release 6.16.3 (preliminary)

2025-08-25 00:14:57 +03:00
parent 86c5c0ef41
commit 44cb6acc9c
238 changed files with 10031 additions and 3060 deletions
--- a/debian/bin/genpatch-pf
+++ b/debian/bin/genpatch-pf
@@ -7,7 +7,7 @@ w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w"

 dst='debian/patches/tmp-pf'
 src='../linux-extras'
-branches='fixes archlinux cpuidle exfat kbuild nfs smb xfs'
+branches='archlinux bbr3 cpuidle kbuild steady'

 if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi
 mkdir -p "${dst}"
--- a/debian/bin/genpatch-zen
+++ b/debian/bin/genpatch-zen
@@ -7,7 +7,7 @@ w=$(git rev-parse --path-format=absolute --show-toplevel) ; : "${w:?}" ; cd "$w"

 dst='debian/patches/tmp-zen'
 src='../linux-extras'
-branches='zen-sauce fixes'
+branches='bbr3 fixes zen-sauce'

 if [ -d "${dst}" ] ; then rm -rf "${dst}" ; fi
 mkdir -p "${dst}"
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,71 +1,9 @@
-linux (6.15.11-1) sid; urgency=medium
+linux (6.16.3-1) sid; urgency=medium

  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.11
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.1
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.2
+    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.16.3
+  * New upstream release: https://kernelnewbies.org/Linux_6.16

- -- Konstantin Demin <rockdrilla@gmail.com>  Wed, 20 Aug 2025 21:45:46 +0300
-
-linux (6.15.10-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.10
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Fri, 15 Aug 2025 15:43:04 +0300
-
-linux (6.15.9-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.9
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Fri, 01 Aug 2025 16:49:13 +0300
-
-linux (6.15.8-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.8
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Sat, 26 Jul 2025 12:31:39 +0300
-
-linux (6.15.7-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.7
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Thu, 17 Jul 2025 22:21:12 +0300
-
-linux (6.15.6-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.6
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Thu, 10 Jul 2025 19:38:23 +0300
-
-linux (6.15.5-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.5
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Mon, 07 Jul 2025 01:40:22 +0300
-
-linux (6.15.4-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.4
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Fri, 27 Jun 2025 14:05:47 +0300
-
-linux (6.15.3-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.3
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Thu, 19 Jun 2025 17:46:46 +0300
-
-linux (6.15.2-1) sid; urgency=medium
-
-  * New upstream stable update:
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.1
-    https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.2
-  * New upstream release: https://kernelnewbies.org/Linux_6.15
-
- -- Konstantin Demin <rockdrilla@gmail.com>  Tue, 17 Jun 2025 12:18:45 +0300
+ -- Konstantin Demin <rockdrilla@gmail.com>  Sun, 24 Aug 2025 20:54:35 +0300
--- a/debian/config/amd64/config.cloud
+++ b/debian/config/amd64/config.cloud
@@ -91,6 +91,7 @@ CONFIG_IO_DELAY_NONE=y
 ##
 ## file: crypto/Kconfig
 ##
+# CONFIG_CRYPTO_BENCHMARK is not set
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_842=m
@@ -201,6 +202,7 @@ CONFIG_SATA_MOBILE_LPM_POLICY=0
 ## file: drivers/block/Kconfig
 ##
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_ZONED_LOOP is not set

 ##
 ## file: drivers/block/mtip32xx/Kconfig
@@ -295,6 +297,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
 # CONFIG_CRYPTO_DEV_QAT_C62X is not set
 # CONFIG_CRYPTO_DEV_QAT_4XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_420XX is not set
+# CONFIG_CRYPTO_DEV_QAT_6XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
@@ -474,7 +477,6 @@ CONFIG_HWMON=m
 # CONFIG_SENSORS_NCT6683 is not set
 # CONFIG_SENSORS_NCT6775 is not set
 # CONFIG_SENSORS_NPCM7XX is not set
-# CONFIG_SENSORS_OXP is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
@@ -826,6 +828,7 @@ CONFIG_FUSION_FC=m
 ##
 ## file: drivers/net/Kconfig
 ##
+# CONFIG_OVPN is not set
 # CONFIG_FUJITSU_ES is not set

 ##
@@ -1223,6 +1226,7 @@ CONFIG_FBNIC=m
 ##
 ## file: drivers/net/phy/Kconfig
 ##
+# CONFIG_AS21XXX_PHY is not set
 # CONFIG_AIR_EN8811H_PHY is not set
 # CONFIG_AMD_PHY is not set
 # CONFIG_ADIN_PHY is not set
@@ -1245,6 +1249,7 @@ CONFIG_FBNIC=m
 # CONFIG_MARVELL_88Q2XXX_PHY is not set
 # CONFIG_MARVELL_88X2222_PHY is not set
 # CONFIG_MAXLINEAR_GPHY is not set
+# CONFIG_MAXLINEAR_86110_PHY is not set
 # CONFIG_MICREL_PHY is not set
 # CONFIG_MICROCHIP_T1S_PHY is not set
 # CONFIG_MICROCHIP_PHY is not set
@@ -1389,7 +1394,7 @@ CONFIG_PCIEASPM_DEFAULT=y
 ##
 ## file: drivers/pci/pwrctrl/Kconfig
 ##
-# CONFIG_PCI_PWRCTL_SLOT is not set
+# CONFIG_PCI_PWRCTRL_SLOT is not set

 ##
 ## file: drivers/pci/switch/Kconfig
@@ -1762,6 +1767,7 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_IBMASR is not set
 # CONFIG_WAFER_WDT is not set
 # CONFIG_IE6XX_WDT is not set
+# CONFIG_INTEL_OC_WATCHDOG is not set
 # CONFIG_IT8712F_WDT is not set
 # CONFIG_IT87_WDT is not set
 # CONFIG_HP_WATCHDOG is not set
@@ -1832,6 +1838,11 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 ##
 # CONFIG_EFS_FS is not set

+##
+## file: fs/erofs/Kconfig
+##
+# CONFIG_EROFS_FS_ZIP_ACCEL is not set
+
 ##
 ## file: fs/f2fs/Kconfig
 ##
@@ -1967,6 +1978,11 @@ CONFIG_PROC_VMCORE=y
 ##
 # CONFIG_CIFS is not set

+##
+## file: fs/squashfs/Kconfig
+##
+# CONFIG_SQUASHFS_COMP_CACHE_FULL is not set
+
 ##
 ## file: fs/ufs/Kconfig
 ##
@@ -1996,6 +2012,7 @@ CONFIG_KEXEC_SIG=y
 CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y
 CONFIG_KEXEC_JUMP=y
 CONFIG_CRASH_DUMP=y
+# CONFIG_CRASH_DM_CRYPT is not set
 CONFIG_CRASH_HOTPLUG=y
 CONFIG_CRASH_MAX_MEMORY_RANGES=8192

@@ -2340,10 +2357,7 @@ CONFIG_CRYPTO_LIB_AESCFB=m
 CONFIG_CRYPTO_LIB_CHACHA=m
 CONFIG_CRYPTO_LIB_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LIB_CHACHA_GENERIC=m
-CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=m
 CONFIG_CRYPTO_LIB_POLY1305=m
-CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m
-CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=m
 CONFIG_CRYPTO_POLY1305_X86_64=m
 CONFIG_CXL_PORT=y
 CONFIG_INFINIBAND_ADDR_TRANS_CONFIGFS=y
@@ -2364,6 +2378,7 @@ CONFIG_ND_BTT=m
 CONFIG_ND_PFN=m
 CONFIG_NETFS_SUPPORT=m
 # CONFIG_NVMEM_LAYOUTS is not set
+CONFIG_PLDMFW=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_RATIONAL=m
 CONFIG_SCSI_COMMON=m
--- a/debian/config/amd64/config.mobile
+++ b/debian/config/amd64/config.mobile
@@ -107,6 +107,7 @@ CONFIG_SYSTEM_BLACKLIST_AUTH_UPDATE=y
 ##
 ## file: crypto/Kconfig
 ##
+CONFIG_CRYPTO_BENCHMARK=m
 CONFIG_CRYPTO_ECDH=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_842=y
@@ -320,6 +321,7 @@ CONFIG_BCMA_DRIVER_GPIO=y
 ## file: drivers/block/Kconfig
 ##
 CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_ZONED_LOOP=m

