adc214af7..cc8bedf410ea7 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -334,7 +334,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
+ 	rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
+ 
+ 	edev->in_error = true;
+-	pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
++	pci_uevent_ers(pdev, rc);
+ 	return rc;
+ }
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/ptp-limit-time-setting-of-ptp-clocks.patch b/queue-6.6/ptp-limit-time-setting-of-ptp-clocks.patch
new file mode 100644
index 0000000000..aeb6545fef
--- /dev/null
+++ b/queue-6.6/ptp-limit-time-setting-of-ptp-clocks.patch
@@ -0,0 +1,81 @@
+From 1c4d494d3635ad417e09cd4e15457c3df749a1c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 12:32:53 +0200
+Subject: ptp: Limit time setting of PTP clocks
+
+From: Miroslav Lichvar <mlichvar@redhat.com>
+
+[ Upstream commit 5a8c02a6bf52b1cf9cfb7868a8330f7c3c6aebe9 ]
+
+Networking drivers implementing PTP clocks and kernel socket code
+handling hardware timestamps use the 64-bit signed ktime_t type counting
+nanoseconds. When a PTP clock reaches the maximum value in year 2262,
+the timestamps returned to applications will overflow into year 1667.
+The same thing happens when injecting a large offset with
+clock_adjtime(ADJ_SETOFFSET).
+
+The commit 7a8e61f84786 ("timekeeping: Force upper bound for setting
+CLOCK_REALTIME") limited the maximum accepted value setting the system
+clock to 30 years before the maximum representable value (i.e. year
+2232) to avoid the overflow, assuming the system will not run for more
+than 30 years.
+
+Enforce the same limit for PTP clocks. Don't allow negative values and
+values closer than 30 years to the maximum value. Drivers may implement
+an even lower limit if the hardware registers cannot represent the whole
+interval between years 1970 and 2262 in the required resolution.
+
+Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: John Stultz <jstultz@google.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Link: https://patch.msgid.link/20250828103300.1387025-1-mlichvar@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ptp/ptp_clock.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
+index 0682bb340221a..d252d018bfe77 100644
+--- a/drivers/ptp/ptp_clock.c
++++ b/drivers/ptp/ptp_clock.c
+@@ -83,6 +83,9 @@ static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp
+ 		return -EBUSY;
+ 	}
+ 
++	if (!timespec64_valid_settod(tp))
++		return -EINVAL;
++
+ 	return  ptp->info->settime64(ptp->info, tp);
+ }
+ 
+@@ -113,7 +116,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 	ops = ptp->info;
+ 
+ 	if (tx->modes & ADJ_SETOFFSET) {
+-		struct timespec64 ts;
++		struct timespec64 ts, ts2;
+ 		ktime_t kt;
+ 		s64 delta;
+ 
+@@ -126,6 +129,14 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
+ 		if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC)
+ 			return -EINVAL;
+ 
++		/* Make sure the offset is valid */
++		err = ptp_clock_gettime(pc, &ts2);
++		if (err)
++			return err;
++		ts2 = timespec64_add(ts2, ts);
++		if (!timespec64_valid_settod(&ts2))
++			return -EINVAL;
++
+ 		kt = timespec64_to_ktime(ts);
+ 		delta = ktime_to_ns(kt);
+ 		err = ops->adjtime(ops, delta);
+-- 
+2.51.0
+
diff --git a/queue-6.6/r8169-set-eee-speed-down-ratio-to-1.patch b/queue-6.6/r8169-set-eee-speed-down-ratio-to-1.patch
new file mode 100644
index 0000000000..4ae98a8fb5
--- /dev/null
+++ b/queue-6.6/r8169-set-eee-speed-down-ratio-to-1.patch
@@ -0,0 +1,63 @@
+From 9c8192769e3dad86aa8dc7873196eb66b501611f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Sep 2025 10:34:25 +0800
+Subject: r8169: set EEE speed down ratio to 1
+
+From: ChunHao Lin <hau@realtek.com>
+
+[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
+
+EEE speed down means speed down MAC MCU clock. It is not from spec.
+It is kind of Realtek specific power saving feature. But enable it
+may cause some issues, like packet drop or interrupt loss. Different
+hardware may have different issues.
+
+EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
+down rate. The larger this value is, the more power can save. But it
+actually save less power then we expected. And, as mentioned above,
+will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
+, which means not to speed down, to improve compatibility.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 3b90f257e94f8..f4353ccb1b87f 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -3362,7 +3362,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
+ 	r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3467,7 +3467,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
+ 		r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
+ 	}
+ 
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_write(tp, 0xea80, 0x0003);
+ 	r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
+ 	r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
+@@ -3660,7 +3660,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
+ 	r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
+ 	r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
+ 	r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
+-	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
++	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+ 	r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
+-- 
+2.51.0
+
diff --git a/queue-6.6/rdma-irdma-update-kconfig.patch b/queue-6.6/rdma-irdma-update-kconfig.patch
new file mode 100644
index 0000000000..54ee09d08d
--- /dev/null
+++ b/queue-6.6/rdma-irdma-update-kconfig.patch
@@ -0,0 +1,42 @@
+From 277e8b63f2eb8fbb6eaa41ca6b012b19577f7ef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Aug 2025 10:25:45 -0500
+Subject: RDMA/irdma: Update Kconfig
+
+From: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+
+[ Upstream commit 060842fed53f77a73824c9147f51dc6746c1267a ]
+
+Update Kconfig to add dependency on idpf module and
+add IPU E2000 to the list of supported devices.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Link: https://patch.msgid.link/20250827152545.2056-17-tatyana.e.nikolova@intel.com
+Tested-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/Kconfig | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/Kconfig b/drivers/infiniband/hw/irdma/Kconfig
+index b6f9c41bca51d..41660203e0049 100644
+--- a/drivers/infiniband/hw/irdma/Kconfig
++++ b/drivers/infiniband/hw/irdma/Kconfig
+@@ -4,9 +4,10 @@ config INFINIBAND_IRDMA
+ 	depends on INET
+ 	depends on IPV6 || !IPV6
+ 	depends on PCI
+-	depends on ICE && I40E
++	depends on IDPF && ICE && I40E
+ 	select GENERIC_ALLOCATOR
+ 	select AUXILIARY_BUS
+ 	help
+-	  This is an Intel(R) Ethernet Protocol Driver for RDMA driver
+-	  that support E810 (iWARP/RoCE) and X722 (iWARP) network devices.
++	  This is an Intel(R) Ethernet Protocol Driver for RDMA that
++	  supports IPU E2000 (RoCEv2), E810 (iWARP/RoCEv2) and X722 (iWARP)
++	  network devices.
+-- 
+2.51.0
+
diff --git a/queue-6.6/rds-fix-endianness-annotation-for-rds_mpath_hash.patch b/queue-6.6/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
new file mode 100644
index 0000000000..53e6ca78f6
--- /dev/null
+++ b/queue-6.6/rds-fix-endianness-annotation-for-rds_mpath_hash.patch
@@ -0,0 +1,39 @@
+From 074f224cf2deef1b7ee686f412df58ec725415b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 23:25:49 +0530
+Subject: rds: Fix endianness annotation for RDS_MPATH_HASH
+
+From: Ujwal Kundur <ujwal.kundur@gmail.com>
+
+[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
+
+jhash_1word accepts host endian inputs while rs_bound_port is a be16
+value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
+
+Flagged by Sparse.
+
+Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
+Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
+Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/rds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index dc360252c5157..5b1c072e2e7ff 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -93,7 +93,7 @@ enum {
+ 
+ /* Max number of multipaths per RDS connection. Must be a power of 2 */
+ #define	RDS_MPATH_WORKERS	8
+-#define	RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
++#define	RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
+ 			       (rs)->rs_hash_initval) & ((n) - 1))
+ 
+ #define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
+-- 
+2.51.0
+
diff --git a/queue-6.6/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch b/queue-6.6/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
new file mode 100644
index 0000000000..786ee66f62
--- /dev/null
+++ b/queue-6.6/remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
@@ -0,0 +1,42 @@
+From 15b90c54ac778a309095c610ebf1a098615befbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 18:02:34 +0200
+Subject: remoteproc: qcom: q6v5: Avoid handling handover twice
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
+
+A remoteproc could theoretically signal handover twice. This is unexpected
+and would break the reference counting for the handover resources (power
+domains, clocks, regulators, etc), so add a check to prevent that from
+happening.
+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/qcom_q6v5.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
+index 769c6d6d6a731..58d5b85e58cda 100644
+--- a/drivers/remoteproc/qcom_q6v5.c
++++ b/drivers/remoteproc/qcom_q6v5.c
+@@ -164,6 +164,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
+ {
+ 	struct qcom_q6v5 *q6v5 = data;
+ 
++	if (q6v5->handover_issued) {
++		dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
++		return IRQ_HANDLED;
++	}
++
+ 	if (q6v5->handover)
+ 		q6v5->handover(q6v5);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch b/queue-6.6/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
new file mode 100644
index 0000000000..ee4fc73993
--- /dev/null
+++ b/queue-6.6/remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
@@ -0,0 +1,54 @@
+From 85f529b20a26d6edb0a5f90a3f1f6531f9f437b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Aug 2025 10:39:37 -0500
+Subject: remoteproc: wkup_m3: Use devm_pm_runtime_enable() helper
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 461edcf73eec57bc0006fbb5209f5012c514c58b ]
+
+Use device life-cycle managed runtime enable function to simplify probe
+and exit paths.
+
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20250814153940.670564-1-afd@ti.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/wkup_m3_rproc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/remoteproc/wkup_m3_rproc.c b/drivers/remoteproc/wkup_m3_rproc.c
+index 36a55f7ffa64d..c39bd2bf2c1e7 100644
+--- a/drivers/remoteproc/wkup_m3_rproc.c
++++ b/drivers/remoteproc/wkup_m3_rproc.c
+@@ -148,7 +148,9 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 	}
+ 
+-	pm_runtime_enable(&pdev->dev);
++	ret = devm_pm_runtime_enable(dev);
++	if (ret < 0)
++		return dev_err_probe(dev, ret, "Failed to enable runtime PM\n");
+ 	ret = pm_runtime_get_sync(&pdev->dev);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
+@@ -219,7 +221,6 @@ static int wkup_m3_rproc_probe(struct platform_device *pdev)
+ 	rproc_free(rproc);
+ err:
+ 	pm_runtime_put_noidle(dev);
+-	pm_runtime_disable(dev);
+ 	return ret;
+ }
+ 
+@@ -230,7 +231,6 @@ static void wkup_m3_rproc_remove(struct platform_device *pdev)
+ 	rproc_del(rproc);
+ 	rproc_free(rproc);
+ 	pm_runtime_put_sync(&pdev->dev);
+-	pm_runtime_disable(&pdev->dev);
+ }
+ 
+ #ifdef CONFIG_PM
+-- 
+2.51.0
+
diff --git a/queue-6.6/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch b/queue-6.6/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
new file mode 100644
index 0000000000..7969906036
--- /dev/null
+++ b/queue-6.6/s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
@@ -0,0 +1,80 @@
+From ed18eee1a7568b6745388d84b719e8d708676479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 15:55:39 +0200
+Subject: s390/pci: Use pci_uevent_ers() in PCI recovery
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit dab32f2576a39d5f54f3dbbbc718d92fa5109ce9 ]
+
+Issue uevents on s390 during PCI recovery using pci_uevent_ers() as done by
+EEH and AER PCIe recovery routines.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Link: https://patch.msgid.link/20250807-add_err_uevents-v5-2-adf85b0620b0@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_event.c | 3 +++
+ drivers/pci/pci-driver.c  | 2 +-
+ include/linux/pci.h       | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
+index e60a66dd8c400..bd4172db26345 100644
+--- a/arch/s390/pci/pci_event.c
++++ b/arch/s390/pci/pci_event.c
+@@ -83,6 +83,7 @@ static pci_ers_result_t zpci_event_notify_error_detected(struct pci_dev *pdev,
+ 	pci_ers_result_t ers_res = PCI_ERS_RESULT_DISCONNECT;
+ 
+ 	ers_res = driver->err_handler->error_detected(pdev,  pdev->error_state);
++	pci_uevent_ers(pdev, ers_res);
+ 	if (ers_result_indicates_abort(ers_res))
+ 		pr_info("%s: Automatic recovery failed after initial reporting\n", pci_name(pdev));
+ 	else if (ers_res == PCI_ERS_RESULT_NEED_RESET)
+@@ -212,6 +213,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 		ers_res = zpci_event_do_reset(pdev, driver);
+ 
+ 	if (ers_res != PCI_ERS_RESULT_RECOVERED) {
++		pci_uevent_ers(pdev, PCI_ERS_RESULT_DISCONNECT);
+ 		pr_err("%s: Automatic recovery failed; operator intervention is required\n",
+ 		       pci_name(pdev));
+ 		goto out_unlock;
+@@ -220,6 +222,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev)
+ 	pr_info("%s: The device is ready to resume operations\n", pci_name(pdev));
+ 	if (driver->err_handler->resume)
+ 		driver->err_handler->resume(pdev);
++	pci_uevent_ers(pdev, PCI_ERS_RESULT_RECOVERED);
+ out_unlock:
+ 	device_unlock(&pdev->dev);
+ 
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 1705d2d0ed126..11a90b55c1873 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -1598,7 +1598,7 @@ static int pci_uevent(const struct device *dev, struct kobj_uevent_env *env)
+ 	return 0;
+ }
+ 
+-#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEAER) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ /**
+  * pci_uevent_ers - emit a uevent during recovery path of PCI device
+  * @pdev: PCI device undergoing error recovery
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index e4338237a0545..052d956d3ba1f 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2667,7 +2667,7 @@ static inline bool pci_is_thunderbolt_attached(struct pci_dev *pdev)
+ 	return false;
+ }
+ 
+-#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH)
++#if defined(CONFIG_PCIEPORTBUS) || defined(CONFIG_EEH) || defined(CONFIG_S390)
+ void pci_uevent_ers(struct pci_dev *pdev, enum  pci_ers_result err_type);
+ #endif
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch b/queue-6.6/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
new file mode 100644
index 0000000000..b32ccae9c1
--- /dev/null
+++ b/queue-6.6/scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
@@ -0,0 +1,70 @@
+From a347d03926a3c5a672adc689e6e234cb15e25117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:37:57 -0700
+Subject: scsi: libfc: Fix potential buffer overflow in fc_ct_ms_fill()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit 072fdd4b0be9b9051bdf75f36d0227aa705074ba ]
+
+The fc_ct_ms_fill() helper currently formats the OS name and version
+into entry->value using "%s v%s". Since init_utsname()->sysname and
+->release are unbounded strings, snprintf() may attempt to write more
+than FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN bytes, triggering a
+-Wformat-truncation warning with W=1.
+
+In file included from drivers/scsi/libfc/fc_elsct.c:18:
+drivers/scsi/libfc/fc_encode.h: In function ‘fc_ct_ms_fill.constprop’:
+drivers/scsi/libfc/fc_encode.h:359:30: error: ‘%s’ directive output may
+be truncated writing up to 64 bytes into a region of size between 62
+and 126 [-Werror=format-truncation=]
+  359 |                         "%s v%s",
+      |                              ^~
+  360 |                         init_utsname()->sysname,
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/libfc/fc_encode.h:357:17: note: ‘snprintf’ output between
+3 and 131 bytes into a destination of size 128
+  357 |                 snprintf((char *)&entry->value,
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  358 |                         FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  359 |                         "%s v%s",
+      |                         ~~~~~~~~~
+  360 |                         init_utsname()->sysname,
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+  361 |                         init_utsname()->release);
+      |                         ~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix this by using "%.62s v%.62s", which ensures sysname and release are
+truncated to fit within the 128-byte field defined by
+FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN.