 ##
 ## file: drivers/block/mtip32xx/Kconfig
@@ -332,7 +334,6 @@ CONFIG_BLK_DEV_PCIESSD_MTIP32XX=m
 CONFIG_BT_HCIBTUSB=m
 CONFIG_BT_HCIBTUSB_AUTOSUSPEND=y
 CONFIG_BT_HCIBTUSB_POLL_SYNC=y
-CONFIG_BT_HCIBTUSB_AUTO_ISOC_ALT=y
 CONFIG_BT_HCIBTUSB_BCM=y
 CONFIG_BT_HCIBTUSB_MTK=y
 CONFIG_BT_HCIBTUSB_RTL=y
@@ -545,6 +546,7 @@ CONFIG_CRYPTO_DEV_QAT_C3XXX=m
 CONFIG_CRYPTO_DEV_QAT_C62X=m
 CONFIG_CRYPTO_DEV_QAT_4XXX=m
 CONFIG_CRYPTO_DEV_QAT_420XX=m
+CONFIG_CRYPTO_DEV_QAT_6XXX=m
 CONFIG_CRYPTO_DEV_QAT_DH895xCCVF=m
 CONFIG_CRYPTO_DEV_QAT_C3XXXVF=m
 CONFIG_CRYPTO_DEV_QAT_C62XVF=m
@@ -556,6 +558,7 @@ CONFIG_CRYPTO_DEV_QAT_ERROR_INJECTION=y
 CONFIG_CXL_BUS=m
 CONFIG_CXL_MEM_RAW_COMMANDS=y
 CONFIG_CXL_FEATURES=y
+# CONFIG_CXL_EDAC_MEM_FEATURES is not set

 ##
 ## file: drivers/devfreq/Kconfig
@@ -711,6 +714,14 @@ CONFIG_GOOGLE_MEMCONSOLE_X86_LEGACY=m
 CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT=y
 # CONFIG_GOOGLE_VPD is not set

+##
+## file: drivers/firmware/qcom/Kconfig
+##
+## choice: TrustZone interface memory allocator mode
+CONFIG_QCOM_TZMEM_MODE_GENERIC=y
+# CONFIG_QCOM_TZMEM_MODE_SHMBRIDGE is not set
+## end choice
+
 ##
 ## file: drivers/fsi/Kconfig
 ##
@@ -809,6 +820,7 @@ CONFIG_GPIO_LP87565=m
 CONFIG_GPIO_MADERA=m
 CONFIG_GPIO_MAX77620=m
 CONFIG_GPIO_MAX77650=m
+CONFIG_GPIO_MAX77759=m
 CONFIG_GPIO_PALMAS=y
 CONFIG_GPIO_RC5T583=y
 CONFIG_GPIO_STMPE=y
@@ -855,14 +867,18 @@ CONFIG_GPIO_VIRTUSER=m
 ## file: drivers/gpu/drm/Kconfig
 ##
 CONFIG_DRM=y
-# CONFIG_DRM_DEBUG_MM is not set
 # CONFIG_DRM_PANIC is not set
 # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
 # CONFIG_DRM_DEBUG_MODESET_LOCK is not set
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM_VGEM=m
 CONFIG_DRM_HYPERV=m
+
+##
+## file: drivers/gpu/drm/Kconfig.debug
+##
 # CONFIG_DRM_WERROR is not set
+# CONFIG_DRM_DEBUG_MM is not set

 ##
 ## file: drivers/gpu/drm/amd/acp/Kconfig
@@ -1072,6 +1088,7 @@ CONFIG_DRM_PANEL_ASUS_Z00T_TM5P5_NT35596=m
 CONFIG_DRM_PANEL_AUO_A030JTN01=m
 CONFIG_DRM_PANEL_BOE_BF060Y8M_AJ0=m
 CONFIG_DRM_PANEL_BOE_HIMAX8279D=m
+CONFIG_DRM_PANEL_BOE_TD4320=m
 CONFIG_DRM_PANEL_BOE_TH101MB31UIG002_28A=m
 CONFIG_DRM_PANEL_BOE_TV101WUM_NL6=m
 CONFIG_DRM_PANEL_BOE_TV101WUM_LL2=m
@@ -1081,6 +1098,7 @@ CONFIG_DRM_PANEL_FEIXIN_K101_IM2BA02=m
 CONFIG_DRM_PANEL_FEIYANG_FY07024DI26A30D=m
 CONFIG_DRM_PANEL_DSI_CM=m
 CONFIG_DRM_PANEL_LVDS=m
+CONFIG_DRM_PANEL_HIMAX_HX8279=m
 CONFIG_DRM_PANEL_HIMAX_HX83102=m
 CONFIG_DRM_PANEL_HIMAX_HX83112A=m
 CONFIG_DRM_PANEL_HIMAX_HX8394=m
@@ -1115,6 +1133,7 @@ CONFIG_DRM_PANEL_NOVATEK_NT35950=m
 CONFIG_DRM_PANEL_NOVATEK_NT36523=m
 CONFIG_DRM_PANEL_NOVATEK_NT36672A=m
 CONFIG_DRM_PANEL_NOVATEK_NT36672E=m
+CONFIG_DRM_PANEL_NOVATEK_NT37801=m
 CONFIG_DRM_PANEL_NOVATEK_NT39016=m
 CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO=m
 CONFIG_DRM_PANEL_ORISETECH_OTA5601A=m
@@ -1168,6 +1187,7 @@ CONFIG_DRM_PANEL_TPO_TD028TTEC1=m
 CONFIG_DRM_PANEL_TPO_TD043MTEA1=m
 CONFIG_DRM_PANEL_TPO_TPG110=m
 # CONFIG_DRM_PANEL_TRULY_NT35597_WQXGA is not set
+CONFIG_DRM_PANEL_VISIONOX_G2647FB105=m
 CONFIG_DRM_PANEL_VISIONOX_R66451=m
 # CONFIG_DRM_PANEL_VISIONOX_RM69299 is not set
 CONFIG_DRM_PANEL_VISIONOX_RM692E5=m
@@ -1186,6 +1206,13 @@ CONFIG_DRM_QXL=m
 CONFIG_DRM_RADEON=m
 CONFIG_DRM_RADEON_USERPTR=y

+##
+## file: drivers/gpu/drm/sitronix/Kconfig
+##
+CONFIG_DRM_ST7571_I2C=m
+CONFIG_DRM_ST7586=m
+CONFIG_DRM_ST7735R=m
+
 ##
 ## file: drivers/gpu/drm/solomon/Kconfig
 ##
@@ -1193,6 +1220,13 @@ CONFIG_DRM_SSD130X=m
 CONFIG_DRM_SSD130X_I2C=m
 CONFIG_DRM_SSD130X_SPI=m

+##
+## file: drivers/gpu/drm/sysfb/Kconfig
+##
+CONFIG_DRM_EFIDRM=m
+# CONFIG_DRM_SIMPLEDRM is not set
+CONFIG_DRM_VESADRM=m
+
 ##
 ## file: drivers/gpu/drm/tiny/Kconfig
 ##
@@ -1202,7 +1236,6 @@ CONFIG_DRM_BOCHS=m
 CONFIG_DRM_CIRRUS_QEMU=m
 CONFIG_DRM_GM12U320=m
 CONFIG_DRM_PANEL_MIPI_DBI=m
-# CONFIG_DRM_SIMPLEDRM is not set
 CONFIG_TINYDRM_HX8357D=m
 CONFIG_TINYDRM_ILI9163=m
 CONFIG_TINYDRM_ILI9225=m
@@ -1211,8 +1244,6 @@ CONFIG_TINYDRM_ILI9486=m
 CONFIG_TINYDRM_MI0283QT=m
 CONFIG_TINYDRM_REPAPER=m
 CONFIG_TINYDRM_SHARP_MEMORY=m
-CONFIG_TINYDRM_ST7586=m
-CONFIG_TINYDRM_ST7735R=m

 ##
 ## file: drivers/gpu/drm/udl/Kconfig
@@ -1247,6 +1278,7 @@ CONFIG_DRM_VMWGFX=m
 CONFIG_DRM_XE=m
 CONFIG_DRM_XE_DISPLAY=y
 CONFIG_DRM_XE_DP_TUNNEL=y
+CONFIG_DRM_XE_GPUSVM=y
 CONFIG_DRM_XE_DEVMEM_MIRROR=y
 CONFIG_DRM_XE_FORCE_PROBE=""

@@ -1528,6 +1560,8 @@ CONFIG_SENSORS_ASUS_ROG_RYUJIN=m
 CONFIG_SENSORS_AXI_FAN_CONTROL=m
 CONFIG_SENSORS_K8TEMP=m
 CONFIG_SENSORS_K10TEMP=m
+CONFIG_SENSORS_KBATT=m
+CONFIG_SENSORS_KFAN=m
 CONFIG_SENSORS_FAM15H_POWER=m
 CONFIG_SENSORS_APPLESMC=m
 CONFIG_SENSORS_ASB100=m
@@ -1601,6 +1635,7 @@ CONFIG_SENSORS_MAX6639=m
 CONFIG_SENSORS_MAX6650=m
 CONFIG_SENSORS_MAX6697=m
 CONFIG_SENSORS_MAX31790=m
+CONFIG_SENSORS_MAX77705=m
 CONFIG_SENSORS_MC34VR500=m
 CONFIG_SENSORS_MCP3021=m
 CONFIG_SENSORS_TC654=m
@@ -1636,13 +1671,11 @@ CONFIG_SENSORS_NPCM7XX=m
 CONFIG_SENSORS_NZXT_KRAKEN2=m
 CONFIG_SENSORS_NZXT_KRAKEN3=m
 CONFIG_SENSORS_NZXT_SMART2=m
-CONFIG_SENSORS_OXP=m
 CONFIG_SENSORS_PCF8591=m
 CONFIG_SENSORS_PT5161L=m
 CONFIG_SENSORS_PWM_FAN=m
 CONFIG_SENSORS_QNAP_MCU_HWMON=m
 CONFIG_SENSORS_SBTSI=m
-CONFIG_SENSORS_SBRMI=m
 CONFIG_SENSORS_SHT15=m
 CONFIG_SENSORS_SHT21=m
 CONFIG_SENSORS_SHT3x=m
@@ -1742,6 +1775,8 @@ CONFIG_SENSORS_IRPS5401=m
 CONFIG_SENSORS_ISL68137=m
 CONFIG_SENSORS_LM25066=m
 CONFIG_SENSORS_LM25066_REGULATOR=y
+CONFIG_SENSORS_LT3074=m
+CONFIG_SENSORS_LT3074_REGULATOR=m
 CONFIG_SENSORS_LT7182S=m
 CONFIG_SENSORS_LTC2978=m
 CONFIG_SENSORS_LTC2978_REGULATOR=y
@@ -1856,6 +1891,7 @@ CONFIG_I2C_CGBC=m
 CONFIG_I2C_DESIGNWARE_CORE=y
 CONFIG_I2C_DESIGNWARE_SLAVE=y
 CONFIG_I2C_DESIGNWARE_PLATFORM=y
+CONFIG_I2C_DESIGNWARE_AMDISP=m
 CONFIG_I2C_DESIGNWARE_BAYTRAIL=y
 CONFIG_I2C_DESIGNWARE_PCI=m
 CONFIG_I2C_EMEV2=m
@@ -2414,6 +2450,7 @@ CONFIG_LEDS_RT4505=m
 CONFIG_LEDS_RT8515=m
 CONFIG_LEDS_SGM3140=m
 CONFIG_LEDS_SY7802=m
+CONFIG_LEDS_TPS6131X=m

 ##
 ## file: drivers/leds/rgb/Kconfig
@@ -2907,6 +2944,7 @@ CONFIG_MFD_MAX77686=m
 CONFIG_MFD_MAX77693=m
 CONFIG_MFD_MAX77705=m
 CONFIG_MFD_MAX77714=m
+CONFIG_MFD_MAX77759=m
 CONFIG_MFD_MAX77843=y
 CONFIG_MFD_MAX8907=m
 CONFIG_MFD_MAX8925=y
@@ -2931,7 +2969,7 @@ CONFIG_MFD_RC5T583=y
 CONFIG_MFD_RK8XX_I2C=m
 CONFIG_MFD_RK8XX_SPI=m
 CONFIG_MFD_RN5T618=m
-CONFIG_MFD_SEC_CORE=m
+CONFIG_MFD_SEC_I2C=m
 CONFIG_MFD_SI476X_CORE=m
 CONFIG_MFD_SM501=m
 CONFIG_MFD_SM501_GPIO=y
@@ -3009,6 +3047,7 @@ CONFIG_AD525X_DPOT_SPI=m
 CONFIG_IBM_ASM=m
 CONFIG_PHANTOM=m
 CONFIG_RPMB=m
+CONFIG_TI_FPC202=m
 CONFIG_TIFM_CORE=m
 CONFIG_TIFM_7XX1=m
 CONFIG_ICS932S401=m
@@ -3042,6 +3081,12 @@ CONFIG_MCHP_LAN966X_PCI=m
 ##
 CONFIG_ALTERA_STAPL=m

+##
+## file: drivers/misc/amd-sbi/Kconfig
+##
+CONFIG_AMD_SBRMI_I2C=m
+CONFIG_AMD_SBRMI_HWMON=y
+
 ##
 ## file: drivers/misc/bcm-vk/Kconfig
 ##
@@ -3348,6 +3393,7 @@ CONFIG_MUX_MMIO=m
 ##
 ## file: drivers/net/Kconfig
 ##
+CONFIG_OVPN=m
 CONFIG_NTB_NETDEV=m
 CONFIG_RIONET=m
 CONFIG_RIONET_TX_SIZE=128
@@ -3709,6 +3755,11 @@ CONFIG_NET_VENDOR_HUAWEI=y
 ##
 CONFIG_HINIC=m

+##
+## file: drivers/net/ethernet/huawei/hinic3/Kconfig
+##
+CONFIG_HINIC3=m
+
 ##
 ## file: drivers/net/ethernet/i825xx/Kconfig
 ##
@@ -4170,6 +4221,7 @@ CONFIG_PCS_XPCS=m
 ##
 CONFIG_LED_TRIGGER_PHY=y
 CONFIG_SFP=m
+CONFIG_AS21XXX_PHY=m
 CONFIG_AIR_EN8811H_PHY=m
 CONFIG_AMD_PHY=m
 CONFIG_ADIN_PHY=m
@@ -4192,6 +4244,7 @@ CONFIG_MARVELL_10G_PHY=m
 CONFIG_MARVELL_88Q2XXX_PHY=m
 CONFIG_MARVELL_88X2222_PHY=m
 CONFIG_MAXLINEAR_GPHY=m
+CONFIG_MAXLINEAR_86110_PHY=m
 CONFIG_MICREL_PHY=m
 CONFIG_MICROCHIP_T1S_PHY=m
 CONFIG_MICROCHIP_PHY=m
@@ -4415,6 +4468,7 @@ CONFIG_ATH11K_SPECTRAL=y
 ## file: drivers/net/wireless/ath/ath12k/Kconfig
 ##
 CONFIG_ATH12K=m
+CONFIG_ATH12K_AHB=y
 CONFIG_ATH12K_DEBUG=y
 CONFIG_ATH12K_DEBUGFS=y
 # CONFIG_ATH12K_TRACING is not set
@@ -5020,6 +5074,7 @@ CONFIG_NVME_HWMON=y
 ##
 ## file: drivers/nvmem/Kconfig
 ##
+CONFIG_NVMEM_MAX77759=m
 CONFIG_NVMEM_RAVE_SP_EEPROM=m
 CONFIG_NVMEM_SPMI_SDAM=m
 CONFIG_NVMEM_U_BOOT_ENV=m
@@ -5103,7 +5158,7 @@ CONFIG_PCIEASPM_POWERSAVE=y
 ##
 ## file: drivers/pci/pwrctrl/Kconfig
 ##
-CONFIG_PCI_PWRCTL_SLOT=m
+CONFIG_PCI_PWRCTRL_SLOT=m

 ##
 ## file: drivers/pci/switch/Kconfig
@@ -5300,6 +5355,7 @@ CONFIG_MSI_LAPTOP=m
 CONFIG_MSI_WMI=m
 CONFIG_MSI_WMI_PLATFORM=m
 CONFIG_PCENGINES_APU2=m
+CONFIG_PORTWELL_EC=m
 CONFIG_BARCO_P50_GPIO=m
 CONFIG_SAMSUNG_GALAXYBOOK=m
 CONFIG_SAMSUNG_LAPTOP=m
@@ -5318,6 +5374,7 @@ CONFIG_TOPSTAR_LAPTOP=m
 CONFIG_SERIAL_MULTI_INSTANTIATE=m
 CONFIG_INSPUR_PLATFORM_PROFILE=m
 CONFIG_LENOVO_WMI_CAMERA=m
+CONFIG_DASHARO_ACPI=m
 CONFIG_INTEL_IPS=m
 CONFIG_INTEL_SCU_PCI=y
 CONFIG_INTEL_SCU_PLATFORM=m
@@ -5325,12 +5382,14 @@ CONFIG_INTEL_SCU_IPC_UTIL=m
 CONFIG_SILICOM_PLATFORM=m
 CONFIG_WINMATE_FM07_KEYS=m
 CONFIG_SEL3350_PLATFORM=m
+CONFIG_OXP_EC=m