+
+[mkp: clarified commit description]
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_encode.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_encode.h b/drivers/scsi/libfc/fc_encode.h
+index 7dcac3b6baa7e..992250ca8b9fd 100644
+--- a/drivers/scsi/libfc/fc_encode.h
++++ b/drivers/scsi/libfc/fc_encode.h
+@@ -354,7 +354,7 @@ static inline int fc_ct_ms_fill(struct fc_lport *lport,
+ 		put_unaligned_be16(len, &entry->len);
+ 		snprintf((char *)&entry->value,
+ 			FC_FDMI_HBA_ATTR_OSNAMEVERSION_LEN,
+-			"%s v%s",
++			"%.62s v%.62s",
+ 			init_utsname()->sysname,
+ 			init_utsname()->release);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch b/queue-6.6/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
new file mode 100644
index 0000000000..c6162066c4
--- /dev/null
+++ b/queue-6.6/scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
@@ -0,0 +1,66 @@
+From e8ae7f3da0d7ffa2b5fcc9d2abccc8d480cb8b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:03 -0700
+Subject: scsi: lpfc: Check return status of lpfc_reset_flush_io_context during
+ TGT_RESET
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit f408dde2468b3957e92b25e7438f74c8e9fb9e73 ]
+
+If lpfc_reset_flush_io_context fails to execute, then the wrong return
+status code may be passed back to upper layers when issuing a target
+reset TMF command.  Fix by checking the return status from
+lpfc_reset_flush_io_context() first in order to properly return FAILED
+or FAST_IO_FAIL.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-7-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index dcbb2432c978b..4734694f59a4c 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -5920,7 +5920,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport)
+ /**
+  * lpfc_reset_flush_io_context -
+  * @vport: The virtual port (scsi_host) for the flush context
+- * @tgt_id: If aborting by Target contect - specifies the target id
++ * @tgt_id: If aborting by Target context - specifies the target id
+  * @lun_id: If aborting by Lun context - specifies the lun id
+  * @context: specifies the context level to flush at.
+  *
+@@ -6094,8 +6094,14 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd)
+ 			pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE;
+ 			spin_unlock_irqrestore(&pnode->lock, flags);
+ 		}
+-		lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
+-					  LPFC_CTX_TGT);
++		status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id,
++						     LPFC_CTX_TGT);
++		if (status != SUCCESS) {
++			lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
++					 "0726 Target Reset flush status x%x\n",
++					 status);
++			return status;
++		}
+ 		return FAST_IO_FAIL;
+ 	}
+ 
+@@ -6191,7 +6197,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd)
+ 	int rc, ret = SUCCESS;
+ 
+ 	lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP,
+-			 "3172 SCSI layer issued Host Reset Data:\n");
++			 "3172 SCSI layer issued Host Reset\n");
+ 
+ 	lpfc_offline_prep(phba, LPFC_MBX_WAIT);
+ 	lpfc_offline(phba);
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch b/queue-6.6/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
new file mode 100644
index 0000000000..4c5b1442ee
--- /dev/null
+++ b/queue-6.6/scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
@@ -0,0 +1,40 @@
+From e7ea2bc1fce417eb5e6298a44fabc5424278f045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:05 -0700
+Subject: scsi: lpfc: Define size of debugfs entry for xri rebalancing
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
+
+To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
+entry is used.  The debugfs file operations for xri rebalancing have
+been previously implemented, but lack definition for its information
+buffer size.  Similar to other pre-existing debugfs entry buffers,
+define LPFC_HDWQINFO_SIZE as 8192 bytes.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
+index 8d2e8d05bbc05..52b14671eaa94 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.h
++++ b/drivers/scsi/lpfc/lpfc_debugfs.h
+@@ -44,6 +44,9 @@
+ /* hbqinfo output buffer size */
+ #define LPFC_HBQINFO_SIZE 8192
+ 
++/* hdwqinfo output buffer size */
++#define LPFC_HDWQINFO_SIZE 8192
++
+ /* nvmestat output buffer size */
+ #define LPFC_NVMESTAT_SIZE 8192
+ #define LPFC_IOKTIME_SIZE 8192
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch b/queue-6.6/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
new file mode 100644
index 0000000000..3a59d671a5
--- /dev/null
+++ b/queue-6.6/scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
@@ -0,0 +1,64 @@
+From 9758e6584f2e710822b1fb96e3b5c90deccc43d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 11:08:01 -0700
+Subject: scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in
+ lpfc_cleanup
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit a4809b98eb004fcbf7c4d45eb5a624d1c682bb73 ]
+
+In lpfc_cleanup, there is an extraneous nlp_put for NPIV ports on the
+F_Port_Ctrl ndlp object.  In cases when an ABTS is issued, the
+outstanding kref is needed for when a second XRI_ABORTED CQE is
+received.  The final kref for the ndlp is designed to be decremented in
+lpfc_sli4_els_xri_aborted instead.  Also, add a new log message to allow
+for future diagnostics when debugging related issues.
+
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Message-ID: <20250915180811.137530-5-justintee8345@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c  | 6 +++++-
+ drivers/scsi/lpfc/lpfc_init.c | 7 -------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ebe84bb7bb3dd..2e9972a587810 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -12094,7 +12094,11 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba,
+ 			sglq_entry->state = SGL_FREED;
+ 			spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+ 					       iflag);
+-
++			lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI |
++					LOG_DISCOVERY | LOG_NODE,
++					"0732 ELS XRI ABORT on Node: ndlp=x%px "
++					"xri=x%x\n",
++					ndlp, xri);
+ 			if (ndlp) {
+ 				lpfc_set_rrq_active(phba, ndlp,
+ 					sglq_entry->sli4_lxritag,
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 7c8e0e1d36da9..b0eac09de5ad5 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -3047,13 +3047,6 @@ lpfc_cleanup(struct lpfc_vport *vport)
+ 		lpfc_vmid_vport_cleanup(vport);
+ 
+ 	list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) {
+-		if (vport->port_type != LPFC_PHYSICAL_PORT &&
+-		    ndlp->nlp_DID == Fabric_DID) {
+-			/* Just free up ndlp with Fabric_DID for vports */
+-			lpfc_nlp_put(ndlp);
+-			continue;
+-		}
+-
+ 		if (ndlp->nlp_DID == Fabric_Cntl_DID &&
+ 		    ndlp->nlp_state == NLP_STE_UNUSED_NODE) {
+ 			lpfc_nlp_put(ndlp);
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch b/queue-6.6/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
new file mode 100644
index 0000000000..83fb6b0c5f
--- /dev/null
+++ b/queue-6.6/scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
@@ -0,0 +1,56 @@
+From 318ef003ac41a6b2da68916a3b847e99651ac3c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Aug 2025 14:11:34 +0530
+Subject: scsi: mpi3mr: Fix controller init failure on fault during queue
+ creation
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit 829fa1582b6ff607b0e2fe41ba1c45c77f686618 ]
+
+Firmware can enter a transient fault while creating operational queues.
+The driver fails the load immediately.
+
+Add a retry loop that checks controller status and history bit after
+queue creation. If either indicates a fault, retry init up to a set
+limit before failing.
+
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Link: https://lore.kernel.org/r/20250820084138.228471-3-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpi3mr/mpi3mr_fw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+index b03e4b8cb67d6..b6ae7ba6de523 100644
+--- a/drivers/scsi/mpi3mr/mpi3mr_fw.c
++++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c
+@@ -2117,6 +2117,8 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ {
+ 	int retval = 0;
+ 	u16 num_queues = 0, i = 0, msix_count_op_q = 1;
++	u32 ioc_status;
++	enum mpi3mr_iocstate ioc_state;
+ 
+ 	num_queues = min_t(int, mrioc->facts.max_op_reply_q,
+ 	    mrioc->facts.max_op_req_q);
+@@ -2172,6 +2174,14 @@ static int mpi3mr_create_op_queues(struct mpi3mr_ioc *mrioc)
+ 		retval = -1;
+ 		goto out_failed;
+ 	}
++	ioc_status = readl(&mrioc->sysif_regs->ioc_status);
++	ioc_state = mpi3mr_get_iocstate(mrioc);
++	if ((ioc_status & MPI3_SYSIF_IOC_STATUS_RESET_HISTORY) ||
++	    ioc_state != MRIOC_STATE_READY) {
++		mpi3mr_print_fault_info(mrioc);
++		retval = -1;
++		goto out_failed;
++	}
+ 	mrioc->num_op_reply_q = mrioc->num_op_req_q = i;
+ 	ioc_info(mrioc,
+ 	    "successfully created %d operational queue pairs(default/polled) queue = (%d/%d)\n",
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch b/queue-6.6/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
new file mode 100644
index 0000000000..a138ca3322
--- /dev/null
+++ b/queue-6.6/scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
@@ -0,0 +1,39 @@
+From 3fe03f7f63e8108172449d2bcd2d148d85e61d4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Sep 2025 15:21:12 +0530
+Subject: scsi: mpt3sas: Add support for 22.5 Gbps SAS link rate
+
+From: Ranjan Kumar <ranjan.kumar@broadcom.com>
+
+[ Upstream commit 4be7599d6b27bade41bfccca42901b917c01c30c ]
+
+Add handling for MPI26_SAS_NEG_LINK_RATE_22_5 in
+_transport_convert_phy_link_rate(). This maps the new 22.5 Gbps
+negotiated rate to SAS_LINK_RATE_22_5_GBPS, to get correct PHY link
+speeds.
+
+Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
+Message-Id: <20250922095113.281484-4-ranjan.kumar@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+index 7d6e4fe31ceed..02c970575464c 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
+@@ -166,6 +166,9 @@ _transport_convert_phy_link_rate(u8 link_rate)
+ 	case MPI25_SAS_NEG_LINK_RATE_12_0:
+ 		rc = SAS_LINK_RATE_12_0_GBPS;
+ 		break;
++	case MPI26_SAS_NEG_LINK_RATE_22_5:
++		rc = SAS_LINK_RATE_22_5_GBPS;
++		break;
+ 	case MPI2_SAS_NEG_LINK_RATE_PHY_DISABLED:
+ 		rc = SAS_PHY_DISABLED;
+ 		break;
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch b/queue-6.6/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
new file mode 100644
index 0000000000..787baea420
--- /dev/null
+++ b/queue-6.6/scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
@@ -0,0 +1,36 @@
+From a0b669b5f57fc299291204c653f09c95902e8746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 17:32:42 +0800
+Subject: scsi: pm8001: Use int instead of u32 to store error codes
+
+From: Qianfeng Rong <rongqianfeng@vivo.com>
+
+[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
+
+Use int instead of u32 for 'ret' variable to store negative error codes
+returned by PM8001_CHIP_DISP->set_nvmd_req().
+
+Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
+Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 20c4e10f7bb57..d3ff212d28b2e 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -682,7 +682,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
+ 	struct pm8001_ioctl_payload	*payload;
+ 	DECLARE_COMPLETION_ONSTACK(completion);
+ 	u8		*ioctlbuffer;
+-	u32		ret;
++	int		ret;
+ 	u32		length = 1024 * 5 + sizeof(*payload) - 1;
+ 
+ 	if (pm8001_ha->fw_image->size > 4096) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch b/queue-6.6/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
new file mode 100644
index 0000000000..def9c046c7
--- /dev/null
+++ b/queue-6.6/scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
@@ -0,0 +1,94 @@
+From b89942279ac9f322da1ed37826a06d2486c034e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jul 2025 18:35:43 +0000
+Subject: scsi: pm80xx: Fix race condition caused by static variables
+
+From: Francisco Gutierrez <frankramirez@google.com>
+
+[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
+
+Eliminate the use of static variables within the log pull implementation
+to resolve a race condition and prevent data gaps when pulling logs from
+multiple controllers in parallel, ensuring each operation is properly
+isolated.
+
+Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
+Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/pm8001/pm8001_ctl.c  | 22 ++++++++++++----------
+ drivers/scsi/pm8001/pm8001_init.c |  1 +
+ drivers/scsi/pm8001/pm8001_sas.h  |  4 ++++
+ 3 files changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
+index 5c26a13ffbd26..20c4e10f7bb57 100644
+--- a/drivers/scsi/pm8001/pm8001_ctl.c
++++ b/drivers/scsi/pm8001/pm8001_ctl.c
+@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
+ 	char *str = buf;
+ 	u32 read_size =
+ 		pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
+-	static u32 start, end, count;
+ 	u32 max_read_times = 32;
+ 	u32 max_count = (read_size * 1024) / (max_read_times * 4);
+ 	u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
+ 
+-	if ((count % max_count) == 0) {
+-		start = 0;
+-		end = max_read_times;
+-		count = 0;
++	mutex_lock(&pm8001_ha->iop_log_lock);
++
++	if ((pm8001_ha->iop_log_count % max_count) == 0) {
++		pm8001_ha->iop_log_start = 0;
++		pm8001_ha->iop_log_end = max_read_times;
++		pm8001_ha->iop_log_count = 0;
+ 	} else {
+-		start = end;
+-		end = end + max_read_times;
++		pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
++		pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
+ 	}
+ 
+-	for (; start < end; start++)
+-		str += sprintf(str, "%08x ", *(temp+start));
+-	count++;
++	for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
++		str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
++	pm8001_ha->iop_log_count++;
++	mutex_unlock(&pm8001_ha->iop_log_lock);
+ 	return str - buf;
+ }
+ static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
+diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
+index c2f6151cbd2d0..00664bd2caab1 100644
+--- a/drivers/scsi/pm8001/pm8001_init.c
++++ b/drivers/scsi/pm8001/pm8001_init.c
+@@ -529,6 +529,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
+ 	pm8001_ha->id = pm8001_id++;
+ 	pm8001_ha->logging_level = logging_level;
+ 	pm8001_ha->non_fatal_count = 0;
++	mutex_init(&pm8001_ha->iop_log_lock);
+ 	if (link_rate >= 1 && link_rate <= 15)
+ 		pm8001_ha->link_rate = (link_rate << 8);
+ 	else {
+diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
+index 2fadd353f1c13..72cd1523235ca 100644
+--- a/drivers/scsi/pm8001/pm8001_sas.h
++++ b/drivers/scsi/pm8001/pm8001_sas.h
+@@ -543,6 +543,10 @@ struct pm8001_hba_info {
+ 	u32 ci_offset;
+ 	u32 pi_offset;
+ 	u32 max_memcnt;
++	u32 iop_log_start;
++	u32 iop_log_end;
++	u32 iop_log_count;
++	struct mutex iop_log_lock;
+ };
+ 
+ struct pm8001_work {
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-core-disable-timestamp-functionality-if-not.patch b/queue-6.6/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
new file mode 100644
index 0000000000..14e5e45131
--- /dev/null
+++ b/queue-6.6/scsi-ufs-core-disable-timestamp-functionality-if-not.patch
@@ -0,0 +1,67 @@
+From 8138d6cccdcb7450ea16b4e95e25859481da4ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 12:06:07 -0700
+Subject: scsi: ufs: core: Disable timestamp functionality if not supported
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit fb1f4568346153d2f80fdb4ffcfa0cf4fb257d3c ]
+
+Some Kioxia UFS 4 devices do not support the qTimestamp attribute.  Set
+the UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT for these devices such that no
+error messages appear in the kernel log about failures to set the
+qTimestamp attribute.