 ##
 ## file: drivers/platform/x86/amd/Kconfig
 ##
 CONFIG_AMD_3D_VCACHE=m
 CONFIG_AMD_WBRF=y
+CONFIG_AMD_ISP_PLATFORM=m

 ##
 ## file: drivers/platform/x86/amd/hsmp/Kconfig
@@ -5466,6 +5525,11 @@ CONFIG_SIEMENS_SIMATIC_IPC_BATT_APOLLOLAKE=m
 CONFIG_SIEMENS_SIMATIC_IPC_BATT_ELKHARTLAKE=m
 CONFIG_SIEMENS_SIMATIC_IPC_BATT_F7188X=m

+##
+## file: drivers/platform/x86/tuxedo/nb04/Kconfig
+##
+CONFIG_TUXEDO_NB04_WMI_AB=m
+
 ##
 ## file: drivers/platform/x86/x86-android-tablets/Kconfig
 ##
@@ -5512,6 +5576,7 @@ CONFIG_TEST_POWER=m
 CONFIG_BATTERY_88PM860X=m
 CONFIG_CHARGER_ADP5061=m
 CONFIG_BATTERY_ACT8945A=m
+CONFIG_BATTERY_CHAGALL=m
 CONFIG_BATTERY_CW2015=m
 CONFIG_BATTERY_DS2760=m
 CONFIG_BATTERY_DS2780=m
@@ -5547,6 +5612,7 @@ CONFIG_CHARGER_MAX77650=m
 CONFIG_CHARGER_MAX77693=m
 CONFIG_CHARGER_MAX77705=m
 CONFIG_CHARGER_MAX77976=m
+CONFIG_CHARGER_MAX8971=m
 CONFIG_CHARGER_MAX8997=m
 CONFIG_CHARGER_MAX8998=m
 CONFIG_CHARGER_MT6360=m
@@ -5625,6 +5691,7 @@ CONFIG_PWM_IQS620A=m
 CONFIG_PWM_LP3943=m
 CONFIG_PWM_LPSS_PCI=m
 CONFIG_PWM_LPSS_PLATFORM=m
+CONFIG_PWM_MC33XS2410=m
 CONFIG_PWM_NTXEC=m
 CONFIG_PWM_PCA9685=m
 CONFIG_PWM_STMPE=y
@@ -5682,6 +5749,7 @@ CONFIG_REGULATOR_88PM886=m
 CONFIG_REGULATOR_ACT8865=m
 CONFIG_REGULATOR_ACT8945A=m
 CONFIG_REGULATOR_AD5398=m
+CONFIG_REGULATOR_ADP5055=m
 CONFIG_REGULATOR_AAT2870=m
 CONFIG_REGULATOR_ARIZONA_LDO1=m
 CONFIG_REGULATOR_ARIZONA_MICSUPP=m
@@ -6087,7 +6155,6 @@ CONFIG_SPI_OFFLOAD_TRIGGER_PWM=m
 ## file: drivers/spmi/Kconfig
 ##
 CONFIG_SPMI=m
-CONFIG_SPMI_HISI3670=m

 ##
 ## file: drivers/ssb/Kconfig
@@ -6506,13 +6573,9 @@ CONFIG_USB_RAW_GADGET=m
 CONFIG_USB_GR_UDC=m
 CONFIG_USB_R8A66597=m
 CONFIG_USB_PXA27X=m
-CONFIG_USB_MV_UDC=m
-CONFIG_USB_MV_U3D=m
 CONFIG_USB_SNP_UDC_PLAT=m
 CONFIG_USB_M66592=m
 CONFIG_USB_AMD5536UDC=m
-CONFIG_USB_NET2272=m
-# CONFIG_USB_NET2272_DMA is not set
 CONFIG_USB_NET2280=m
 CONFIG_USB_GOKU=m
 CONFIG_USB_EG20T=m
@@ -6538,6 +6601,7 @@ CONFIG_USB_XHCI_HCD=m
 # CONFIG_USB_XHCI_DBGCAP is not set
 CONFIG_USB_XHCI_PCI_RENESAS=m
 CONFIG_USB_XHCI_PLATFORM=m
+CONFIG_USB_XHCI_SIDEBAND=y
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_TT_NEWSCHED=y
@@ -6986,6 +7050,7 @@ CONFIG_IB700_WDT=m
 CONFIG_IBMASR=m
 CONFIG_WAFER_WDT=m
 CONFIG_IE6XX_WDT=m
+CONFIG_INTEL_OC_WATCHDOG=m
 CONFIG_IT8712F_WDT=m
 CONFIG_IT87_WDT=m
 CONFIG_HP_WATCHDOG=m
@@ -7088,6 +7153,11 @@ CONFIG_ECRYPT_FS_MESSAGING=y
 ##
 CONFIG_EFS_FS=m

+##
+## file: fs/erofs/Kconfig
+##
+CONFIG_EROFS_FS_ZIP_ACCEL=y
+
 ##
 ## file: fs/f2fs/Kconfig
 ##
@@ -7285,6 +7355,11 @@ CONFIG_CIFS_SWN_UPCALL=y
 CONFIG_CIFS_FSCACHE=y
 # CONFIG_CIFS_COMPRESSION is not set

+##
+## file: fs/squashfs/Kconfig
+##
+CONFIG_SQUASHFS_COMP_CACHE_FULL=y
+
 ##
 ## file: fs/ubifs/Kconfig
 ##
@@ -7324,6 +7399,7 @@ CONFIG_LOG_CPU_MAX_BUF_SHIFT=14
 CONFIG_UCLAMP_TASK=y
 CONFIG_UCLAMP_BUCKETS_COUNT=10
 CONFIG_RT_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED is not set
 CONFIG_UCLAMP_TASK_GROUP=y

 ##
@@ -7769,6 +7845,7 @@ CONFIG_AF_RXRPC_IPV6=y
 # CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set
 # CONFIG_AF_RXRPC_DEBUG is not set
 CONFIG_RXKAD=y
+# CONFIG_RXGK is not set
 # CONFIG_RXPERF is not set

 ##
@@ -8054,6 +8131,7 @@ CONFIG_SND_YMFPCI=m
 ## file: sound/pci/hda/Kconfig
 ##
 CONFIG_SND_HDA_INTEL=m
+CONFIG_SND_HDA_ACPI=m
 CONFIG_SND_HDA_HWDEP=y
 CONFIG_SND_HDA_RECONFIG=y
 CONFIG_SND_HDA_INPUT_BEEP=y
@@ -8088,6 +8166,7 @@ CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM=y
 ## file: sound/soc/Kconfig
 ##
 CONFIG_SND_SOC=m
+CONFIG_SND_SOC_USB=m