+
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Avri Altman <avri.altman@sandisk.com>
+Tested-by: Nitin Rawat <quic_nitirawa@quicinc.com> # on SM8650-QRD
+Reviewed-by: Nitin Rawat <quic_nitirawa@quicinc.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Message-ID: <20250909190614.3531435-1-bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 6 +++++-
+ include/ufs/ufs_quirks.h  | 3 +++
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 1e08bf4dfb034..dbb5e55dc2324 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -275,6 +275,9 @@ static const struct ufs_dev_quirk ufs_fixups[] = {
+ 	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
+ 	  .model = "THGLF2G9D8KBADG",
+ 	  .quirk = UFS_DEVICE_QUIRK_PA_TACTIVATE },
++	{ .wmanufacturerid = UFS_VENDOR_TOSHIBA,
++	  .model = "THGJFJT1E45BATP",
++	  .quirk = UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT },
+ 	{}
+ };
+ 
+@@ -8731,7 +8734,8 @@ static void ufshcd_set_timestamp_attr(struct ufs_hba *hba)
+ 	struct ufs_dev_info *dev_info = &hba->dev_info;
+ 	struct utp_upiu_query_v4_0 *upiu_data;
+ 
+-	if (dev_info->wspecversion < 0x400)
++	if (dev_info->wspecversion < 0x400 ||
++	    hba->dev_quirks & UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT)
+ 		return;
+ 
+ 	ufshcd_hold(hba);
+diff --git a/include/ufs/ufs_quirks.h b/include/ufs/ufs_quirks.h
+index f52de5ed1b3b6..83563247c36cb 100644
+--- a/include/ufs/ufs_quirks.h
++++ b/include/ufs/ufs_quirks.h
+@@ -113,4 +113,7 @@ struct ufs_dev_quirk {
+  */
+ #define UFS_DEVICE_QUIRK_PA_HIBER8TIME          (1 << 12)
+ 
++/* Some UFS 4 devices do not support the qTimestamp attribute */
++#define UFS_DEVICE_QUIRK_NO_TIMESTAMP_SUPPORT	(1 << 13)
++
+ #endif /* UFS_QUIRKS_H_ */
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch b/queue-6.6/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
new file mode 100644
index 0000000000..ce4a512f18
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
@@ -0,0 +1,61 @@
+From 4b910958c6579892c22fe0f7922a262dae12832c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:22 +0800
+Subject: scsi: ufs: host: mediatek: Assign power mode userdata before FASTAUTO
+ mode change
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 979feee0cf43b32d288931649d7c6d9a5524ea55 ]
+
+Assign power mode userdata settings before transitioning to FASTAUTO
+power mode. This ensures that default timeout values are set for various
+parameters, enhancing the reliability and performance of the power mode
+change process.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-7-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 1a1085594fbb4..7b506220438bb 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1091,6 +1091,28 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 		ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TXHSADAPTTYPE),
+ 			       PA_NO_ADAPT);
+ 
++		if (!(hba->quirks & UFSHCD_QUIRK_SKIP_DEF_UNIPRO_TIMEOUT_SETTING)) {
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2),
++					DL_AFC0ReqTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA3),
++					DL_FC1ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA4),
++					DL_TC1ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA5),
++					DL_AFC1ReqTimeOutVal_Default);
++
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalFC0ProtectionTimeOutVal),
++					DL_FC0ProtectionTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalTC0ReplayTimeOutVal),
++					DL_TC0ReplayTimeOutVal_Default);
++			ufshcd_dme_set(hba, UIC_ARG_MIB(DME_LocalAFC0ReqTimeOutVal),
++					DL_AFC0ReqTimeOutVal_Default);
++		}
++
+ 		ret = ufshcd_uic_change_pwr_mode(hba,
+ 					FASTAUTO_MODE << 4 | FASTAUTO_MODE);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch b/queue-6.6/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
new file mode 100644
index 0000000000..b4de653d67
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
@@ -0,0 +1,44 @@
+From 5834f772b48bfe9dddc6392a127927fd935f472f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:25 +0800
+Subject: scsi: ufs: host: mediatek: Change reset sequence for improved
+ stability
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 878ed88c50bfb14d972dd3b86a1c8188c58de4e5 ]
+
+Modify the reset sequence to ensure that the device reset pin is set low
+before the host is disabled. This change enhances the stability of the
+reset process by ensuring the correct order of operations.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-10-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 7b506220438bb..90a698f8a082e 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1234,11 +1234,11 @@ static int ufs_mtk_device_reset(struct ufs_hba *hba)
+ {
+ 	struct arm_smccc_res res;
+ 
+-	/* disable hba before device reset */
+-	ufshcd_hba_stop(hba);
+-
+ 	ufs_mtk_device_reset_ctrl(0, res);
+ 
++	/* disable hba in middle of device reset */
++	ufshcd_hba_stop(hba);
++
+ 	/*
+ 	 * The reset signal is active low. UFS devices shall detect
+ 	 * more than or equal to 1us of positive or negative RST_n
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch b/queue-6.6/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
new file mode 100644
index 0000000000..f7bbdc61b1
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
@@ -0,0 +1,109 @@
+From 245fbdd33ee6d47162cbbbb532a7f2b9ef5b6e83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:42 +0800
+Subject: scsi: ufs: host: mediatek: Disable auto-hibern8 during power mode
+ changes
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit f5ca8d0c7a6388abd5d8023cc682e1543728cc73 ]
+
+Disable auto-hibern8 during power mode transitions to prevent unintended
+entry into auto-hibern8. Restore the original auto-hibern8 timer value
+after completing the power mode change to maintain system stability and
+prevent potential issues during power state transitions.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 53 +++++++++++++++++++--------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index c80780ade5aa5..8b4a3cc812531 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1131,19 +1131,49 @@ static int ufs_mtk_pre_pwr_change(struct ufs_hba *hba,
+ 	return ret;
+ }
+ 
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++{
++	int ret;
++
++	/* disable auto-hibern8 */
++	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
++
++	/* wait host return to idle state when auto-hibern8 off */
++	ufs_mtk_wait_idle_state(hba, 5);
++
++	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
++	if (ret) {
++		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
++}
++
+ static int ufs_mtk_pwr_change_notify(struct ufs_hba *hba,
+ 				     enum ufs_notify_change_status stage,
+ 				     struct ufs_pa_layer_attr *dev_max_params,
+ 				     struct ufs_pa_layer_attr *dev_req_params)
+ {
+ 	int ret = 0;
++	static u32 reg;
+ 
+ 	switch (stage) {
+ 	case PRE_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba)) {
++			reg = ufshcd_readl(hba, REG_AUTO_HIBERNATE_IDLE_TIMER);
++			ufs_mtk_auto_hibern8_disable(hba);
++		}
+ 		ret = ufs_mtk_pre_pwr_change(hba, dev_max_params,
+ 					     dev_req_params);
+ 		break;
+ 	case POST_CHANGE:
++		if (ufshcd_is_auto_hibern8_supported(hba))
++			ufshcd_writel(hba, reg, REG_AUTO_HIBERNATE_IDLE_TIMER);
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+@@ -1363,29 +1393,6 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+-{
+-	int ret;
+-
+-	/* disable auto-hibern8 */
+-	ufshcd_writel(hba, 0, REG_AUTO_HIBERNATE_IDLE_TIMER);
+-
+-	/* wait host return to idle state when auto-hibern8 off */
+-	ufs_mtk_wait_idle_state(hba, 5);
+-
+-	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret) {
+-		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
+-
+-		ufshcd_force_error_recovery(hba);
+-
+-		/* trigger error handler and break suspend */
+-		ret = -EBUSY;
+-	}
+-
+-	return ret;
+-}
+-
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 	enum ufs_notify_change_status status)
+ {
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch b/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
new file mode 100644
index 0000000000..bb88dfe0ee
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
@@ -0,0 +1,99 @@
+From 01e80ca9ce1e5042f3266e81548ee1f526d74b46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:37 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on hibernation exit
+ failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit faac32d4ece30609f1a0930ca0ae951cf6dc1786 ]
+
+Improve the recovery process for hibernation exit failures. Trigger the
+error handler and break the suspend operation to ensure effective
+recovery from hibernation errors. Activate the error handling mechanism
+by ufshcd_force_error_recovery and scheduling the error handler work.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c       |  3 ++-
+ drivers/ufs/host/ufs-mediatek.c | 14 +++++++++++---
+ include/ufs/ufshcd.h            |  1 +
+ 3 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 2080b251580c8..1e08bf4dfb034 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -6341,13 +6341,14 @@ void ufshcd_schedule_eh_work(struct ufs_hba *hba)
+ 	}
+ }
+ 
+-static void ufshcd_force_error_recovery(struct ufs_hba *hba)
++void ufshcd_force_error_recovery(struct ufs_hba *hba)
+ {
+ 	spin_lock_irq(hba->host->host_lock);
+ 	hba->force_reset = true;
+ 	ufshcd_schedule_eh_work(hba);
+ 	spin_unlock_irq(hba->host->host_lock);
+ }
++EXPORT_SYMBOL_GPL(ufshcd_force_error_recovery);
+ 
+ static void ufshcd_clk_scaling_allow(struct ufs_hba *hba, bool allow)
+ {
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 6f2e5b83ff0c9..c80780ade5aa5 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1363,7 +1363,7 @@ static void ufs_mtk_dev_vreg_set_lpm(struct ufs_hba *hba, bool lpm)
+ 	}
+ }
+ 
+-static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
++static int ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ {
+ 	int ret;
+ 
+@@ -1374,8 +1374,16 @@ static void ufs_mtk_auto_hibern8_disable(struct ufs_hba *hba)
+ 	ufs_mtk_wait_idle_state(hba, 5);
+ 
+ 	ret = ufs_mtk_wait_link_state(hba, VS_LINK_UP, 100);
+-	if (ret)
++	if (ret) {
+ 		dev_warn(hba->dev, "exit h8 state fail, ret=%d\n", ret);
++
++		ufshcd_force_error_recovery(hba);
++
++		/* trigger error handler and break suspend */
++		ret = -EBUSY;
++	}
++
++	return ret;
+ }
+ 
+ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+@@ -1386,7 +1394,7 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ 
+ 	if (status == PRE_CHANGE) {
+ 		if (ufshcd_is_auto_hibern8_supported(hba))
+-			ufs_mtk_auto_hibern8_disable(hba);
++			return ufs_mtk_auto_hibern8_disable(hba);
+ 		return 0;
+ 	}
+ 
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index e9db9682316a2..9eaf47dcc7277 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -1425,5 +1425,6 @@ int __ufshcd_write_ee_control(struct ufs_hba *hba, u32 ee_ctrl_mask);
+ int ufshcd_write_ee_control(struct ufs_hba *hba);
+ int ufshcd_update_ee_control(struct ufs_hba *hba, u16 *mask,
+ 			     const u16 *other_mask, u16 set, u16 clr);
++void ufshcd_force_error_recovery(struct ufs_hba *hba);
+ 
+ #endif /* End of Header */
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch b/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
new file mode 100644
index 0000000000..a5945f9425
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
@@ -0,0 +1,50 @@
+From de85808e972cc1ced4fea3ef82d5f73e58a7282f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 10:44:38 +0800
+Subject: scsi: ufs: host: mediatek: Enhance recovery on resume failure
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit 15ef3f5aa822f32524cba1463422a2c9372443f0 ]
+
+Improve the recovery process for failed resume operations. Log the
+device's power status and return 0 if both resume and recovery fail to
+prevent I/O hang.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 7ede6531bf40c..6f2e5b83ff0c9 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1444,8 +1444,21 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ 	}
+ 
+ 	return 0;
++
+ fail:
+-	return ufshcd_link_recovery(hba);
++	/*
++	 * Check if the platform (parent) device has resumed, and ensure that
++	 * power, clock, and MTCMOS are all turned on.
++	 */
++	err = ufshcd_link_recovery(hba);
++	if (err) {
++		dev_err(hba->dev, "Device PM: req=%d, status:%d, err:%d\n",
++			hba->dev->power.request,
++			hba->dev->power.runtime_status,
++			hba->dev->power.runtime_error);
++	}
++
++	return 0; /* Cannot return a failure, otherwise, the I/O will hang. */
+ }
+ 
+ static void ufs_mtk_dbg_register_dump(struct ufs_hba *hba)
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch b/queue-6.6/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
new file mode 100644
index 0000000000..00688017f0
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
@@ -0,0 +1,147 @@
+From 9c761287460b4ec8e00882cf515386cc026c329f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:18 +0800
+Subject: scsi: ufs: host: mediatek: Fix auto-hibern8 timer configuration
+
+From: Peter Wang <peter.wang@mediatek.com>
+
+[ Upstream commit aa86602a483ba48f51044fbaefa1ebbf6da194a4 ]
+
+Move the configuration of the Auto-Hibern8 (AHIT) timer from the
+post-link stage to the 'fixup_dev_quirks' function. This change allows
+setting the AHIT based on the vendor requirements:
+
+   (a) Samsung: 3.5 ms
+   (b) Micron: 2 ms
+   (c) Others: 1 ms
+
+Additionally, the clock gating timer is adjusted based on the AHIT
+scale, with a maximum setting of 10 ms. This ensures that the clock
+gating delay is appropriately configured to match the AHIT settings.
+
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-3-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 86 ++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 2383ecd88f1cb..1a1085594fbb4 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -847,6 +847,69 @@ static void ufs_mtk_vreg_fix_vccqx(struct ufs_hba *hba)
+ 	}
+ }
+ 
++static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
++{
++	unsigned long flags;
++	u32 ah_ms = 10;
++	u32 ah_scale, ah_timer;
++	u32 scale_us[] = {1, 10, 100, 1000, 10000, 100000};
++
++	if (ufshcd_is_clkgating_allowed(hba)) {
++		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit) {
++			ah_scale = FIELD_GET(UFSHCI_AHIBERN8_SCALE_MASK,
++					  hba->ahit);
++			ah_timer = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
++					  hba->ahit);
++			if (ah_scale <= 5)
++				ah_ms = ah_timer * scale_us[ah_scale] / 1000;
++		}
++
++		spin_lock_irqsave(hba->host->host_lock, flags);
++		hba->clk_gating.delay_ms = max(ah_ms, 10U);
++		spin_unlock_irqrestore(hba->host->host_lock, flags);
++	}
++}
++
++/* Convert microseconds to Auto-Hibernate Idle Timer register value */
++static u32 ufs_mtk_us_to_ahit(unsigned int timer)
++{
++	unsigned int scale;
++
++	for (scale = 0; timer > UFSHCI_AHIBERN8_TIMER_MASK; ++scale)
++		timer /= UFSHCI_AHIBERN8_SCALE_FACTOR;
++
++	return FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, timer) |
++	       FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, scale);
++}
++
++static void ufs_mtk_fix_ahit(struct ufs_hba *hba)
++{
++	unsigned int us;
++
++	if (ufshcd_is_auto_hibern8_supported(hba)) {
++		switch (hba->dev_info.wmanufacturerid) {
++		case UFS_VENDOR_SAMSUNG:
++			/* configure auto-hibern8 timer to 3.5 ms */
++			us = 3500;
++			break;
++
++		case UFS_VENDOR_MICRON:
++			/* configure auto-hibern8 timer to 2 ms */
++			us = 2000;
++			break;
++
++		default:
++			/* configure auto-hibern8 timer to 1 ms */
++			us = 1000;
++			break;
++		}
++
++		hba->ahit = ufs_mtk_us_to_ahit(us);
++	}
++
++	ufs_mtk_setup_clk_gating(hba);
++}
++
+ static void ufs_mtk_init_mcq_irq(struct ufs_hba *hba)
+ {
+ 	struct ufs_mtk_host *host = ufshcd_get_variant(hba);
+@@ -1119,32 +1182,10 @@ static int ufs_mtk_pre_link(struct ufs_hba *hba)
+ 
+ 	return ret;
+ }
+-
+-static void ufs_mtk_setup_clk_gating(struct ufs_hba *hba)
+-{
+-	u32 ah_ms;
+-
+-	if (ufshcd_is_clkgating_allowed(hba)) {
+-		if (ufshcd_is_auto_hibern8_supported(hba) && hba->ahit)
+-			ah_ms = FIELD_GET(UFSHCI_AHIBERN8_TIMER_MASK,
+-					  hba->ahit);
+-		else
+-			ah_ms = 10;
+-		ufshcd_clkgate_delay_set(hba->dev, ah_ms + 5);
+-	}
+-}
+-
+ static void ufs_mtk_post_link(struct ufs_hba *hba)
+ {
+ 	/* enable unipro clock gating feature */
+ 	ufs_mtk_cfg_unipro_cg(hba, true);
+-
+-	/* will be configured during probe hba */
+-	if (ufshcd_is_auto_hibern8_supported(hba))
+-		hba->ahit = FIELD_PREP(UFSHCI_AHIBERN8_TIMER_MASK, 10) |
+-			FIELD_PREP(UFSHCI_AHIBERN8_SCALE_MASK, 3);
+-
+-	ufs_mtk_setup_clk_gating(hba);
+ }
+ 
+ static int ufs_mtk_link_startup_notify(struct ufs_hba *hba,
+@@ -1444,6 +1485,7 @@ static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba)
+ 
+ 	ufs_mtk_vreg_fix_vcc(hba);
+ 	ufs_mtk_vreg_fix_vccqx(hba);
++	ufs_mtk_fix_ahit(hba);
+ }
+ 
+ static void ufs_mtk_event_notify(struct ufs_hba *hba,
+-- 
+2.51.0
+
diff --git a/queue-6.6/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch b/queue-6.6/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
new file mode 100644
index 0000000000..fef8cb330a
--- /dev/null
+++ b/queue-6.6/scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
@@ -0,0 +1,41 @@
+From 758a329d039ca5ffd48ff4fc04e3f4c28e8d5cb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Aug 2025 21:11:26 +0800
+Subject: scsi: ufs: host: mediatek: Fix invalid access in vccqx handling
+
+From: Alice Chao <alice.chao@mediatek.com>
+
+[ Upstream commit 5863638598f5e4f64d2f85b03f376383ca1f2ab7 ]
+
+Add a NULL check before accessing the 'vccqx' pointer to prevent invalid
+memory access. This ensures that the function safely handles cases where
+'vccq' and 'vccq2' are not initialized, improving the robustness of the
+power management code.
+
+Signed-off-by: Alice Chao <alice.chao@mediatek.com>
+Reviewed-by: Peter Wang <peter.wang@mediatek.com>
+Signed-off-by: Peter Wang <peter.wang@mediatek.com>
+Link: https://lore.kernel.org/r/20250811131423.3444014-11-peter.wang@mediatek.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index 90a698f8a082e..7ede6531bf40c 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1316,6 +1316,9 @@ static void ufs_mtk_vccqx_set_lpm(struct ufs_hba *hba, bool lpm)
+ {
+ 	struct ufs_vreg *vccqx = NULL;
+ 
++	if (!hba->vreg_info.vccq && !hba->vreg_info.vccq2)
++		return;
++
+ 	if (hba->vreg_info.vccq)
+ 		vccqx = hba->vreg_info.vccq;
+ 	else
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch b/queue-6.6/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
new file mode 100644
index 0000000000..359d807b15
--- /dev/null
+++ b/queue-6.6/selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
@@ -0,0 +1,37 @@
+From e1d95d749fe864e046d707da91969210e70087d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:27 -0600
+Subject: selftests: Disable dad for ipv6 in fcnal-test.sh
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
+
+Constrained test environment; duplicate address detection is not needed
+and causes races so disable it.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index 5726975975c14..b4d7b1994091b 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -423,6 +423,8 @@ create_ns()
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
+ 	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
++	ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
+ }
+ 
+ # create veth pair to connect namespaces and apply addresses.