 ##
 ## file: sound/soc/adi/Kconfig
@@ -8209,6 +8288,7 @@ CONFIG_SND_SOC_CS42XX8_I2C=m
 CONFIG_SND_SOC_CS43130=m
 CONFIG_SND_SOC_CS4341=m
 CONFIG_SND_SOC_CS4349=m
+CONFIG_SND_SOC_CS48L32=m
 CONFIG_SND_SOC_CS53L30=m
 CONFIG_SND_SOC_CS530X_I2C=m
 CONFIG_SND_SOC_CX2072X=m
@@ -8222,6 +8302,8 @@ CONFIG_SND_SOC_ES8323=m
 CONFIG_SND_SOC_ES8326=m
 CONFIG_SND_SOC_ES8328_I2C=m
 CONFIG_SND_SOC_ES8328_SPI=m
+CONFIG_SND_SOC_ES8375=m
+CONFIG_SND_SOC_ES8389=m
 CONFIG_SND_SOC_FRAMER=m
 CONFIG_SND_SOC_GTM601=m
 CONFIG_SND_SOC_HDA=m
@@ -8280,6 +8362,8 @@ CONFIG_SND_SOC_RT722_SDCA_SDW=m
 CONFIG_SND_SOC_RT715_SDW=m
 CONFIG_SND_SOC_RT715_SDCA_SDW=m
 CONFIG_SND_SOC_RT9120=m
+CONFIG_SND_SOC_RT9123=m
+CONFIG_SND_SOC_RT9123P=m
 CONFIG_SND_SOC_RTQ9128=m
 CONFIG_SND_SOC_SDW_MOCKUP=m
 CONFIG_SND_SOC_SGTL5000=m
@@ -8357,6 +8441,7 @@ CONFIG_SND_SOC_WM8962=m
 CONFIG_SND_SOC_WM8974=m
 CONFIG_SND_SOC_WM8978=m
 CONFIG_SND_SOC_WM8985=m
+CONFIG_SND_SOC_WM8998=m
 CONFIG_SND_SOC_WSA881X=m
 CONFIG_SND_SOC_WSA883X=m
 CONFIG_SND_SOC_WSA884X=m
@@ -8444,6 +8529,7 @@ CONFIG_SND_SOC_INTEL_AVS=m
 ##
 ## file: sound/soc/intel/avs/boards/Kconfig
 ##
+# CONFIG_SND_SOC_INTEL_AVS_CARDNAME_OBSOLETE is not set
 CONFIG_SND_SOC_INTEL_AVS_MACH_DA7219=m
 CONFIG_SND_SOC_INTEL_AVS_MACH_DMIC=m
 CONFIG_SND_SOC_INTEL_AVS_MACH_ES8336=m
@@ -8581,6 +8667,7 @@ CONFIG_SND_USB_US122L=m
 CONFIG_SND_USB_6FIRE=m
 CONFIG_SND_USB_HIFACE=m
 CONFIG_SND_BCD2000=m
+CONFIG_SND_USB_AUDIO_QMI=m

 ##
 ## file: sound/usb/line6/Kconfig
@@ -8685,10 +8772,7 @@ CONFIG_CRYPTO_LIB_ARC4=m
 CONFIG_CRYPTO_LIB_CHACHA=y
 CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y
 CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y
-CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=y
 CONFIG_CRYPTO_LIB_POLY1305=y
-CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y
-CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=y
 CONFIG_CRYPTO_POLY1305_X86_64=y
 CONFIG_CXL_PORT=m
 CONFIG_DCA=m
@@ -8735,6 +8819,7 @@ CONFIG_DRM_PANEL_BRIDGE=y
 CONFIG_DRM_PRIVACY_SCREEN=y
 CONFIG_DRM_SCHED=m
 CONFIG_DRM_SUBALLOC_HELPER=m
+CONFIG_DRM_SYSFB_HELPER=m
 CONFIG_DRM_TTM=m
 CONFIG_DRM_TTM_HELPER=m
 CONFIG_DRM_VRAM_HELPER=m
@@ -8779,6 +8864,7 @@ CONFIG_IGC_LEDS=y
 CONFIG_INTEL_ATOMISP2_PDX86=y
 CONFIG_INTEL_GTT=y
 CONFIG_INTEL_IDXD_BUS=m
+CONFIG_INTEL_PMC_SSRAM_TELEMETRY=m
 CONFIG_INTEL_PMT_CLASS=m
 CONFIG_INTEL_SCU=y
 CONFIG_INTEL_SCU_IPC=y
@@ -8831,6 +8917,7 @@ CONFIG_MFD_INTEL_LPSS=m
 CONFIG_MFD_INTEL_M10_BMC_CORE=m
 CONFIG_MFD_MC13XXX=m
 CONFIG_MFD_RK8XX=m
+CONFIG_MFD_SEC_CORE=m
 CONFIG_MFD_SIMPLE_MFD_I2C=m
 CONFIG_MFD_TPS65912=m
 CONFIG_MFD_TPS6594=m
@@ -8909,7 +8996,7 @@ CONFIG_PCIE_DW_PLAT=y
 CONFIG_PCIE_PLDA_HOST=y
 CONFIG_PCI_ECAM=y
 CONFIG_PCI_HOST_COMMON=y
-CONFIG_PCI_PWRCTL=m
+CONFIG_PCI_PWRCTRL=m
 CONFIG_PCS_LYNX=m
 CONFIG_PHYLIB_LEDS=y
 CONFIG_PINCTRL_CS47L15=y
@@ -8936,10 +9023,13 @@ CONFIG_PREEMPT_COUNT=y
 CONFIG_PWM_DWC_CORE=m
 CONFIG_PWM_LPSS=m
 CONFIG_QCA7000=m
+CONFIG_QCOM_MDT_LOADER=m
 CONFIG_QCOM_NET_PHYLIB=m
 CONFIG_QCOM_PDR_HELPERS=m
 CONFIG_QCOM_PDR_MSG=m
 CONFIG_QCOM_QMI_HELPERS=m
+CONFIG_QCOM_SCM=m
+CONFIG_QCOM_TZMEM=m
 CONFIG_QTNFMAC=m
 CONFIG_RAID6_PQ=m
 CONFIG_RATIONAL=y
@@ -9035,7 +9125,6 @@ CONFIG_SND_HDA=m
 CONFIG_SND_HDA_CIRRUS_SCODEC=m
 CONFIG_SND_HDA_COMPONENT=y
 CONFIG_SND_HDA_CORE=m
-CONFIG_SND_HDA_CS_DSP_CONTROLS=m
 CONFIG_SND_HDA_DSP_LOADER=y
 CONFIG_SND_HDA_EXT_CORE=m
 CONFIG_SND_HDA_GENERIC_LEDS=y
@@ -9043,6 +9132,7 @@ CONFIG_SND_HDA_I915=y
 CONFIG_SND_HDA_SCODEC_COMPONENT=m
 CONFIG_SND_HDA_SCODEC_CS35L41=m
 CONFIG_SND_HDA_SCODEC_CS35L56=m
+CONFIG_SND_HDA_SCODEC_TAS2781=m
 CONFIG_SND_HWDEP=m
 CONFIG_SND_INTEL_DSP_CONFIG=m
 CONFIG_SND_INTEL_NHLT=y
@@ -9185,6 +9275,7 @@ CONFIG_SND_SOC_SOF_XTENSA=m
 CONFIG_SND_SOC_SRC4XXX=m
 CONFIG_SND_SOC_SSM2602=m
 CONFIG_SND_SOC_TAS2781_COMLIB=m
+CONFIG_SND_SOC_TAS2781_COMLIB_I2C=m
 CONFIG_SND_SOC_TAS2781_FMWLIB=m
 CONFIG_SND_SOC_TLV320AIC23=m
 CONFIG_SND_SOC_TLV320AIC32X4=m
--- a/debian/config/amd64/config.vm
+++ b/debian/config/amd64/config.vm
@@ -96,6 +96,7 @@ CONFIG_IO_DELAY_NONE=y
 ##
 ## file: crypto/Kconfig
 ##
+CONFIG_CRYPTO_BENCHMARK=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_DEFLATE=m
 CONFIG_CRYPTO_842=m
@@ -216,6 +217,7 @@ CONFIG_SATA_MOBILE_LPM_POLICY=0
 ## file: drivers/block/Kconfig
 ##
 # CONFIG_ATA_OVER_ETH is not set
+CONFIG_BLK_DEV_ZONED_LOOP=m

 ##
 ## file: drivers/block/mtip32xx/Kconfig
@@ -342,6 +344,7 @@ CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
 # CONFIG_CRYPTO_DEV_QAT_C62X is not set
 # CONFIG_CRYPTO_DEV_QAT_4XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_420XX is not set
+# CONFIG_CRYPTO_DEV_QAT_6XXX is not set
 # CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
 # CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
@@ -551,14 +554,18 @@ CONFIG_GPIO_SIM=m
 ## file: drivers/gpu/drm/Kconfig
 ##
 CONFIG_DRM=y
-# CONFIG_DRM_DEBUG_MM is not set
 # CONFIG_DRM_PANIC is not set
 # CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set
 # CONFIG_DRM_DEBUG_MODESET_LOCK is not set
 CONFIG_DRM_LOAD_EDID_FIRMWARE=y
 CONFIG_DRM_VGEM=m
 CONFIG_DRM_HYPERV=m
+
+##
+## file: drivers/gpu/drm/Kconfig.debug
+##
 # CONFIG_DRM_WERROR is not set
+# CONFIG_DRM_DEBUG_MM is not set

 ##
 ## file: drivers/gpu/drm/amd/amdgpu/Kconfig
@@ -636,11 +643,23 @@ CONFIG_DRM_QXL=m
 ##
 # CONFIG_DRM_RADEON is not set