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-makefile-include-install_dep_targets-in-cl.patch b/queue-6.6/selftests-makefile-include-install_dep_targets-in-cl.patch
new file mode 100644
index 0000000000..427c8e6b7a
--- /dev/null
+++ b/queue-6.6/selftests-makefile-include-install_dep_targets-in-cl.patch
@@ -0,0 +1,44 @@
+From a3a86602f668f8a3691b532719ef472a5f33cd65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 19:30:32 +0800
+Subject: selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to
+ clean net/lib dependency
+
+From: Nai-Chen Cheng <bleach1827@gmail.com>
+
+[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
+
+The selftests 'make clean' does not clean the net/lib because it only
+processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
+compiled objects in net/lib after cleaning, requiring manual cleanup.
+
+Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
+dependency is properly cleaned.
+
+Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Simon Horman <horms@kernel.org> # build-tested
+Acked-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
+index 5b61b8bb29f84..a670d5de302b9 100644
+--- a/tools/testing/selftests/Makefile
++++ b/tools/testing/selftests/Makefile
+@@ -269,7 +269,7 @@ gen_tar: install
+ 	@echo "Created ${TAR_PATH}"
+ 
+ clean:
+-	@for TARGET in $(TARGETS); do \
++	@for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
+ 		BUILD_TARGET=$$BUILD/$$TARGET;	\
+ 		$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
+ 	done;
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch b/queue-6.6/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
new file mode 100644
index 0000000000..1ffb1cb171
--- /dev/null
+++ b/queue-6.6/selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
@@ -0,0 +1,45 @@
+From c92f9c3703ed8c3651b0e94bfd5250b6a7f3f09f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Aug 2025 14:20:13 +0800
+Subject: selftests/net: Ensure assert() triggers in psock_tpacket.c
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
+
+The get_next_frame() function in psock_tpacket.c was missing a return
+statement in its default switch case, leading to a compiler warning.
+
+This was caused by a `bug_on(1)` call, which is defined as an
+`assert()`, being compiled out because NDEBUG is defined during the
+build.
+
+Instead of adding a `return NULL;` which would silently hide the error
+and could lead to crashes later, this change restores the original
+author's intent. By adding `#undef NDEBUG` before including <assert.h>,
+we ensure the assertion is active and will cause the test to abort if
+this unreachable code is ever executed.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 93092d13b3c59..ca0d9a5a9e08c 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -22,6 +22,7 @@
+  *   - TPACKET_V3: RX_RING
+  */
+ 
++#undef NDEBUG
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-net-replace-non-standard-__wordsize-with-s.patch b/queue-6.6/selftests-net-replace-non-standard-__wordsize-with-s.patch
new file mode 100644
index 0000000000..f7974331d3
--- /dev/null
+++ b/queue-6.6/selftests-net-replace-non-standard-__wordsize-with-s.patch
@@ -0,0 +1,54 @@
+From 2aec37483dce40414384185276906167ed3534ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Aug 2025 16:09:32 +0800
+Subject: selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
+
+From: Wake Liu <wakel@google.com>
+
+[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
+
+The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
+header, is a GNU extension and not universally available with all
+toolchains, such as Clang when used with musl libc.
+
+This can lead to build failures in environments where this header is
+missing.
+
+The intention of the code is to determine the bit width of a C `long`.
+Replace the non-portable `__WORDSIZE` with the standard and portable
+`sizeof(long) * 8` expression to achieve the same result.
+
+This change also removes the inclusion of the now-unused
+`<bits/wordsize.h>` header.
+
+Signed-off-by: Wake Liu <wakel@google.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/psock_tpacket.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
+index 404a2ce759ab6..93092d13b3c59 100644
+--- a/tools/testing/selftests/net/psock_tpacket.c
++++ b/tools/testing/selftests/net/psock_tpacket.c
+@@ -33,7 +33,6 @@
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+-#include <bits/wordsize.h>
+ #include <net/ethernet.h>
+ #include <netinet/ip.h>
+ #include <arpa/inet.h>
+@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
+ 
+ static int test_user_bit_width(void)
+ {
+-	return __WORDSIZE;
++	return sizeof(long) * 8;
+ }
+ 
+ static const char *tpacket_str[] = {
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch b/queue-6.6/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
new file mode 100644
index 0000000000..a700153acc
--- /dev/null
+++ b/queue-6.6/selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
@@ -0,0 +1,1849 @@
+From 4aa4b180e72132ce779a6dd5ac8960821d350b61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 15:38:37 -0700
+Subject: selftests: net: replace sleeps in fcnal-test with waits
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 15c068cb214d74a2faca9293b25f454242d0d65e ]
+
+fcnal-test.sh already includes lib.sh, use relevant helpers
+instead of sleeping. Replace sleep after starting nettest
+as a server with wait_local_port_listen.
+
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250909223837.863217-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 428 +++++++++++-----------
+ 1 file changed, 214 insertions(+), 214 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index d32a14ba069ac..5726975975c14 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -865,7 +865,7 @@ ipv4_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -873,7 +873,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -881,7 +881,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -889,7 +889,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -900,7 +900,7 @@ ipv4_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -908,7 +908,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -916,7 +916,7 @@ ipv4_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -933,7 +933,7 @@ ipv4_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -941,7 +941,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -949,7 +949,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -957,7 +957,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -968,7 +968,7 @@ ipv4_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -976,7 +976,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -984,7 +984,7 @@ ipv4_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -c ${NSB_LO_IP} -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -995,14 +995,14 @@ ipv4_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1010,7 +1010,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1018,21 +1018,21 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NSB_IP} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest  -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest  -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -1040,7 +1040,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -1048,7 +1048,7 @@ ipv4_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} &
+ 	run_cmd nettest -s -M ${MD5_WRONG_PW} -m ${NS_NET} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -1072,14 +1072,14 @@ test_ipv4_md5_vrf__vrf_server__no_bind_ifindex()
+ 	log_start
+ 	show_hint "Simulates applications using VRF without TCP_MD5SIG_FLAG_IFINDEX"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, unbound key accepts connection"
+ 
+ 	log_start
+ 	show_hint "Binding both the socket and the key is not required but it works"
+ 	run_cmd nettest -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: VRF-bound server, bound key accepts connection"
+ }
+@@ -1093,25 +1093,25 @@ test_ipv4_md5_vrf__global_server__bind_ifindex0()
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Global server, Key bound to ifindex=0 rejects VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --force-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key bound to ifindex=0 accepts non-VRF connection"
+ 	log_start
+ 
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts VRF connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -M ${MD5_PW} -m ${NS_NET} --no-bind-key-ifindex &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -r ${NSA_IP} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Global server, key not bound to ifindex accepts non-VRF connection"
+ 
+@@ -1183,7 +1183,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -1191,7 +1191,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1211,13 +1211,13 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1239,7 +1239,7 @@ ipv4_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1247,7 +1247,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1256,7 +1256,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1264,7 +1264,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -0 ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -1273,7 +1273,7 @@ ipv4_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -1281,7 +1281,7 @@ ipv4_tcp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest  -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 
+@@ -1313,19 +1313,19 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1342,7 +1342,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -1364,14 +1364,14 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		show_hint "client socket should be bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -1386,7 +1386,7 @@ ipv4_tcp_vrf()
+ 	log_start
+ 	show_hint "client socket should be bound to device"
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1396,7 +1396,7 @@ ipv4_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since client is not bound to VRF"
+ 		run_cmd nettest -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -1408,13 +1408,13 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+@@ -1433,7 +1433,7 @@ ipv4_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -1441,26 +1441,26 @@ ipv4_tcp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+ 	log_start
+ 	show_hint "Should fail 'No route to host' since client is out of VRF scope"
+ 	run_cmd nettest -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ }
+@@ -1499,7 +1499,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -1512,7 +1512,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server"
+ 
+@@ -1523,31 +1523,31 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP} -U
+ 		log_test_addr ${a} $? 0 "Client, device bind via IP_UNICAST_IF, with connect()"
+ 
+@@ -1570,7 +1570,7 @@ ipv4_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -1578,7 +1578,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -1587,7 +1587,7 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -1595,25 +1595,25 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -S -r ${a} -U
+ 	log_test_addr ${a} $? 0 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1626,28 +1626,28 @@ ipv4_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 2 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail since addresses on loopback are out of device scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 
+@@ -1657,7 +1657,7 @@ ipv4_udp_novrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -1699,19 +1699,19 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Fails because ingress is in a VRF and global server is disabled"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1723,7 +1723,7 @@ ipv4_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is out of scope"
+ 		run_cmd nettest -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local connection"
+ 	done
+@@ -1731,26 +1731,26 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, enslaved device client, local connection"
+ 
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1765,19 +1765,19 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 
+ 		log_start
+ 		run_cmd nettest -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 
+@@ -1792,13 +1792,13 @@ ipv4_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${VRF} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "VRF client"
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -d ${NSA_DEV} -D -r ${NSB_IP} -1 ${NSA_IP}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -1819,31 +1819,31 @@ ipv4_udp_vrf()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -1851,7 +1851,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -D -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 	done
+@@ -1860,7 +1860,7 @@ ipv4_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s -D -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -2083,7 +2083,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2097,7 +2097,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2110,7 +2110,7 @@ ipv4_rt()
+ 	a=${NSA_IP}
+ 	log_start
+ 	run_cmd nettest ${varg} -s -I ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest ${varg} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2124,7 +2124,7 @@ ipv4_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2135,7 +2135,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2151,7 +2151,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2165,7 +2165,7 @@ ipv4_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -2179,7 +2179,7 @@ ipv4_rt()
+ 	log_start
+ 
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2190,7 +2190,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2201,7 +2201,7 @@ ipv4_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -2551,7 +2551,7 @@ ipv6_tcp_md5_novrf()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Single address config"
+ 
+@@ -2559,7 +2559,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Server no config, client uses password"
+ 
+@@ -2567,7 +2567,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Client uses wrong password"
+ 
+@@ -2575,7 +2575,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Client address does not match address configured with password"
+ 
+@@ -2586,7 +2586,7 @@ ipv6_tcp_md5_novrf()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: Prefix config"
+ 
+@@ -2594,7 +2594,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: Prefix config, client uses wrong password"
+ 
+@@ -2602,7 +2602,7 @@ ipv6_tcp_md5_novrf()
+ 	log_start
+ 	show_hint "Should timeout due to MD5 mismatch"
+ 	run_cmd nettest -6 -s -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: Prefix config, client address not in configured prefix"
+ }
+@@ -2619,7 +2619,7 @@ ipv6_tcp_md5()
+ 	# basic use case
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config"
+ 
+@@ -2627,7 +2627,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server does not have MD5 auth"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Server no config, client uses password"
+ 
+@@ -2635,7 +2635,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Client uses wrong password"
+ 
+@@ -2643,7 +2643,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since server config differs from client"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_LO_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Client address does not match address configured with password"
+ 
+@@ -2654,7 +2654,7 @@ ipv6_tcp_md5()
+ 	# client in prefix
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config"
+ 
+@@ -2662,7 +2662,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client uses wrong password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client uses wrong password"
+ 
+@@ -2670,7 +2670,7 @@ ipv6_tcp_md5()
+ 	log_start
+ 	show_hint "Should timeout since client address is outside of prefix"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -c ${NSB_LO_IP6} -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config, client address not in configured prefix"
+ 
+@@ -2681,14 +2681,14 @@ ipv6_tcp_md5()
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2696,7 +2696,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2704,21 +2704,21 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NSB_IP6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NSB_IP6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Single address config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 0 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF"
+ 
+@@ -2726,7 +2726,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in default VRF uses VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsc nettest -6 -r ${NSA_IP6} -X ${MD5_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in default VRF with VRF pw"
+ 
+@@ -2734,7 +2734,7 @@ ipv6_tcp_md5()
+ 	show_hint "Should timeout since client in VRF uses default VRF password"
+ 	run_cmd nettest -6 -s -I ${VRF} -M ${MD5_PW} -m ${NS_NET6} &
+ 	run_cmd nettest -6 -s -M ${MD5_WRONG_PW} -m ${NS_NET6} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${NSA_IP6} -X ${MD5_WRONG_PW}
+ 	log_test $? 2 "MD5: VRF: Prefix config in default VRF and VRF, conn in VRF with default VRF pw"
+ 
+@@ -2762,7 +2762,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2783,7 +2783,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Client"
+ 	done
+@@ -2792,7 +2792,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -2812,7 +2812,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -2820,7 +2820,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -2829,7 +2829,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, unbound client, local connection"
+ 	done
+@@ -2837,7 +2837,7 @@ ipv6_tcp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+@@ -2846,7 +2846,7 @@ ipv6_tcp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 	done
+@@ -2855,7 +2855,7 @@ ipv6_tcp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6  -d ${NSA_DEV} -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 	done
+@@ -2888,7 +2888,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -2897,7 +2897,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2906,7 +2906,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2914,7 +2914,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -2933,7 +2933,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server with VRF is disabled"
+ 	run_cmd nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 	log_test_addr ${a} $? 1 "Global server, local connection"
+ 
+@@ -2954,7 +2954,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -2963,7 +2963,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -2972,13 +2972,13 @@ ipv6_tcp_vrf()
+ 	a=${NSA_LINKIP6}%${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd_nsb nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server"
+ 
+@@ -2986,7 +2986,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3006,7 +3006,7 @@ ipv6_tcp_vrf()
+ 		log_start
+ 		show_hint "Fails 'Connection refused' since client is not in VRF"
+ 		run_cmd nettest -6 -s -I ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, local connection"
+ 	done
+@@ -3019,7 +3019,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF}
+ 		log_test_addr ${a} $? 0 "Client, VRF bind"
+ 	done
+@@ -3028,7 +3028,7 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Fails since VRF device does not allow linklocal addresses"
+ 	run_cmd_nsb nettest -6 -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF}
+ 	log_test_addr ${a} $? 1 "Client, VRF bind"
+ 
+@@ -3036,7 +3036,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 	done
+@@ -3061,7 +3061,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local connection"
+ 	done
+@@ -3069,7 +3069,7 @@ ipv6_tcp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${VRF} -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local connection"
+ 
+@@ -3077,13 +3077,13 @@ ipv6_tcp_vrf()
+ 	log_start
+ 	show_hint "Should fail since unbound client is out of VRF scope"
+ 	run_cmd nettest -6 -s -I ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a}
+ 	log_test_addr ${a} $? 1 "VRF server, unbound client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest -6 -r ${a} -d ${VRF} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local connection"
+ 
+@@ -3091,7 +3091,7 @@ ipv6_tcp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest -6 -r ${a} -d ${NSA_DEV} -0 ${a}
+ 		log_test_addr ${a} $? 0 "Device server, device client, local connection"
+ 	done
+@@ -3131,13 +3131,13 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Device server"
+ 	done
+@@ -3145,7 +3145,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_LO_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server"
+ 
+@@ -3155,7 +3155,7 @@ ipv6_udp_novrf()
+ 	#log_start
+ 	#show_hint "Should fail since loopback address is out of scope"
+ 	#run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	#sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	#run_cmd_nsb nettest -6 -D -r ${a}
+ 	#log_test_addr ${a} $? 1 "Device server"
+ 
+@@ -3175,25 +3175,25 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device send via cmsg"
+ 
+ 		log_start
+ 		run_cmd_nsb nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSB} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -0 ${NSA_IP6}
+ 		log_test_addr ${a} $? 0 "Client, device bind via IPV6_UNICAST_IF"
+ 
+@@ -3215,7 +3215,7 @@ ipv6_udp_novrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -0 ${a} -1 ${a}
+ 		log_test_addr ${a} $? 0 "Global server, local connection"
+ 	done
+@@ -3223,7 +3223,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, unbound client, local connection"
+ 
+@@ -3232,7 +3232,7 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since address is out of device scope"
+ 		run_cmd nettest -6 -s -D -I ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Device server, local connection"
+ 	done
+@@ -3240,19 +3240,19 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -C -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device send via cmsg, local connection"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -S -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client via IPV6_UNICAST_IF, local connection"
+ 
+@@ -3261,28 +3261,28 @@ ipv6_udp_novrf()
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV}
+ 		log_test_addr ${a} $? 1 "Global server, device client, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -C
+ 		log_test_addr ${a} $? 1 "Global server, device send via cmsg, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection"
+ 
+ 		log_start
+ 		show_hint "Should fail 'No route to host' since addresses on loopback are out of device scope"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -r ${a} -d ${NSA_DEV} -S -U
+ 		log_test_addr ${a} $? 1 "Global server, device client via IP_UNICAST_IF, local connection, with connect()"
+ 	done
+@@ -3290,7 +3290,7 @@ ipv6_udp_novrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -I ${NSA_DEV} -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a} -0 ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3304,7 +3304,7 @@ ipv6_udp_novrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3328,7 +3328,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server"
+ 	done
+@@ -3337,7 +3337,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3346,7 +3346,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3368,7 +3368,7 @@ ipv6_udp_vrf()
+ 		log_start
+ 		show_hint "Should fail 'Connection refused' since global server is disabled"
+ 		run_cmd nettest -6 -D -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, VRF client, local conn"
+ 	done
+@@ -3377,7 +3377,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 	done
+@@ -3386,25 +3386,25 @@ ipv6_udp_vrf()
+ 	log_start
+ 	show_hint "Should fail 'Connection refused' since global server is disabled"
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 1 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Enslaved device server, device client, local conn"
+ 
+@@ -3419,7 +3419,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Global server"
+ 	done
+@@ -3428,7 +3428,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "VRF server"
+ 	done
+@@ -3437,7 +3437,7 @@ ipv6_udp_vrf()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 udp
+ 		run_cmd_nsb nettest -6 -D -r ${a}
+ 		log_test_addr ${a} $? 0 "Enslaved device server"
+ 	done
+@@ -3455,7 +3455,7 @@ ipv6_udp_vrf()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${NSB_IP6}
+ 	log_test $? 0 "VRF client"
+ 
+@@ -3466,7 +3466,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_IP6}
+ 	log_test $? 0 "Enslaved device client"
+ 
+@@ -3481,13 +3481,13 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	#log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3495,13 +3495,13 @@ ipv6_udp_vrf()
+ 	a=${VRF_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${VRF} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, VRF client, local conn"
+ 
+@@ -3517,25 +3517,25 @@ ipv6_udp_vrf()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest -6 -D -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Global server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${VRF} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "VRF server, device client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${VRF} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, VRF client, local conn"
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -I ${NSA_DEV} -s -3 ${NSA_DEV} &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${a}
+ 	log_test_addr ${a} $? 0 "Device server, device client, local conn"
+ 
+@@ -3547,7 +3547,7 @@ ipv6_udp_vrf()
+ 	# link local addresses
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -d ${NSB_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Global server, linklocal IP"
+ 
+@@ -3558,7 +3558,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSB_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, linklocal IP"
+ 
+@@ -3569,7 +3569,7 @@ ipv6_udp_vrf()
+ 
+ 	log_start
+ 	run_cmd nettest -6 -D -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd nettest -6 -D -d ${NSA_DEV} -r ${NSA_LINKIP6}
+ 	log_test $? 0 "Enslaved device client, local conn - linklocal IP"
+ 
+@@ -3582,7 +3582,7 @@ ipv6_udp_vrf()
+ 	run_cmd_nsb ip -6 ro add ${NSA_IP6}/128 dev ${NSB_DEV}
+ 	log_start
+ 	run_cmd nettest -6 -s -D &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 udp
+ 	run_cmd_nsb nettest -6 -D -r ${NSA_IP6}
+ 	log_test $? 0 "UDP in - LLA to GUA"
+ 
+@@ -3761,7 +3761,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3775,7 +3775,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3789,7 +3789,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${varg} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3804,7 +3804,7 @@ ipv6_rt()
+ 	#
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${VRF} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3815,7 +3815,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd_nsb nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSB} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${NSB_IP6} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3832,7 +3832,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3846,7 +3846,7 @@ ipv6_rt()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${varg} -I ${VRF} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd nettest ${varg} -d ${VRF} -r ${a} &
+ 		sleep 3
+ 		run_cmd ip link del ${VRF}
+@@ -3859,7 +3859,7 @@ ipv6_rt()
+ 	a=${NSA_IP6}
+ 	log_start
+ 	run_cmd nettest ${varg} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3870,7 +3870,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${VRF} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3881,7 +3881,7 @@ ipv6_rt()
+ 
+ 	log_start
+ 	run_cmd nettest ${varg} -I ${NSA_DEV} -s &
+-	sleep 1
++	wait_local_port_listen ${NSA} 12345 tcp
+ 	run_cmd nettest ${varg} -d ${NSA_DEV} -r ${a} &
+ 	sleep 3
+ 	run_cmd ip link del ${VRF}
+@@ -3940,7 +3940,7 @@ netfilter_tcp_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -3958,7 +3958,7 @@ netfilter_icmp()
+ 	do
+ 		log_start
+ 		run_cmd nettest ${arg} -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -3997,7 +3997,7 @@ netfilter_tcp6_reset()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 -r ${a}
+ 		log_test_addr ${a} $? 1 "Global server, reject with TCP-reset on Rx"
+ 	done
+@@ -4015,7 +4015,7 @@ netfilter_icmp6()
+ 	do
+ 		log_start
+ 		run_cmd nettest -6 -s ${arg} &
+-		sleep 1
++		wait_local_port_listen ${NSA} 12345 tcp
+ 		run_cmd_nsb nettest -6 ${arg} -r ${a}
+ 		log_test_addr ${a} $? 1 "Global ${stype} server, Rx reject icmp-port-unreach"
+ 	done
+@@ -4211,12 +4211,12 @@ use_case_snat_on_vrf()
+ 	run_cmd ip6tables -t nat -A POSTROUTING -p tcp -m tcp --dport ${port} -j SNAT --to-source ${NSA_LO_IP6} -o ${VRF}
+ 
+ 	run_cmd_nsb nettest -s -l ${NSB_IP} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -d ${VRF} -r ${NSB_IP} -p ${port}
+ 	log_test $? 0 "IPv4 TCP connection over VRF with SNAT"
+ 
+ 	run_cmd_nsb nettest -6 -s -l ${NSB_IP6} -p ${port} &
+-	sleep 1
++	wait_local_port_listen ${NSB} ${port} tcp
+ 	run_cmd nettest -6 -d ${VRF} -r ${NSB_IP6} -p ${port}
+ 	log_test $? 0 "IPv6 TCP connection over VRF with SNAT"
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-replace-sleep-with-slowwait.patch b/queue-6.6/selftests-replace-sleep-with-slowwait.patch
new file mode 100644
index 0000000000..ef966c9788
--- /dev/null
+++ b/queue-6.6/selftests-replace-sleep-with-slowwait.patch
@@ -0,0 +1,36 @@
+From 6525273a45be04eeac5d36d9af00f30507eefd3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2025 20:58:28 -0600
+Subject: selftests: Replace sleep with slowwait
+
+From: David Ahern <dsahern@kernel.org>
+
+[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
+
+Replace the sleep in kill_procs with slowwait.
+
+Signed-off-by: David Ahern <dsahern@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fcnal-test.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
+index b4d7b1994091b..5d8f50cd38b7e 100755
+--- a/tools/testing/selftests/net/fcnal-test.sh
++++ b/tools/testing/selftests/net/fcnal-test.sh
+@@ -194,7 +194,7 @@ show_hint()
+ kill_procs()
+ {
+ 	killall nettest ping ping6 >/dev/null 2>&1
+-	sleep 1
++	slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
+ }
+ 
+ do_run_cmd()
+-- 
+2.51.0
+
diff --git a/queue-6.6/selftests-traceroute-use-require_command.patch b/queue-6.6/selftests-traceroute-use-require_command.patch
new file mode 100644
index 0000000000..7a68d98771
--- /dev/null
+++ b/queue-6.6/selftests-traceroute-use-require_command.patch
@@ -0,0 +1,78 @@
+From 818ae689bd3efd10bda27b78a1ba4644de93451b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 10:32:35 +0300
+Subject: selftests: traceroute: Use require_command()
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
+
+Use require_command() so that the test will return SKIP (4) when a
+required command is not present.
+
+Before:
+
+ # ./traceroute.sh
+ SKIP: Could not run IPV6 test without traceroute6
+ SKIP: Could not run IPV4 test without traceroute
+ $ echo $?
+ 0
+
+After:
+
+ # ./traceroute.sh
+ TEST: traceroute6 not installed                                    [SKIP]
+ $ echo $?
+ 4
+
+Reviewed-by: Petr Machata <petrm@nvidia.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/traceroute.sh | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
+index de9ca97abc306..9cb5e96e64333 100755
+--- a/tools/testing/selftests/net/traceroute.sh
++++ b/tools/testing/selftests/net/traceroute.sh
+@@ -209,11 +209,6 @@ setup_traceroute6()
+ 
+ run_traceroute6()
+ {
+-	if [ ! -x "$(command -v traceroute6)" ]; then
+-		echo "SKIP: Could not run IPV6 test without traceroute6"
+-		return
+-	fi
+-
+ 	setup_traceroute6
+ 
+ 	# traceroute6 host-2 from host-1 (expects 2000:102::2)
+@@ -278,11 +273,6 @@ setup_traceroute()
+ 
+ run_traceroute()
+ {
+-	if [ ! -x "$(command -v traceroute)" ]; then
+-		echo "SKIP: Could not run IPV4 test without traceroute"
+-		return
+-	fi
+-
+ 	setup_traceroute
+ 
+ 	# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
+@@ -316,6 +306,9 @@ do
+ 	esac
+ done
+ 
++require_command traceroute6
++require_command traceroute
++
+ run_tests
+ 
+ printf "\nTests passed: %3d\n" ${nsuccess}
+-- 
+2.51.0
+
diff --git a/queue-6.6/series b/queue-6.6/series
index 6a674471e9..997d38ab8a 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -111,3 +111,190 @@ mfd-stmpe-remove-irq-domain-upon-removal.patch
 mfd-stmpe-i2c-add-missing-module_license.patch
 mfd-madera-work-around-false-positive-wininitialized.patch
 mfd-da9063-split-chip-variant-reading-in-two-bus-tra.patch
+drm-amd-display-ensure-committing-streams-is-seamles.patch
+drm-amd-display-increase-aux-intra-hop-done-max-wait.patch
+drm-amd-display-add-more-cyan-skillfish-devices.patch
+drm-amd-display-update-dpp-disp-clock-from-smu-clock.patch
+drm-amd-pm-use-cached-metrics-data-on-aldebaran.patch
+drm-amd-pm-use-cached-metrics-data-on-arcturus.patch
+drm-amdgpu-jpeg-hold-pg_lock-before-jpeg-poweroff.patch
+drm-nouveau-replace-snprintf-with-scnprintf-in-nvkm_.patch
+pci-disable-msi-on-rdc-pci-to-pcie-bridges.patch
+selftests-net-replace-non-standard-__wordsize-with-s.patch
+selftests-net-ensure-assert-triggers-in-psock_tpacke.patch
+wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
+drm-amdkfd-return-enotty-for-unsupported-ioctls.patch
+media-pci-ivtv-don-t-create-fake-v4l2_fh.patch
+media-amphion-delete-v4l2_fh-synchronously-in-.relea.patch
+drm-tidss-use-the-crtc_-timings-when-programming-the.patch
+drm-bridge-cdns-dsi-fix-reg_wakeup_time-value.patch
+drm-bridge-cdns-dsi-don-t-fail-on-mipi_dsi_mode_vide.patch
+drm-tidss-set-crtc-modesetting-parameters-with-adjus.patch
+media-i2c-kconfig-ensure-a-dependency-on-have_clk-fo.patch
+x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
+net-stmmac-check-stmmac_hw_setup-in-stmmac_resume.patch
+ice-don-t-use-pk-through-printk-or-tracepoints.patch
+thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
+powerpc-eeh-use-result-of-error_detected-in-uevent.patch
+s390-pci-use-pci_uevent_ers-in-pci-recovery.patch
+bridge-redirect-to-backup-port-when-port-is-administ.patch
+scsi-ufs-host-mediatek-fix-auto-hibern8-timer-config.patch
+scsi-ufs-host-mediatek-assign-power-mode-userdata-be.patch
+scsi-ufs-host-mediatek-change-reset-sequence-for-imp.patch
+scsi-ufs-host-mediatek-fix-invalid-access-in-vccqx-h.patch
+net-ipv6-fix-field-spanning-memcpy-warning-in-ah-out.patch
+media-imon-make-send_packet-more-robust.patch
+drm-bridge-display-connector-don-t-set-op_detect-for.patch
+drm-amdkfd-handle-lack-of-read-permissions-in-svm-ma.patch
+iio-adc-spear_adc-mask-spear_adc_status-channel-and-.patch
+iio-adc-imx93_adc-load-calibrated-values-even-calibr.patch
+usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
+char-misc-make-misc_register-reentry-for-miscdevice-.patch
+char-misc-does-not-request-module-for-miscdevice-wit.patch
+net-when-removing-nexthops-don-t-call-synchronize_ne.patch
+net-stmmac-correctly-handle-rx-checksum-offload-erro.patch
+net-call-trace_sock_exceed_buf_limit-for-memcg-failu.patch
+pci-p2pdma-fix-incorrect-pointer-usage-in-devm_kfree.patch