+##
+## file: drivers/gpu/drm/sitronix/Kconfig
+##
+# CONFIG_DRM_ST7571_I2C is not set
+
 ##
 ## file: drivers/gpu/drm/solomon/Kconfig
 ##
 # CONFIG_DRM_SSD130X is not set

+##
+## file: drivers/gpu/drm/sysfb/Kconfig
+##
+CONFIG_DRM_EFIDRM=m
+# CONFIG_DRM_SIMPLEDRM is not set
+CONFIG_DRM_VESADRM=m
+
 ##
 ## file: drivers/gpu/drm/tiny/Kconfig
 ##
@@ -648,7 +667,6 @@ CONFIG_DRM_QXL=m
 CONFIG_DRM_BOCHS=m
 CONFIG_DRM_CIRRUS_QEMU=m
 # CONFIG_DRM_GM12U320 is not set
-# CONFIG_DRM_SIMPLEDRM is not set

 ##
 ## file: drivers/gpu/drm/udl/Kconfig
@@ -973,11 +991,9 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_NZXT_KRAKEN2 is not set
 # CONFIG_SENSORS_NZXT_KRAKEN3 is not set
 # CONFIG_SENSORS_NZXT_SMART2 is not set
-# CONFIG_SENSORS_OXP is not set
 # CONFIG_SENSORS_PCF8591 is not set
 # CONFIG_SENSORS_PT5161L is not set
 # CONFIG_SENSORS_SBTSI is not set
-# CONFIG_SENSORS_SBRMI is not set
 # CONFIG_SENSORS_SHT15 is not set
 # CONFIG_SENSORS_SHT21 is not set
 # CONFIG_SENSORS_SHT3x is not set
@@ -1059,6 +1075,7 @@ CONFIG_SENSORS_PMBUS=m
 # CONFIG_SENSORS_IRPS5401 is not set
 # CONFIG_SENSORS_ISL68137 is not set
 # CONFIG_SENSORS_LM25066 is not set
+# CONFIG_SENSORS_LT3074 is not set
 # CONFIG_SENSORS_LT7182S is not set
 # CONFIG_SENSORS_LTC2978 is not set
 # CONFIG_SENSORS_LTC3815 is not set
@@ -1704,6 +1721,7 @@ CONFIG_MFD_INTEL_PMC_BXT=m
 # CONFIG_AD525X_DPOT is not set
 # CONFIG_IBM_ASM is not set
 # CONFIG_PHANTOM is not set
+# CONFIG_TI_FPC202 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
@@ -1726,6 +1744,12 @@ CONFIG_NTSYNC=m
 ##
 # CONFIG_ALTERA_STAPL is not set

+##
+## file: drivers/misc/amd-sbi/Kconfig
+##
+CONFIG_AMD_SBRMI_I2C=m
+CONFIG_AMD_SBRMI_HWMON=y
+
 ##
 ## file: drivers/misc/bcm-vk/Kconfig
 ##
@@ -1795,6 +1819,7 @@ CONFIG_EEPROM_AT24=m
 ##
 ## file: drivers/net/Kconfig
 ##
+CONFIG_OVPN=m
 # CONFIG_FUJITSU_ES is not set

 ##
@@ -2201,6 +2226,7 @@ CONFIG_MCTP_TRANSPORT_USB=m
 ## file: drivers/net/phy/Kconfig
 ##
 # CONFIG_SFP is not set
+# CONFIG_AS21XXX_PHY is not set
 # CONFIG_AIR_EN8811H_PHY is not set
 # CONFIG_AMD_PHY is not set
 # CONFIG_ADIN_PHY is not set
@@ -2223,6 +2249,7 @@ CONFIG_MCTP_TRANSPORT_USB=m
 # CONFIG_MARVELL_88Q2XXX_PHY is not set
 # CONFIG_MARVELL_88X2222_PHY is not set
 # CONFIG_MAXLINEAR_GPHY is not set
+# CONFIG_MAXLINEAR_86110_PHY is not set
 # CONFIG_MICREL_PHY is not set
 # CONFIG_MICROCHIP_T1S_PHY is not set
 # CONFIG_MICROCHIP_PHY is not set
@@ -2393,7 +2420,7 @@ CONFIG_PCIEASPM_DEFAULT=y
 ##
 ## file: drivers/pci/pwrctrl/Kconfig
 ##
-# CONFIG_PCI_PWRCTL_SLOT is not set
+CONFIG_PCI_PWRCTRL_SLOT=m

 ##
 ## file: drivers/pci/switch/Kconfig
@@ -2471,6 +2498,7 @@ CONFIG_WMI_BMOF=m
 CONFIG_ACPI_QUICKSTART=m
 # CONFIG_MEEGOPAD_ANX7428 is not set
 CONFIG_MSI_WMI_PLATFORM=m
+# CONFIG_PORTWELL_EC is not set
 # CONFIG_BARCO_P50_GPIO is not set
 # CONFIG_SAMSUNG_Q10 is not set
 # CONFIG_TOSHIBA_BT_RFKILL is not set
@@ -2481,6 +2509,7 @@ CONFIG_MSI_WMI_PLATFORM=m
 CONFIG_SERIAL_MULTI_INSTANTIATE=m
 # CONFIG_INSPUR_PLATFORM_PROFILE is not set
 # CONFIG_LENOVO_WMI_CAMERA is not set
+# CONFIG_DASHARO_ACPI is not set
 # CONFIG_INTEL_IPS is not set
 # CONFIG_INTEL_SCU_PCI is not set
 # CONFIG_INTEL_SCU_PLATFORM is not set
@@ -2491,6 +2520,7 @@ CONFIG_SERIAL_MULTI_INSTANTIATE=m
 ##
 # CONFIG_AMD_3D_VCACHE is not set
 # CONFIG_AMD_WBRF is not set
+CONFIG_AMD_ISP_PLATFORM=m

 ##
 ## file: drivers/platform/x86/amd/hsmp/Kconfig
@@ -2561,6 +2591,11 @@ CONFIG_SERIAL_MULTI_INSTANTIATE=m
 ##
 # CONFIG_SIEMENS_SIMATIC_IPC is not set

+##
+## file: drivers/platform/x86/tuxedo/nb04/Kconfig
+##
+# CONFIG_TUXEDO_NB04_WMI_AB is not set
+
 ##
 ## file: drivers/pnp/Kconfig
 ##
@@ -2601,6 +2636,7 @@ CONFIG_CHARGER_GPIO=m
 # CONFIG_CHARGER_LT3651 is not set
 # CONFIG_CHARGER_LTC4162L is not set
 # CONFIG_CHARGER_MAX77976 is not set
+# CONFIG_CHARGER_MAX8971 is not set
 # CONFIG_CHARGER_BQ2415X is not set
 # CONFIG_CHARGER_BQ24190 is not set
 # CONFIG_CHARGER_BQ24257 is not set
@@ -2971,6 +3007,7 @@ CONFIG_USB_XHCI_HCD=m
 # CONFIG_USB_XHCI_DBGCAP is not set
 CONFIG_USB_XHCI_PCI_RENESAS=m
 CONFIG_USB_XHCI_PLATFORM=m
+# CONFIG_USB_XHCI_SIDEBAND is not set
 CONFIG_USB_EHCI_HCD=m
 CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_TT_NEWSCHED=y
@@ -3203,6 +3240,7 @@ CONFIG_SOFT_WATCHDOG_PRETIMEOUT=y
 # CONFIG_IBMASR is not set
 # CONFIG_WAFER_WDT is not set
 # CONFIG_IE6XX_WDT is not set
+# CONFIG_INTEL_OC_WATCHDOG is not set
 # CONFIG_IT8712F_WDT is not set
 # CONFIG_IT87_WDT is not set
 # CONFIG_HP_WATCHDOG is not set
@@ -3285,6 +3323,11 @@ CONFIG_ECRYPT_FS_MESSAGING=y
 ##
 # CONFIG_EFS_FS is not set

+##
+## file: fs/erofs/Kconfig
+##
+CONFIG_EROFS_FS_ZIP_ACCEL=y
+
 ##
 ## file: fs/f2fs/Kconfig
 ##
@@ -3447,6 +3490,11 @@ CONFIG_CIFS_SWN_UPCALL=y
 CONFIG_CIFS_FSCACHE=y
 # CONFIG_CIFS_COMPRESSION is not set