+alsa-usb-audio-add-validation-of-uac2-uac3-effect-un.patch
+rds-fix-endianness-annotation-for-rds_mpath_hash.patch
+scsi-mpi3mr-fix-controller-init-failure-on-fault-dur.patch
+scsi-pm80xx-fix-race-condition-caused-by-static-vari.patch
+extcon-adc-jack-fix-wakeup-source-leaks-on-device-un.patch
+remoteproc-wkup_m3-use-devm_pm_runtime_enable-helper.patch
+net-phy-fixed_phy-let-fixed_phy_unregister-free-the-.patch
+fuse-zero-initialize-inode-private-data.patch
+drm-amdkfd-fix-vram-allocation-failure-for-a-special.patch
+drm-amdkfd-tie-unmap_latency-to-queue_preemption.patch
+media-fix-uninitialized-symbol-warnings.patch
+drm-amdgpu-respect-max-pixel-clock-for-hdmi-and-dvi-.patch
+mips-lantiq-danube-add-missing-properties-to-cpu-nod.patch
+mips-lantiq-danube-add-model-to-easy50712-dts.patch
+mips-lantiq-danube-add-missing-device_type-in-pci-no.patch
+mips-lantiq-xway-sysctrl-rename-stp-clock.patch
+mips-lantiq-danube-rename-stp-node-on-easy50712-refe.patch
+crypto-qat-use-kcalloc-in-qat_uclo_map_objs_from_mof.patch
+scsi-pm8001-use-int-instead-of-u32-to-store-error-co.patch
+ptp-limit-time-setting-of-ptp-clocks.patch
+dmaengine-sh-setup_xref-error-handling.patch
+dmaengine-mv_xor-match-alloc_wc-and-free_wc.patch
+dmaengine-dw-edma-set-status-for-callback_result.patch
+drm-msm-dsi-phy-toggle-back-buffer-resync-after-prep.patch
+drm-msm-dsi-phy_7nm-fix-missing-initial-vco-rate.patch
+drm-amdgpu-allow-kfd-criu-with-no-buffer-objects.patch
+ipv6-add-sanity-checks-on-ipv6_devconf.rpl_seg_enabl.patch
+net-nfc-nci-increase-nci_data_timeout-to-3000-ms.patch
+media-adv7180-add-missing-lock-in-suspend-callback.patch
+media-adv7180-do-not-write-format-to-device-in-set_f.patch
+media-adv7180-only-validate-format-in-querystd.patch
+media-verisilicon-explicitly-disable-selection-api-i.patch
+alsa-usb-audio-apply-quirk-for-moondrop-quark2.patch
+net-call-cond_resched-less-often-in-__release_sock.patch
+smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
+iommu-amd-skip-enabling-command-event-buffers-for-kd.patch
+iommu-apple-dart-clear-stream-error-indicator-bits-f.patch
+drm-amd-add-more-cyan-skillfish-pci-ids.patch
+drm-amdgpu-don-t-enable-smu-on-cyan-skillfish.patch
+drm-amdgpu-add-support-for-cyan-skillfish-gpu_info.patch
+usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
+usb-cdns3-gadget-use-after-free-during-failed-initia.patch
+drm-msm-make-sure-to-not-queue-up-recovery-more-than.patch
+char-use-list_del_init-in-misc_deregister-to-reiniti.patch
+media-ov08x40-fix-the-horizontal-flip-control.patch
+media-i2c-og01a1b-specify-monochrome-media-bus-forma.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-resume-fa.patch
+scsi-ufs-host-mediatek-enhance-recovery-on-hibernati.patch
+net-phy-marvell-fix-88e1510-downshift-counter-errata.patch
+scsi-ufs-host-mediatek-disable-auto-hibern8-during-p.patch
+ntfs3-pretend-extend-records-as-regular-files.patch
+wifi-mac80211-fix-he-capabilities-element-check.patch
+phy-cadence-cdns-dphy-enable-lower-resolutions-in-dp.patch
+phy-renesas-r8a779f0-ether-serdes-add-new-step-added.patch
+phy-rockchip-phy-rockchip-inno-csidphy-allow-writes-.patch
+net-sh_eth-disable-wol-if-system-can-not-suspend.patch
+selftests-net-replace-sleeps-in-fcnal-test-with-wait.patch
+media-redrat3-use-int-type-to-store-negative-error-c.patch
+selftests-traceroute-use-require_command.patch
+netfilter-nf_reject-don-t-reply-to-icmp-error-messag.patch
+x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
+selftests-disable-dad-for-ipv6-in-fcnal-test.sh.patch
+eth-8139too-make-8139too_pio-depend-on-no_ioport_map.patch
+selftests-replace-sleep-with-slowwait.patch
+udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
+hid-asus-add-z13-folio-to-generic-group-for-multitou.patch
+watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
+crypto-sun8i-ce-remove-channel-timeout-field.patch
+pci-dwc-verify-the-single-edma-irq-in-dw_pcie_edma_i.patch
+crypto-caam-double-the-entropy-delay-interval-for-re.patch
+net-cls_cgroup-fix-task_get_classid-during-qdisc-run.patch
+wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
+wifi-mt76-mt7996-temporarily-disable-epcs.patch
+alsa-serial-generic-remove-shared-static-buffer.patch
+drm-amdgpu-use-memdup_array_user-in-amdgpu_cs_wait_f.patch
+drm-amd-avoid-evicting-resources-at-s5.patch
+drm-amd-display-fix-dvi-d-hdmi-adapters.patch
+drm-amd-display-disable-vrr-on-dce-6.patch
+page_pool-always-add-gfp_nowarn-for-atomic-allocatio.patch
+ethernet-extend-device_get_mac_address-to-use-nvmem.patch
+hid-i2c-hid-resolve-touchpad-issues-on-dell-systems-.patch
+drm-amdgpu-reject-gang-submissions-under-sriov.patch
+selftests-makefile-include-install_dep_targets-in-cl.patch
+scsi-ufs-core-disable-timestamp-functionality-if-not.patch
+scsi-lpfc-check-return-status-of-lpfc_reset_flush_io.patch
+scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f_po.patch
+scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebal.patch
+allow-finish_no_open-file-err_ptr-e.patch
+usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
+usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
+alsa-seq-fix-kcsan-data-race-warning-at-snd_seq_fifo.patch
+usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
+f2fs-fix-infinite-loop-in-__insert_extent_tree.patch
+ipv6-np-rxpmtu-race-annotation.patch
+rdma-irdma-update-kconfig.patch
+jfs-verify-inode-mode-when-loading-from-disk.patch
+jfs-fix-uninitialized-waitqueue-in-transaction-manag.patch
+asoc-qcom-sc8280xp-explicitly-set-s16le-format-in-sc.patch
+net-phy-clear-link-parameters-on-admin-link-down.patch
+net-ethernet-microchip-sparx5-make-it-selectable-for.patch
+iommu-vt-d-replace-snprintf-with-scnprintf-in-dmar_l.patch
+wifi-ath10k-fix-connection-after-gtk-rekeying.patch
+net-intel-fm10k-fix-parameter-idx-set-but-not-used.patch
+r8169-set-eee-speed-down-ratio-to-1.patch
+pci-cadence-check-for-the-existence-of-cdns_pcie-ops.patch
+sparc-module-add-r_sparc_ua64-relocation-handling.patch
+sparc64-fix-prototypes-of-reads-bwl.patch
+vfio-return-enotty-for-unsupported-device-feature.patch
+pci-pm-skip-resuming-to-d0-if-device-is-disconnected.patch
+remoteproc-qcom-q6v5-avoid-handling-handover-twice.patch
+wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
+drm-amd-display-add-avi-infoframe-copy-in-copy_strea.patch
+nfsv4-handle-err_grace-on-delegation-recalls.patch
+nfsv4.1-fix-mount-hang-after-create_session-failure.patch
+nfs4_setup_readdir-insufficient-locking-for-d_parent.patch
+net-bridge-install-fdb-for-bridge-mac-on-vlan-0.patch
+scsi-libfc-fix-potential-buffer-overflow-in-fc_ct_ms.patch
+accel-habanalabs-gaudi2-fix-bmon-disable-configurati.patch
+scsi-mpt3sas-add-support-for-22.5-gbps-sas-link-rate.patch
+accel-habanalabs-return-enomem-if-less-than-requeste.patch
+accel-habanalabs-gaudi2-read-preboot-status-after-re.patch
+accel-habanalabs-support-mapping-cb-with-vmalloc-bac.patch
+fs-ext4-change-gfp_kernel-to-gfp_nofs-to-avoid-deadl.patch
+ext4-increase-io-priority-of-fastcommit.patch
+amd-amdkfd-resolve-a-race-in-amdgpu_amdkfd_device_fi.patch
+asoc-stm32-sai-manage-context-in-set_sysclk-callback.patch
+asoc-tlv320aic3x-fix-class-d-initialization-for-tlv3.patch
+net-mlx5e-don-t-query-fec-statistics-when-fec-is-dis.patch
+net-macb-avoid-dealing-with-endianness-in-macb_set_h.patch
+bluetooth-btusb-check-for-unexpected-bytes-when-defr.patch
+bluetooth-sco-fix-uaf-on-sco_conn_free.patch
+bluetooth-bcsp-receive-data-only-if-registered.patch
+alsa-usb-audio-add-mono-main-switch-to-presonus-s182.patch
+exfat-limit-log-print-for-io-error.patch
+6pack-drop-redundant-locking-and-refcounting.patch
+page_pool-clamp-pool-size-to-max-16k-pages.patch
+orangefs-fix-xattr-related-buffer-overflow.patch
+ftrace-fix-softlockup-in-ftrace_module_enable.patch
+ksmbd-use-sock_create_kern-interface-to-create-kerne.patch
+smb-client-transport-avoid-reconnects-triggered-by-p.patch
+ima-don-t-clear-ima_digsig-flag-when-setting-or-remo.patch
+char-misc-restrict-the-dynamic-range-to-exclude-rese.patch
+acpica-update-dsmethod.c-to-get-rid-of-unused-variab.patch
diff --git a/queue-6.6/smb-client-transport-avoid-reconnects-triggered-by-p.patch b/queue-6.6/smb-client-transport-avoid-reconnects-triggered-by-p.patch
new file mode 100644
index 0000000000..1e94180603
--- /dev/null
+++ b/queue-6.6/smb-client-transport-avoid-reconnects-triggered-by-p.patch
@@ -0,0 +1,70 @@
+From adb8ed12f9a21dd9f43eef8d30200f0e9af67624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:19:39 +0200
+Subject: smb: client: transport: avoid reconnects triggered by pending task
+ work
+
+From: Fiona Ebner <f.ebner@proxmox.com>
+
+[ Upstream commit 00be6f26a2a7c671f1402d74c4d3c30a5844660a ]
+
+When io_uring is used in the same task as CIFS, there might be
+unnecessary reconnects, causing issues in user-space applications
+like QEMU with a log like:
+
+> CIFS: VFS: \\10.10.100.81 Error -512 sending data on socket to server
+
+Certain io_uring completions might be added to task_work with
+notify_method being TWA_SIGNAL and thus TIF_NOTIFY_SIGNAL is set for
+the task.
+
+In __smb_send_rqst(), signals are masked before calling
+smb_send_kvec(), but the masking does not apply to TIF_NOTIFY_SIGNAL.
+
+If sk_stream_wait_memory() is reached via sock_sendmsg() while
+TIF_NOTIFY_SIGNAL is set, signal_pending(current) will evaluate to
+true there, and -EINTR will be propagated all the way from
+sk_stream_wait_memory() to sock_sendmsg() in smb_send_kvec().
+Afterwards, __smb_send_rqst() will see that not everything was written
+and reconnect.
+
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/transport.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c
+index 7b2560612bd6a..719b04202ed1c 100644
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -22,6 +22,7 @@
+ #include <linux/mempool.h>
+ #include <linux/sched/signal.h>
+ #include <linux/task_io_accounting_ops.h>
++#include <linux/task_work.h>
+ #include "cifspdu.h"
+ #include "cifsglob.h"
+ #include "cifsproto.h"
+@@ -211,9 +212,16 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+ 		 * send a packet.  In most cases if we fail to send
+ 		 * after the retries we will kill the socket and
+ 		 * reconnect which may clear the network problem.
++		 *
++		 * Even if regular signals are masked, EINTR might be
++		 * propagated from sk_stream_wait_memory() to here when
++		 * TIF_NOTIFY_SIGNAL is used for task work. For example,
++		 * certain io_uring completions will use that. Treat
++		 * having EINTR with pending task work the same as EAGAIN
++		 * to avoid unnecessary reconnects.
+ 		 */
+ 		rc = sock_sendmsg(ssocket, smb_msg);
+-		if (rc == -EAGAIN) {
++		if (rc == -EAGAIN || unlikely(rc == -EINTR && task_work_pending(current))) {
+ 			retries++;
+ 			if (retries >= 14 ||
+ 			    (!server->noblocksnd && (retries > 2))) {
+-- 
+2.51.0
+
diff --git a/queue-6.6/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch b/queue-6.6/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
new file mode 100644
index 0000000000..7fbffc1904
--- /dev/null
+++ b/queue-6.6/smsc911x-add-second-read-of-eeprom-mac-when-possible.patch
@@ -0,0 +1,55 @@
+From 28ff1adc4cc0ee393d315e5fcf301d3eb4a15b1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Sep 2025 08:26:10 -0500
+Subject: smsc911x: add second read of EEPROM mac when possible corruption seen
+
+From: Colin Foster <colin.foster@in-advantage.com>
+
+[ Upstream commit 69777753a8919b0b8313c856e707e1d1fe5ced85 ]
+
+When the EEPROM MAC is read by way of ADDRH, it can return all 0s the
+first time. Subsequent reads succeed.
+
+This is fully reproduceable on the Phytec PCM049 SOM.
+
+Re-read the ADDRH when this behaviour is observed, in an attempt to
+correctly apply the EEPROM MAC address.
+
+Signed-off-by: Colin Foster <colin.foster@in-advantage.com>
+Link: https://patch.msgid.link/20250903132610.966787-1-colin.foster@in-advantage.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smsc911x.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
+index cb590db625e83..90a8eb517033e 100644
+--- a/drivers/net/ethernet/smsc/smsc911x.c
++++ b/drivers/net/ethernet/smsc/smsc911x.c
+@@ -2162,10 +2162,20 @@ static const struct net_device_ops smsc911x_netdev_ops = {
+ static void smsc911x_read_mac_address(struct net_device *dev)
+ {
+ 	struct smsc911x_data *pdata = netdev_priv(dev);
+-	u32 mac_high16 = smsc911x_mac_read(pdata, ADDRH);
+-	u32 mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++	u32 mac_high16, mac_low32;
+ 	u8 addr[ETH_ALEN];
+ 
++	mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	mac_low32 = smsc911x_mac_read(pdata, ADDRL);
++
++	/* The first mac_read in some setups can incorrectly read 0. Re-read it
++	 * to get the full MAC if this is observed.
++	 */
++	if (mac_high16 == 0) {
++		SMSC_TRACE(pdata, probe, "Re-read MAC ADDRH\n");
++		mac_high16 = smsc911x_mac_read(pdata, ADDRH);
++	}
++
+ 	addr[0] = (u8)(mac_low32);
+ 	addr[1] = (u8)(mac_low32 >> 8);
+ 	addr[2] = (u8)(mac_low32 >> 16);
+-- 
+2.51.0
+
diff --git a/queue-6.6/sparc-module-add-r_sparc_ua64-relocation-handling.patch b/queue-6.6/sparc-module-add-r_sparc_ua64-relocation-handling.patch
new file mode 100644
index 0000000000..b183d78c40
--- /dev/null
+++ b/queue-6.6/sparc-module-add-r_sparc_ua64-relocation-handling.patch
@@ -0,0 +1,48 @@
+From 6af0b866d701508de0d96fac4a63971264fe5fd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jun 2025 20:53:11 +0700
+Subject: sparc/module: Add R_SPARC_UA64 relocation handling
+
+From: Koakuma <koachan@protonmail.com>
+
+[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
+
+This is needed so that the kernel can handle R_SPARC_UA64 relocations,
+which is emitted by LLVM's IAS.
+
+Signed-off-by: Koakuma <koachan@protonmail.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/elf_64.h | 1 +
+ arch/sparc/kernel/module.c      | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
+index 8fb09eec8c3e7..694ed081cf8d9 100644
+--- a/arch/sparc/include/asm/elf_64.h
++++ b/arch/sparc/include/asm/elf_64.h
+@@ -58,6 +58,7 @@
+ #define R_SPARC_7		43
+ #define R_SPARC_5		44
+ #define R_SPARC_6		45
++#define R_SPARC_UA64		54
+ 
+ /* Bits present in AT_HWCAP, primarily for Sparc32.  */
+ #define HWCAP_SPARC_FLUSH       0x00000001
+diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
+index 66c45a2764bc8..a7780907fc2f9 100644
+--- a/arch/sparc/kernel/module.c
++++ b/arch/sparc/kernel/module.c
+@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
+ 			break;
+ #ifdef CONFIG_SPARC64
+ 		case R_SPARC_64:
++		case R_SPARC_UA64:
+ 			location[0] = v >> 56;
+ 			location[1] = v >> 48;
+ 			location[2] = v >> 40;
+-- 
+2.51.0
+
diff --git a/queue-6.6/sparc64-fix-prototypes-of-reads-bwl.patch b/queue-6.6/sparc64-fix-prototypes-of-reads-bwl.patch
new file mode 100644
index 0000000000..76c3b14c68
--- /dev/null
+++ b/queue-6.6/sparc64-fix-prototypes-of-reads-bwl.patch
@@ -0,0 +1,51 @@
+From 0f7f4a2896715c7fb11519abdd16215629de801c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Aug 2025 04:42:08 +0100
+Subject: sparc64: fix prototypes of reads[bwl]()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 7205ef77dfe167df1b83aea28cf00fc02d662990 ]
+
+Conventions for readsl() are the same as for readl() - any __iomem
+pointer is acceptable, both const and volatile ones being OK.  Same
+for readsb() and readsw().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com> # Making sparc64 subject prefix
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/include/asm/io_64.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/sparc/include/asm/io_64.h b/arch/sparc/include/asm/io_64.h
+index 9303270b22f3c..f9d370324729e 100644
+--- a/arch/sparc/include/asm/io_64.h
++++ b/arch/sparc/include/asm/io_64.h
+@@ -250,19 +250,19 @@ void insl(unsigned long, void *, unsigned long);
+ #define insw insw
+ #define insl insl
+ 
+-static inline void readsb(void __iomem *port, void *buf, unsigned long count)
++static inline void readsb(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insb((unsigned long __force)port, buf, count);
+ }
+ #define readsb readsb
+ 
+-static inline void readsw(void __iomem *port, void *buf, unsigned long count)
++static inline void readsw(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insw((unsigned long __force)port, buf, count);
+ }
+ #define readsw readsw
+ 
+-static inline void readsl(void __iomem *port, void *buf, unsigned long count)
++static inline void readsl(const volatile void __iomem *port, void *buf, unsigned long count)
+ {
+ 	insl((unsigned long __force)port, buf, count);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch b/queue-6.6/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
new file mode 100644
index 0000000000..5c86bc2e8d
--- /dev/null
+++ b/queue-6.6/thunderbolt-use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,63 @@
+From 02b44892e1086617772f762d813b4b3f84c96fd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Aug 2025 15:42:29 +0200
+Subject: thunderbolt: Use is_pciehp instead of is_hotplug_bridge
+
+From: Lukas Wunner <lukas@wunner.de>
+
+[ Upstream commit 5d03847175e81e86d4865456c15638faaf7c0634 ]
+
+The thunderbolt driver sets up device link dependencies from hotplug ports
+to the Host Router (aka Native Host Interface, NHI).  When resuming from
+system sleep, this allows the Host Router to re-establish tunnels to
+attached Thunderbolt devices before the hotplug ports resume.
+
+To identify the hotplug ports, the driver utilizes the is_hotplug_bridge
+flag which also encompasses ACPI slots handled by the ACPI hotplug driver.