+##
+## file: fs/squashfs/Kconfig
+##
+CONFIG_SQUASHFS_COMP_CACHE_FULL=y
+
 ##
 ## file: fs/ufs/Kconfig
 ##
@@ -3471,6 +3519,7 @@ CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
 CONFIG_UCLAMP_TASK=y
 CONFIG_UCLAMP_BUCKETS_COUNT=10
 CONFIG_RT_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED is not set
 CONFIG_UCLAMP_TASK_GROUP=y

 ##
@@ -3763,6 +3812,7 @@ CONFIG_AF_RXRPC_IPV6=y
 # CONFIG_AF_RXRPC_INJECT_RX_DELAY is not set
 # CONFIG_AF_RXRPC_DEBUG is not set
 # CONFIG_RXKAD is not set
+# CONFIG_RXGK is not set
 # CONFIG_RXPERF is not set

 ##
@@ -3912,10 +3962,7 @@ CONFIG_CRYPTO_LIB_ARC4=m
 CONFIG_CRYPTO_LIB_CHACHA=m
 CONFIG_CRYPTO_LIB_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LIB_CHACHA_GENERIC=m
-CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=m
 CONFIG_CRYPTO_LIB_POLY1305=m
-CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m
-CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=m
 CONFIG_CRYPTO_POLY1305_X86_64=m
 CONFIG_CXL_PORT=y
 CONFIG_DEV_SYNC_PROBE=m
@@ -3930,6 +3977,7 @@ CONFIG_DRM_GEM_SHMEM_HELPER=m
 CONFIG_DRM_KMS_HELPER=m
 CONFIG_DRM_PANEL=y
 CONFIG_DRM_PANEL_BRIDGE=y
+CONFIG_DRM_SYSFB_HELPER=m
 CONFIG_DRM_TTM=m
 CONFIG_DRM_TTM_HELPER=m
 CONFIG_DRM_VRAM_HELPER=m
@@ -3964,6 +4012,8 @@ CONFIG_NETFS_SUPPORT=y
 CONFIG_NET_CLS=y
 CONFIG_NLS_UCS2_UTILS=m
 # CONFIG_NVMEM_LAYOUTS is not set
+CONFIG_PCI_PWRCTRL=m
+CONFIG_PLDMFW=y
 CONFIG_PM_CLK=y
 CONFIG_PM_OPP=y
 CONFIG_PM_SLEEP_DEBUG=y
--- a/debian/config/config
+++ b/debian/config/config
@@ -61,7 +61,6 @@ CONFIG_X86_VSYSCALL_EMULATION=y
 # CONFIG_MICROCODE_LATE_LOADING is not set
 CONFIG_X86_MSR=m
 CONFIG_X86_CPUID=m
-# CONFIG_X86_5LEVEL is not set
 # CONFIG_X86_CPA_STATISTICS is not set
 CONFIG_AMD_MEM_ENCRYPT=y
 CONFIG_NUMA=y
@@ -127,11 +126,9 @@ CONFIG_IA32_EMULATION=y
 ##
 ## file: arch/x86/Kconfig.cpu
 ##
-## choice: x86_64 Compiler Build Optimization
 # CONFIG_X86_NATIVE_CPU is not set
+## choice: x86_64 Compiler Build Optimization
 CONFIG_GENERIC_CPU=y
-# CONFIG_MNATIVE_INTEL is not set
-# CONFIG_MNATIVE_AMD is not set
 # CONFIG_MK8 is not set
 # CONFIG_MK8SSE3 is not set
 # CONFIG_MK10 is not set
@@ -230,10 +227,8 @@ CONFIG_CRYPTO_ARIA_GFNI_AVX512_X86_64=m
 CONFIG_CRYPTO_AEGIS128_AESNI_SSE2=m
 CONFIG_CRYPTO_NHPOLY1305_SSE2=m
 CONFIG_CRYPTO_NHPOLY1305_AVX2=m
-CONFIG_CRYPTO_BLAKE2S_X86=y
 CONFIG_CRYPTO_POLYVAL_CLMUL_NI=m
 CONFIG_CRYPTO_SHA1_SSSE3=m
-CONFIG_CRYPTO_SHA256_SSSE3=m
 CONFIG_CRYPTO_SHA512_SSSE3=m
 CONFIG_CRYPTO_SM3_AVX_X86_64=m
 CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m
@@ -265,6 +260,11 @@ CONFIG_KVM_HYPERV=y
 # CONFIG_KVM_PROVE_MMU is not set
 CONFIG_KVM_MAX_NR_VCPUS=1024

+##
+## file: arch/x86/lib/crypto/Kconfig
+##
+CONFIG_CRYPTO_BLAKE2S_X86=y
+
 ##
 ## file: arch/x86/xen/Kconfig
 ##
@@ -325,15 +325,13 @@ CONFIG_SYSTEM_TRUSTED_KEYS=""
 ## file: crypto/Kconfig
 ##
 CONFIG_CRYPTO=y
-CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
+# CONFIG_CRYPTO_SELFTESTS is not set
 CONFIG_CRYPTO_NULL=y
 CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_AUTHENC=m
 CONFIG_CRYPTO_KRB5ENC=m
-CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_RSA=y
 CONFIG_CRYPTO_DH=y
 CONFIG_CRYPTO_DH_RFC7919_GROUPS=y
@@ -376,7 +374,6 @@ CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_POLY1305=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_SHA1=y
 CONFIG_CRYPTO_SHA256=y
@@ -628,6 +625,7 @@ CONFIG_TCG_TPM2_HMAC=y
 CONFIG_HW_RANDOM_TPM=y
 CONFIG_TCG_XEN=m
 CONFIG_TCG_VTPM_PROXY=m
+CONFIG_TCG_SVSM=m

 ##
 ## file: drivers/comedi/Kconfig
@@ -963,11 +961,6 @@ CONFIG_VMWARE_BALLOON=m
 # CONFIG_PCI_ENDPOINT_TEST is not set
 CONFIG_NSM=m

-##
-## file: drivers/misc/echo/Kconfig
-##
-# CONFIG_ECHO is not set
-
 ##
 ## file: drivers/misc/genwqe/Kconfig
 ##
@@ -1112,7 +1105,7 @@ CONFIG_HYPERV_NET=m
 ##
 ## file: drivers/net/mdio/Kconfig
 ##
-CONFIG_MDIO_DEVICE=m
+CONFIG_MDIO_BUS=m

 ##
 ## file: drivers/net/phy/Kconfig
@@ -1734,6 +1727,9 @@ CONFIG_VIRTIO_INPUT=m
 CONFIG_VIRTIO_MMIO=m
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 # CONFIG_VIRTIO_DEBUG is not set
+CONFIG_VIRTIO_RTC=m
+CONFIG_VIRTIO_RTC_PTP=y
+CONFIG_VIRTIO_RTC_CLASS=y

 ##
 ## file: drivers/watchdog/Kconfig
@@ -2050,6 +2046,11 @@ CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_QFMT_V1 is not set
 CONFIG_QFMT_V2=m

+##
+## file: fs/resctrl/Kconfig
+##
+CONFIG_RESCTRL_FS=y
+
 ##
 ## file: fs/smb/server/Kconfig
 ##
@@ -2135,7 +2136,6 @@ CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_WATCH_QUEUE=y
 CONFIG_CROSS_MEMORY_ATTACH=y
-# CONFIG_USELIB is not set
 CONFIG_AUDIT=y
 ## choice: Cputime accounting
 CONFIG_VIRT_CPU_ACCOUNTING_GEN=y
@@ -2181,6 +2181,7 @@ CONFIG_UTS_NS=y
 CONFIG_TIME_NS=y
 CONFIG_IPC_NS=y
 CONFIG_USER_NS=y
+CONFIG_USER_NS_UNPRIVILEGED=y
 CONFIG_PID_NS=y
 CONFIG_NET_NS=y
 CONFIG_CHECKPOINT_RESTORE=y
@@ -2649,6 +2650,7 @@ CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
 # CONFIG_READ_ONLY_THP_FOR_FS is not set
 # CONFIG_NO_PAGE_MAPCOUNT is not set
 # CONFIG_CMA is not set
+CONFIG_PAGE_BLOCK_ORDER=10
 CONFIG_MEM_SOFT_DIRTY=y
 CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
 # CONFIG_IDLE_PAGE_TRACKING is not set
@@ -2764,11 +2766,6 @@ CONFIG_CEPH_LIB=m
 ##
 # CONFIG_DCB is not set