+
+Thunderbolt hotplug ports are always Hot-Plug Capable PCIe ports, so it is
+more apt to identify them with the is_pciehp flag.
+
+Similarly, hotplug ports on older Thunderbolt controllers have broken MSI
+support and are quirked to use legacy INTx interrupts instead.  The quirk
+identifies them with is_hotplug_bridge, even though all affected ports are
+also matched by is_pciehp.  So use is_pciehp here as well.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c     | 2 +-
+ drivers/thunderbolt/tb.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index aae702063ba3d..30a5f809ee798 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3825,7 +3825,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
+  */
+ static void quirk_thunderbolt_hotplug_msi(struct pci_dev *pdev)
+ {
+-	if (pdev->is_hotplug_bridge &&
++	if (pdev->is_pciehp &&
+ 	    (pdev->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C ||
+ 	     pdev->revision <= 1))
+ 		pdev->no_msi = 1;
+diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
+index b92a8a5b2e8c9..bf35fd23b5e16 100644
+--- a/drivers/thunderbolt/tb.c
++++ b/drivers/thunderbolt/tb.c
+@@ -3022,7 +3022,7 @@ static bool tb_apple_add_links(struct tb_nhi *nhi)
+ 		if (!pci_is_pcie(pdev))
+ 			continue;
+ 		if (pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM ||
+-		    !pdev->is_hotplug_bridge)
++		    !pdev->is_pciehp)
+ 			continue;
+ 
+ 		link = device_link_add(&pdev->dev, &nhi->pdev->dev,
+-- 
+2.51.0
+
diff --git a/queue-6.6/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch b/queue-6.6/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
new file mode 100644
index 0000000000..0ff90df7d7
--- /dev/null
+++ b/queue-6.6/udp_tunnel-use-netdev_warn-instead-of-netdev_warn.patch
@@ -0,0 +1,44 @@
+From 42d8e2f379ce098ff7e7e8e82f8869b84ecee8e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Sep 2025 12:50:26 -0700
+Subject: udp_tunnel: use netdev_warn() instead of netdev_WARN()
+
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+
+[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
+
+netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
+file and line information. In this case, udp_tunnel_nic_register()
+returning an error is just a failed operation, not a kernel bug.
+
+udp_tunnel_nic_register() can fail due to a memory allocation
+failure (kzalloc() or udp_tunnel_nic_alloc()).
+This is a normal runtime error and not a kernel bug.
+
+Replace netdev_WARN() with netdev_warn() accordingly.
+
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp_tunnel_nic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
+index 0292197497850..a08b0b6e0727c 100644
+--- a/net/ipv4/udp_tunnel_nic.c
++++ b/net/ipv4/udp_tunnel_nic.c
+@@ -899,7 +899,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
+ 
+ 		err = udp_tunnel_nic_register(dev);
+ 		if (err)
+-			netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
++			netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
+ 		return notifier_from_errno(err);
+ 	}
+ 	/* All other events will need the udp_tunnel_nic state */
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-cdns3-gadget-use-after-free-during-failed-initia.patch b/queue-6.6/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
new file mode 100644
index 0000000000..8a7f2604aa
--- /dev/null
+++ b/queue-6.6/usb-cdns3-gadget-use-after-free-during-failed-initia.patch
@@ -0,0 +1,62 @@
+From 6304a261489372ef39bf732cb48e1d32a72ea711 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Sep 2025 17:48:42 +0800
+Subject: usb: cdns3: gadget: Use-after-free during failed initialization and
+ exit of cdnsp gadget
+
+From: Chen Yufeng <chenyufeng@iie.ac.cn>
+
+[ Upstream commit 87c5ff5615dc0a37167e8faf3adeeddc6f1344a3 ]
+
+In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
+structure (pdev->gadget) was freed before its endpoints.
+The endpoints are linked via the ep_list in the gadget structure.
+Freeing the gadget first leaves dangling pointers in the endpoint list.
+When the endpoints are subsequently freed, this results in a use-after-free.
+
+Fix:
+By separating the usb_del_gadget_udc() operation into distinct "del" and
+"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
+final release of the gadget structure with usb_put_gadget().
+
+A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
+ only after freeing endpoints").
+
+Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
+Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdnsp-gadget.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/cdns3/cdnsp-gadget.c b/drivers/usb/cdns3/cdnsp-gadget.c
+index 38e693cd3efc0..fb192b120d77f 100644
+--- a/drivers/usb/cdns3/cdnsp-gadget.c
++++ b/drivers/usb/cdns3/cdnsp-gadget.c
+@@ -1975,7 +1975,10 @@ static int __cdnsp_gadget_init(struct cdns *cdns)
+ 	return 0;
+ 
+ del_gadget:
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
++	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
++	goto halt_pdev;
+ free_endpoints:
+ 	cdnsp_gadget_free_endpoints(pdev);
+ halt_pdev:
+@@ -1997,8 +2000,9 @@ static void cdnsp_gadget_exit(struct cdns *cdns)
+ 	devm_free_irq(pdev->dev, cdns->dev_irq, pdev);
+ 	pm_runtime_mark_last_busy(cdns->dev);
+ 	pm_runtime_put_autosuspend(cdns->dev);
+-	usb_del_gadget_udc(&pdev->gadget);
++	usb_del_gadget(&pdev->gadget);
+ 	cdnsp_gadget_free_endpoints(pdev);
++	usb_put_gadget(&pdev->gadget);
+ 	cdnsp_mem_cleanup(pdev);
+ 	kfree(pdev);
+ 	cdns->gadget_dev = NULL;
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch b/queue-6.6/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
new file mode 100644
index 0000000000..49c2b7fbd0
--- /dev/null
+++ b/queue-6.6/usb-gadget-f_fs-fix-epfile-null-pointer-access-after.patch
@@ -0,0 +1,60 @@
+From e1a52bf7e1f33a3b693e3f540ff9769c347a85c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 17:29:07 +0800
+Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
+
+From: Owen Gu <guhuinan@xiaomi.com>
+
+[ Upstream commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 ]
+
+A race condition occurs when ffs_func_eps_enable() runs concurrently
+with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
+sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
+to a NULL pointer dereference when accessing epfile->ep in
+ffs_func_eps_enable() after successful usb_ep_enable().
+
+The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
+ffs_data_close() functions, and its modification is protected by the
+spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
+is also protected by ffs->eps_lock.
+
+Thus, add NULL pointer handling for ffs->epfiles in the
+ffs_func_eps_enable() function to fix issues
+
+Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
+Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 4a88546b1b157..14424e395f2a9 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1941,7 +1941,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	ep = func->eps;
+ 	epfile = ffs->epfiles;
+ 	count = ffs->eps_count;
+-	while(count--) {
++	if (!epfile) {
++		ret = -ENOMEM;
++		goto done;
++	}
++
++	while (count--) {
+ 		ep->ep->driver_data = ep;
+ 
+ 		ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
+@@ -1965,6 +1970,7 @@ static int ffs_func_eps_enable(struct ffs_function *func)
+ 	}
+ 
+ 	wake_up_interruptible(&ffs->wait);
++done:
+ 	spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
+ 
+ 	return ret;
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch b/queue-6.6/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
new file mode 100644
index 0000000000..ec743b0d74
--- /dev/null
+++ b/queue-6.6/usb-gadget-f_hid-fix-zero-length-packet-transfer.patch
@@ -0,0 +1,47 @@
+From ca73298d3a7fd8202cf5770d9dccc6e78396225f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Aug 2025 18:28:07 +0800
+Subject: usb: gadget: f_hid: Fix zero length packet transfer
+
+From: William Wu <william.wu@rock-chips.com>
+
+[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
+
+Set the hid req->zero flag of ep0/in_ep to true by default,
+then the UDC drivers can transfer a zero length packet at
+the end if the hid transfer with size divisible to EPs max
+packet size according to the USB 2.0 spec.
+
+Signed-off-by: William Wu <william.wu@rock-chips.com>
+Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_hid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
+index 2f1ec03d17d6d..d8dafebeabea4 100644
+--- a/drivers/usb/gadget/function/f_hid.c
++++ b/drivers/usb/gadget/function/f_hid.c
+@@ -494,7 +494,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
+ 	}
+ 
+ 	req->status   = 0;
+-	req->zero     = 0;
++	req->zero     = 1;
+ 	req->length   = count;
+ 	req->complete = f_hidg_req_complete;
+ 	req->context  = hidg;
+@@ -765,7 +765,7 @@ static int hidg_setup(struct usb_function *f,
+ 	return -EOPNOTSUPP;
+ 
+ respond:
+-	req->zero = 0;
++	req->zero = 1;
+ 	req->length = length;
+ 	status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
+ 	if (status < 0)
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch b/queue-6.6/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
new file mode 100644
index 0000000000..9704ce5bf1
--- /dev/null
+++ b/queue-6.6/usb-gadget-f_ncm-fix-mac-assignment-ncm-ethernet.patch
@@ -0,0 +1,56 @@
+From da53176df36a71ed874d8d14f35d66ec9055dd47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Aug 2025 09:07:21 -0400
+Subject: usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
+
+From: raub camaioni <raubcameo@gmail.com>
+
+[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
+
+This fix is already present in f_ecm.c and was never
+propagated to f_ncm.c
+
+When creating multiple NCM ethernet devices
+on a composite usb gadget device
+each MAC address on the HOST side will be identical.
+Having the same MAC on different network interfaces is bad.
+
+This fix updates the MAC address inside the
+ncm_strings_defs global during the ncm_bind call.
+This ensures each device has a unique MAC.
+In f_ecm.c ecm_string_defs is updated in the same way.
+
+The defunct MAC assignment in ncm_alloc has been removed.
+
+Signed-off-by: raub camaioni <raubcameo@gmail.com>
+Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index 7aad737901e83..1da4e59338c56 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1449,6 +1449,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
+ 
+ 	ncm_opts->bound = true;
+ 
++	ncm_string_defs[1].s = ncm->ethaddr;
++
+ 	us = usb_gstrings_attach(cdev, ncm_strings,
+ 				 ARRAY_SIZE(ncm_string_defs));
+ 	if (IS_ERR(us))
+@@ -1696,7 +1698,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
+ 		mutex_unlock(&opts->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+-	ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
+ 
+ 	spin_lock_init(&ncm->lock);
+ 	ncm_reset_values(ncm);
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch b/queue-6.6/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
new file mode 100644
index 0000000000..c0cc99ff9e
--- /dev/null
+++ b/queue-6.6/usb-mon-increase-buff_max-to-64-mib-to-support-multi.patch
@@ -0,0 +1,85 @@
+From cf0f70e0eeb7aca77edabadd58215c8765a929eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Sep 2025 15:55:10 -0400
+Subject: usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
+
+The usbmon binary interface currently truncates captures of large
+transfers from higher-speed USB devices. Because a single event capture
+is limited to one-fifth of the total buffer size, the current maximum
+size of a captured URB is around 240 KiB. This is insufficient when
+capturing traffic from modern devices that use transfers of several
+hundred kilobytes or more, as truncated URBs can make it impossible for
+user-space USB analysis tools like Wireshark to properly defragment and
+reassemble higher-level protocol packets in the captured data.
+
+The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
+not been changed since the binary interface was introduced in 2006.
+
+To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
+original comment for BUFF_MAX based the limit's calculation on a
+saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
+Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
+buffer should be at least 50 MB. The new limit of 64 MiB covers that,
+plus a little extra for any overhead.
+
+With this change, both users and developers should now be able to debug
+and reverse engineer modern USB devices even when running unmodified
+distro kernels.
+
+Please note that this change does not affect the default buffer size. A
+larger buffer is only allocated when a user explicitly requests it via
+the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
+should not unduly increase memory usage for users that don't
+deliberately request a larger buffer.
+
+Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mon/mon_bin.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
+index 4e30de4db1c0a..dabe1a5c6ae56 100644
+--- a/drivers/usb/mon/mon_bin.c
++++ b/drivers/usb/mon/mon_bin.c
+@@ -68,18 +68,20 @@
+  * The magic limit was calculated so that it allows the monitoring
+  * application to pick data once in two ticks. This way, another application,
+  * which presumably drives the bus, gets to hog CPU, yet we collect our data.
+- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
+- * enormous overhead built into the bus protocol, so we need about 1000 KB.
++ *
++ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
++ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
++ * buffer size is set to 64 MiB to accommodate this.
+  *
+  * This is still too much for most cases, where we just snoop a few
+  * descriptor fetches for enumeration. So, the default is a "reasonable"
+- * amount for systems with HZ=250 and incomplete bus saturation.
++ * amount for typical, low-throughput use cases.
+  *
+  * XXX What about multi-megabyte URBs which take minutes to transfer?
+  */
+-#define BUFF_MAX  CHUNK_ALIGN(1200*1024)
+-#define BUFF_DFL   CHUNK_ALIGN(300*1024)
+-#define BUFF_MIN     CHUNK_ALIGN(8*1024)
++#define BUFF_MAX  CHUNK_ALIGN(64*1024*1024)
++#define BUFF_DFL      CHUNK_ALIGN(300*1024)
++#define BUFF_MIN        CHUNK_ALIGN(8*1024)
+ 
+ /*
+  * The per-event API header (2 per URB).
+-- 
+2.51.0
+
diff --git a/queue-6.6/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch b/queue-6.6/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
new file mode 100644
index 0000000000..1e2027b584
--- /dev/null
+++ b/queue-6.6/usb-xhci-plat-facilitate-using-autosuspend-for-xhci-.patch
@@ -0,0 +1,40 @@
+From 2af7c7ec1f3105e38eeaba0a8832016759813a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Sep 2025 17:34:36 +0530
+Subject: usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
+
+From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+
+[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
+
+Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
+when in host mode, it is intended that the controller goes to suspend
+state to save power and wait for interrupts from connected peripheral
+to wake it up. This is particularly used in cases where a HID or Audio
+device is connected. In such scenarios, the usb controller can enter
+auto suspend and resume action after getting interrupts from the
+connected device.
+
+Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
+Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-plat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index b350ee080236e..64383566cfb77 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -168,6 +168,7 @@ int xhci_plat_probe(struct platform_device *pdev, struct device *sysdev, const s
+ 		return ret;
+ 
+ 	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_get_noresume(&pdev->dev);
+ 
+-- 
+2.51.0
+
diff --git a/queue-6.6/vfio-return-enotty-for-unsupported-device-feature.patch b/queue-6.6/vfio-return-enotty-for-unsupported-device-feature.patch
new file mode 100644
index 0000000000..4d9c1d293b
--- /dev/null
+++ b/queue-6.6/vfio-return-enotty-for-unsupported-device-feature.patch
@@ -0,0 +1,40 @@
+From 27cc56a3a296ad0774dad774d95173e2469adfde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Sep 2025 08:58:40 -0700
+Subject: vfio: return -ENOTTY for unsupported device feature
+
+From: Alex Mastro <amastro@fb.com>
+
+[ Upstream commit 16df67f2189a71a8310bcebddb87ed569e8352be ]
+
+The two implementers of vfio_device_ops.device_feature,
+vfio_cdx_ioctl_feature and vfio_pci_core_ioctl_feature, return
+-ENOTTY in the fallthrough case when the feature is unsupported. For
+consistency, the base case, vfio_ioctl_device_feature, should do the
+same when device_feature == NULL, indicating an implementation has no
+feature extensions.
+
+Signed-off-by: Alex Mastro <amastro@fb.com>
+Link: https://lore.kernel.org/r/20250908-vfio-enotty-v1-1-4428e1539e2e@fb.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
+index edb631e5e7ec9..6dfb290c339f9 100644
+--- a/drivers/vfio/vfio_main.c
++++ b/drivers/vfio/vfio_main.c
+@@ -1195,7 +1195,7 @@ static int vfio_ioctl_device_feature(struct vfio_device *device,
+ 			feature.argsz - minsz);
+ 	default:
+ 		if (unlikely(!device->ops->device_feature))
+-			return -EINVAL;
++			return -ENOTTY;
+ 		return device->ops->device_feature(device, feature.flags,
+ 						   arg->data,
+ 						   feature.argsz - minsz);
+-- 
+2.51.0
+
diff --git a/queue-6.6/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch b/queue-6.6/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
new file mode 100644
index 0000000000..5fffad64b4
--- /dev/null
+++ b/queue-6.6/watchdog-s3c2410_wdt-fix-max_timeout-being-calculate.patch
@@ -0,0 +1,59 @@
+From 06c2a336cf5eb119c5ab74cce0ff163252c81e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Aug 2025 11:18:23 +0900
+Subject: watchdog: s3c2410_wdt: Fix max_timeout being calculated larger
+
+From: Sangwook Shin <sw617.shin@samsung.com>
+
+[ Upstream commit df3c6e0b6d83450563d6266e1dacc7eaf25511f4 ]
+
+Fix the issue of max_timeout being calculated larger than actual value.
+The calculation result of freq / (S3C2410_WTCON_PRESCALE_MAX + 1) /
+S3C2410_WTCON_MAXDIV is smaller than the actual value because the remainder
+is discarded during the calculation process. This leads to a larger
+calculated value for max_timeout compared to the actual settable value.
+To resolve this issue, the order of calculations in the computation process
+has been adjusted.
+
+Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
+Signed-off-by: Sangwook Shin <sw617.shin@samsung.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/s3c2410_wdt.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
+index 0b4bd883ff28a..183d77a6c4b31 100644
+--- a/drivers/watchdog/s3c2410_wdt.c
++++ b/drivers/watchdog/s3c2410_wdt.c
+@@ -26,6 +26,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/regmap.h>
+ #include <linux/delay.h>
++#include <linux/math64.h>
+ 
+ #define S3C2410_WTCON		0x00
+ #define S3C2410_WTDAT		0x04
+@@ -302,9 +303,14 @@ static inline unsigned long s3c2410wdt_get_freq(struct s3c2410_wdt *wdt)
+ static inline unsigned int s3c2410wdt_max_timeout(struct s3c2410_wdt *wdt)
+ {
+ 	const unsigned long freq = s3c2410wdt_get_freq(wdt);
++	const u64 n_max = (u64)(S3C2410_WTCON_PRESCALE_MAX + 1) *
++			S3C2410_WTCON_MAXDIV * S3C2410_WTCNT_MAXCNT;
++	u64 t_max = div64_ul(n_max, freq);
+ 
+-	return S3C2410_WTCNT_MAXCNT / (freq / (S3C2410_WTCON_PRESCALE_MAX + 1)
+-				       / S3C2410_WTCON_MAXDIV);
++	if (t_max > UINT_MAX)
++		t_max = UINT_MAX;
++
++	return t_max;
+ }
+ 
+ static int s3c2410wdt_disable_wdt_reset(struct s3c2410_wdt *wdt, bool mask)
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-ath10k-fix-connection-after-gtk-rekeying.patch b/queue-6.6/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
new file mode 100644
index 0000000000..d3972357ce
--- /dev/null
+++ b/queue-6.6/wifi-ath10k-fix-connection-after-gtk-rekeying.patch
@@ -0,0 +1,66 @@
+From 36b133ba34148bd2c6a18add51dbec9be47d711e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Sep 2025 16:32:25 +0200
+Subject: wifi: ath10k: Fix connection after GTK rekeying
+
+From: Loic Poulain <loic.poulain@oss.qualcomm.com>
+
+[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
+
+It appears that not all hardware/firmware implementations support
+group key deletion correctly, which can lead to connection hangs
+and deauthentication following GTK rekeying (delete and install).
+
+To avoid this issue, instead of attempting to delete the key using
+the special WMI_CIPHER_NONE value, we now replace the key with an
+invalid (random) value.
+
+This behavior has been observed with WCN39xx chipsets.
+
+Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
+Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
+Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
+Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
+Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 655fb5cdf01f8..233e5c619fa4e 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -14,6 +14,7 @@
+ #include <linux/acpi.h>
+ #include <linux/of.h>
+ #include <linux/bitfield.h>
++#include <linux/random.h>
+ 
+ #include "hif.h"
+ #include "core.h"
+@@ -287,8 +288,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
+ 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+-		arg.key_data = NULL;
++		if (flags & WMI_KEY_GROUP) {
++			/* Not all hardware handles group-key deletion operation
++			 * correctly. Replace the key with a junk value to invalidate it.
++			 */
++			get_random_bytes(key->key, key->keylen);
++		} else {
++			arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
++			arg.key_data = NULL;
++		}
+ 	}
+ 
+ 	return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch b/queue-6.6/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
new file mode 100644
index 0000000000..29e47d2fec
--- /dev/null
+++ b/queue-6.6/wifi-ath12k-increase-dp_reo_cmd_ring_size-to-256.patch
@@ -0,0 +1,41 @@
+From f264884e2701835df43949ba969ef571d42ff7b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Aug 2025 16:47:44 +0530
+Subject: wifi: ath12k: Increase DP_REO_CMD_RING_SIZE to 256
+
+From: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+
+[ Upstream commit 82993345aef6987a916337ebd2fca3ff4a6250a7 ]
+
+Increase DP_REO_CMD_RING_SIZE from 128 to 256 to avoid
+queuing failures observed during stress test scenarios.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Nithyanantham Paramasivam <nithyanantham.paramasivam@oss.qualcomm.com>
+Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
+Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250806111750.3214584-2-nithyanantham.paramasivam@oss.qualcomm.com
+Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/dp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/dp.h b/drivers/net/wireless/ath/ath12k/dp.h
+index 61f765432516b..284032db0b98d 100644
+--- a/drivers/net/wireless/ath/ath12k/dp.h
++++ b/drivers/net/wireless/ath/ath12k/dp.h
+@@ -162,7 +162,7 @@ struct ath12k_pdev_dp {
+ #define DP_REO_REINJECT_RING_SIZE	32
+ #define DP_RX_RELEASE_RING_SIZE		1024
+ #define DP_REO_EXCEPTION_RING_SIZE	128
+-#define DP_REO_CMD_RING_SIZE		128
++#define DP_REO_CMD_RING_SIZE		256
+ #define DP_REO_STATUS_RING_SIZE		2048
+ #define DP_RXDMA_BUF_RING_SIZE		4096
+ #define DP_RXDMA_REFILL_RING_SIZE	2048
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-mac80211-fix-he-capabilities-element-check.patch b/queue-6.6/wifi-mac80211-fix-he-capabilities-element-check.patch
new file mode 100644
index 0000000000..53fcade0e5
--- /dev/null
+++ b/queue-6.6/wifi-mac80211-fix-he-capabilities-element-check.patch
@@ -0,0 +1,37 @@
+From aba9f57d167baf649a422e002fe47642f1b1c197 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Sep 2025 11:51:17 +0300
+Subject: wifi: mac80211: Fix HE capabilities element check
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit ea928544f3215fdeac24d66bef85e10bb638b8c1 ]
+
+The element data length check did not account for the extra
+octet used for the extension ID. Fix it.
+
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://patch.msgid.link/20250907115109.8da0012e2286.I8c0c69a0011f7153c13b365b14dfef48cfe7c3e3@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 295c2fdbd3c74..aa7cee830b004 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4507,7 +4507,7 @@ static u8 ieee80211_max_rx_chains(struct ieee80211_link_data *link,
+ 	he_cap_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY,
+ 					     ies->data, ies->len);
+ 
+-	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap))
++	if (!he_cap_elem || he_cap_elem->datalen < sizeof(*he_cap) + 1)
+ 		return chains;
+ 
+ 	/* skip one byte ext_tag_id */
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch b/queue-6.6/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
new file mode 100644
index 0000000000..852de01ca0
--- /dev/null
+++ b/queue-6.6/wifi-mt76-mt7921-add-160mhz-beamformee-capability-fo.patch
@@ -0,0 +1,43 @@
+From 48a6a936cdb19b5d8dc3cc4d290c53f8062b1104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Aug 2025 20:39:42 +0800
+Subject: wifi: mt76: mt7921: Add 160MHz beamformee capability for mt7922
+ device
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 25ef5b5d02ac03fe8dd91cf25bd011a570fbeba2 ]
+
+Enable 160MHz beamformee support on mt7922 by updating HE capability
+element configuration. Previously, only 160MHz channel width was set,
+but beamformee for 160MHz was not properly advertised. This patch
+adds BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4 capability to allow devices
+to utilize 160MHz BW for beamforming.
+
+Tested by connecting to 160MHz-bandwidth beamforming AP and verified
+HE capability.
+
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Link: https://patch.msgid.link/ae637afaffed387018fdc43709470ef65898ff0b.1756383627.git.quan.zhou@mediatek.com
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 15b7d22d3639f..ae7a01c7ce36d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -135,6 +135,8 @@ mt7921_init_he_caps(struct mt792x_phy *phy, enum nl80211_band band,
+ 			if (is_mt7922(phy->mt76->dev)) {
+ 				he_cap_elem->phy_cap_info[0] |=
+ 					IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G;
++				he_cap_elem->phy_cap_info[4] |=
++					IEEE80211_HE_PHY_CAP4_BEAMFORMEE_MAX_STS_ABOVE_80MHZ_4;
+ 				he_cap_elem->phy_cap_info[8] |=
+ 					IEEE80211_HE_PHY_CAP8_20MHZ_IN_160MHZ_HE_PPDU |
+ 					IEEE80211_HE_PHY_CAP8_80MHZ_IN_160MHZ_HE_PPDU;
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-mt76-mt7996-temporarily-disable-epcs.patch b/queue-6.6/wifi-mt76-mt7996-temporarily-disable-epcs.patch
new file mode 100644
index 0000000000..e555540507
--- /dev/null
+++ b/queue-6.6/wifi-mt76-mt7996-temporarily-disable-epcs.patch
@@ -0,0 +1,36 @@
+From c1deac3ce7b8ef35e1e502ebc4a8752d4b8c61b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Sep 2025 09:56:42 +0200
+Subject: wifi: mt76: mt7996: Temporarily disable EPCS
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit e6291bb7a5935b2f1d337fd7a58eab7ada6678ad ]
+
+EPCS is not yet ready, so do not claim to support it.
+
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Co-developed-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250904-mt7996-mlo-more-fixes-v1-4-89d8fed67f20@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 375a3d6f4b384..fa81a1c30704b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -730,7 +730,6 @@ mt7996_init_eht_caps(struct mt7996_phy *phy, enum nl80211_band band,
+ 	eht_cap->has_eht = true;
+ 
+ 	eht_cap_elem->mac_cap_info[0] =
+-		IEEE80211_EHT_MAC_CAP0_EPCS_PRIO_ACCESS |
+ 		IEEE80211_EHT_MAC_CAP0_OM_CONTROL |
+ 		u8_encode_bits(IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_11454,
+ 			       IEEE80211_EHT_MAC_CAP0_MAX_MPDU_LEN_MASK);
+-- 
+2.51.0
+
diff --git a/queue-6.6/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch b/queue-6.6/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
new file mode 100644
index 0000000000..1667545d0d
--- /dev/null
+++ b/queue-6.6/wifi-rtw88-sdio-use-indirect-io-for-device-registers.patch
@@ -0,0 +1,52 @@
+From e424370274dd9bee6da7139105fef0d2a31a0099 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jul 2025 08:48:15 +0800
+Subject: wifi: rtw88: sdio: use indirect IO for device registers before
+ power-on
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 58de1f91e033b1fface8d8948984583125f93736 ]
+
+The register REG_SYS_CFG1 is used to determine chip basic information
+as arguments of following flows, such as download firmware and load PHY
+parameters, so driver read the value early (before power-on).
+
+However, the direct IO is disallowed before power-on, or it causes wrong
+values, which driver recognizes a chip as a wrong type RF_1T1R, but
+actually RF_2T2R, causing driver warns:
+
+  rtw88_8822cs mmc1:0001:1: unsupported rf path (1)
+
+Fix it by using indirect IO before power-on.
+
+Reported-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/699C22B4-A3E3-4206-97D0-22AB3348EBF6@gmail.com/T/#t
+Suggested-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Tested-by: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20250724004815.7043-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
+index 832a427279b40..df4248744d87a 100644
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -143,6 +143,10 @@ static u32 rtw_sdio_to_io_address(struct rtw_dev *rtwdev, u32 addr,
+ 
+ static bool rtw_sdio_use_direct_io(struct rtw_dev *rtwdev, u32 addr)
+ {
++	if (!test_bit(RTW_FLAG_POWERON, rtwdev->flags) &&
++	    !rtw_sdio_is_bus_addr(addr))
++		return false;
++
+ 	return !rtw_sdio_is_sdio30_supported(rtwdev) ||
+ 		rtw_sdio_is_bus_addr(addr);
+ }
+-- 
+2.51.0
+
diff --git a/queue-6.6/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch b/queue-6.6/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
new file mode 100644
index 0000000000..dee3fc154c
--- /dev/null
+++ b/queue-6.6/x86-kvm-prefer-native-qspinlock-for-dedicated-vcpus-.patch
@@ -0,0 +1,81 @@
+From 7266174a4b68cfcc0ea53d2f66338a11bf94a9e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jul 2025 19:00:05 +0800
+Subject: x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of
+ PV_UNHALT
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
+
+The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
+physical CPUs are available") states that when PV_DEDICATED=1
+(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
+PV_UNHALT.  However, the current implementation doesn't reflect this: when
+PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
+
+This is suboptimal because:
+1. Native qspinlocks should outperform virt_spin_lock() for dedicated
+   vCPUs irrespective of HALT exiting
+2. virt_spin_lock() should only be preferred when vCPUs may be preempted
+   (non-dedicated case)
+
+So reorder the PV spinlock checks to:
+1. First handle dedicated pCPU case (disable virt_spin_lock_key)
+2. Second check single CPU, and nopvspin configuration
+3. Only then check PV_UNHALT support
+
+This ensures we always use native qspinlock for dedicated vCPUs, delivering
+pretty performance gains at high contention levels.
+
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Tested-by: Wangyang Guo <wangyang.guo@intel.com>
+Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kvm.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index b8ab9ee5896c1..b5ef2c2899f2a 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -1066,16 +1066,6 @@ static void kvm_wait(u8 *ptr, u8 val)
+  */
+ void __init kvm_spinlock_init(void)
+ {
+-	/*
+-	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+-	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+-	 * preferred over native qspinlock when vCPU is preempted.
+-	 */
+-	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+-		pr_info("PV spinlocks disabled, no host support\n");
+-		return;
+-	}
+-
+ 	/*
+ 	 * Disable PV spinlocks and use native qspinlock when dedicated pCPUs
+ 	 * are available.
+@@ -1095,6 +1085,16 @@ void __init kvm_spinlock_init(void)
+ 		goto out;
+ 	}
+ 
++	/*
++	 * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
++	 * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
++	 * preferred over native qspinlock when vCPU is preempted.
++	 */
++	if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
++		pr_info("PV spinlocks disabled, no host support\n");
++		return;
++	}
++
+ 	pr_info("PV spinlocks enabled\n");
+ 
+ 	__pv_init_lock_hash();
+-- 
+2.51.0
+
diff --git a/queue-6.6/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch b/queue-6.6/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
new file mode 100644
index 0000000000..2892a83449
--- /dev/null
+++ b/queue-6.6/x86-vsyscall-do-not-require-x86_pf_instr-to-emulate-.patch
@@ -0,0 +1,79 @@
+From 093714a56de0f9fb2c3dc28f8bfc8d5e44d9be33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jun 2025 17:59:18 +0300
+Subject: x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
+
+emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
+page fault, but the CPU does not report X86_PF_INSTR if neither
+X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
+
+X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
+early P4 processors that did not support this feature.
+
+Instead of explicitly checking for X86_PF_INSTR, compare the fault
+address to RIP.
+
+On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
+to fault address but X86_PF_INSTR is absent.
+
+[ dhansen: flesh out code comments ]
+
+Originally-by: Dave Hansen <dave.hansen@intel.com>
+Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
+Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
+Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
+index 2fb7d53cf3338..95e053b0a4bc0 100644
+--- a/arch/x86/entry/vsyscall/vsyscall_64.c
++++ b/arch/x86/entry/vsyscall/vsyscall_64.c
+@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
+ 	if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+ 		return false;
+ 
+-	if (!(error_code & X86_PF_INSTR)) {
++	/*
++	 * Assume that faults at regs->ip are because of an
++	 * instruction fetch. Return early and avoid
++	 * emulation for faults during data accesses:
++	 */
++	if (address != regs->ip) {
+ 		/* Failed vsyscall read */
+ 		if (vsyscall_mode == EMULATE)
+ 			return false;
+@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
+ 		return false;
+ 	}
+ 
++	/*
++	 * X86_PF_INSTR is only set when NX is supported.  When
++	 * available, use it to double-check that the emulation code
++	 * is only being used for instruction fetches:
++	 */
++	if (cpu_feature_enabled(X86_FEATURE_NX))
++		WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
++
+ 	/*
+ 	 * No point in checking CS -- the only way to get here is a user mode
+ 	 * trap to a high address, which means that we're in 64-bit user code.
+ 	 */
+ 
+-	WARN_ON_ONCE(address != regs->ip);
+-
+ 	if (vsyscall_mode == NONE) {
+ 		warn_bad_vsyscall(KERN_INFO, regs,
+ 				  "vsyscall attempted with vsyscall=none");
+-- 
+2.51.0
+
-- 
2.47.3