-##
-## file: net/dccp/Kconfig
-##
-# CONFIG_IP_DCCP is not set
-
 ##
 ## file: net/dns_resolver/Kconfig
 ##
@@ -3193,6 +3190,7 @@ CONFIG_NET_SCH_FQ_CODEL=y
 CONFIG_NET_SCH_CAKE=m
 CONFIG_NET_SCH_PIE=y
 CONFIG_NET_SCH_FQ_PIE=y
+CONFIG_NET_SCH_BPF=y
 CONFIG_NET_SCH_DEFAULT=y
 ## choice: Default queuing discipline
 # CONFIG_DEFAULT_FQ is not set
@@ -3439,6 +3437,7 @@ CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
 CONFIG_ACPI_LPIT=y
 CONFIG_ACPI_MADT_WAKEUP=y
 CONFIG_ACPI_MDIO=m
+CONFIG_ACPI_MRRM=y
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_PROCESSOR_CSTATE=y
 CONFIG_ACPI_PROCESSOR_IDLE=y
@@ -3471,6 +3470,7 @@ CONFIG_ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION=y
 CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
 CONFIG_ARCH_HAS_CPU_PASID=y
 CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_CPU_RESCTRL=y
 CONFIG_ARCH_HAS_CRC32=y
 CONFIG_ARCH_HAS_CRC64=y
 CONFIG_ARCH_HAS_CRC_T10DIF=y
@@ -3542,6 +3542,7 @@ CONFIG_ARCH_SUPPORTS_INT128=y
 CONFIG_ARCH_SUPPORTS_KEXEC=y
 CONFIG_ARCH_SUPPORTS_KEXEC_BZIMAGE_VERIFY_SIG=y
 CONFIG_ARCH_SUPPORTS_KEXEC_FILE=y
+CONFIG_ARCH_SUPPORTS_KEXEC_HANDOVER=y
 CONFIG_ARCH_SUPPORTS_KEXEC_JUMP=y
 CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY=y
 CONFIG_ARCH_SUPPORTS_KEXEC_SIG=y
@@ -3580,6 +3581,7 @@ CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y
 CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
 CONFIG_ARCH_WANT_HUGETLB_VMEMMAP_PREINIT=y
 CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
+CONFIG_ARCH_WANT_IRQS_OFF_ACTIVATE_MM=y
 CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y
 CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y
 CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=y
@@ -3601,9 +3603,7 @@ CONFIG_BLK_CGROUP_RWSTAT=y
 CONFIG_BLK_DEV_BSG_COMMON=y
 CONFIG_BLK_DEV_DM_BUILTIN=y
 CONFIG_BLK_ICQ=y
-CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_MQ_STACKING=y
-CONFIG_BLK_MQ_VIRTIO=y
 CONFIG_BLK_PM=y
 CONFIG_BLK_RQ_ALLOC_TIME=y
 CONFIG_BLOCK_HOLDER_DEPRECATED=y
@@ -3655,6 +3655,8 @@ CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S=y
 CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y
 CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=y
 CONFIG_CRYPTO_ARCH_HAVE_LIB_POLY1305=y
+CONFIG_CRYPTO_ARCH_HAVE_LIB_SHA256=y
+CONFIG_CRYPTO_ARCH_HAVE_LIB_SHA256_SIMD=y
 CONFIG_CRYPTO_BLOWFISH_COMMON=m
 CONFIG_CRYPTO_CAST_COMMON=m
 CONFIG_CRYPTO_CURVE25519_X86=m
@@ -3680,23 +3682,25 @@ CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=m
 CONFIG_CRYPTO_LIB_CURVE25519_INTERNAL=m
 CONFIG_CRYPTO_LIB_DES=m
 CONFIG_CRYPTO_LIB_GF128MUL=y
+CONFIG_CRYPTO_LIB_POLY1305_GENERIC=m
 CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
 CONFIG_CRYPTO_LIB_SHA1=y
 CONFIG_CRYPTO_LIB_SHA256=y
+CONFIG_CRYPTO_LIB_SHA256_GENERIC=y
+CONFIG_CRYPTO_LIB_SM3=m
 CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_NHPOLY1305=m
-CONFIG_CRYPTO_NULL2=y
 CONFIG_CRYPTO_POLYVAL=m
 CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
+CONFIG_CRYPTO_SHA256_X86_64=y
 CONFIG_CRYPTO_SIG=y
 CONFIG_CRYPTO_SIG2=y
-CONFIG_CRYPTO_SIMD=m
 CONFIG_CRYPTO_SKCIPHER=y
 CONFIG_CRYPTO_SKCIPHER2=y
-CONFIG_CRYPTO_SM3=m
 CONFIG_CRYPTO_SM4=m
 CONFIG_CRYPTO_TWOFISH_COMMON=m
 CONFIG_CRYPTO_USER_API=m
@@ -3738,7 +3742,6 @@ CONFIG_DYNAMIC_EVENTS=y
 CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
 CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
-CONFIG_DYNAMIC_MEMORY_LAYOUT=y
 CONFIG_DYNAMIC_PHYSICAL_MASK=y
 CONFIG_DYNAMIC_SIGFRAME=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
@@ -3789,6 +3792,7 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FUNCTION_PADDING_BYTES=16
 CONFIG_FUNCTION_PADDING_CFI=11
 CONFIG_FUNCTION_TRACE_ARGS=y
+CONFIG_FUTEX_MPOL=y
 CONFIG_FUTEX_PI=y
 CONFIG_FWNODE_MDIO=m
 CONFIG_FW_LOADER_PAGED_BUF=y
@@ -4082,8 +4086,6 @@ CONFIG_LRU_GEN_WALKS_MMU=y
 CONFIG_LZ4_DECOMPRESS=y
 CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
-CONFIG_MDIO_BUS=m
-CONFIG_MDIO_DEVRES=m
 CONFIG_MEMORY_BALLOON=y
 CONFIG_MEMORY_ISOLATION=y
 CONFIG_MEMREGION=y
@@ -4120,6 +4122,7 @@ CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_SKIP_EGRESS=y
 CONFIG_NETFILTER_SYNPROXY=m
 CONFIG_NETPOLL=y
+CONFIG_NET_CRC32C=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DEVMEM=y
 CONFIG_NET_EGRESS=y
@@ -4201,7 +4204,7 @@ CONFIG_PCI_LOCKLESS_CONFIG=y
 CONFIG_PCI_XEN=y
 CONFIG_PER_VMA_LOCK=y
 CONFIG_PGTABLE_HAS_HUGE_LEAVES=y
-CONFIG_PGTABLE_LEVELS=4
+CONFIG_PGTABLE_LEVELS=5
 CONFIG_PHYLINK=m
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_PM_SLEEP=y
@@ -4310,6 +4313,8 @@ CONFIG_TRACING=y
 CONFIG_TRACING_SUPPORT=y
 CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
+CONFIG_TSM_GUEST=y
+CONFIG_TSM_MEASUREMENTS=y
 CONFIG_TSM_REPORTS=m
 CONFIG_UCS2_STRING=y
 CONFIG_UEFI_CPER=y
@@ -4355,7 +4360,6 @@ CONFIG_X86_DISABLED_FEATURE_CENTAUR_MCR=y
 CONFIG_X86_DISABLED_FEATURE_CYRIX_ARR=y
 CONFIG_X86_DISABLED_FEATURE_IBT=y
 CONFIG_X86_DISABLED_FEATURE_K6_MTRR=y
-CONFIG_X86_DISABLED_FEATURE_LA57=y
 CONFIG_X86_DISABLED_FEATURE_LAM=y
 CONFIG_X86_DISABLED_FEATURE_RETHUNK=y
 CONFIG_X86_DISABLED_FEATURE_RETPOLINE=y
--- a/debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch
+++ b/debian/patches/bugfix/all/bootconfig-fix-negative-seeks-on-32-bit-with-lfs-ena.patch
@@ -0,0 +1,45 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Sun, 17 Aug 2025 16:06:28 +0200
+Subject: bootconfig: Fix negative seeks on 32-bit with LFS enabled
+Forwarded: https://lore.kernel.org/linux-trace-kernel/aKHlevxeg6Y7UQrz@decadent.org.uk/T/
+
+Commit 26dda5769509 "tools/bootconfig: Cleanup bootconfig footer size
+calculations" replaced some expressions of type int with the
+BOOTCONFIG_FOOTER_SIZE macro, which expands to an expression of type
+size_t, which is unsigned.
+
+On 32-bit architectures with LFS enabled (i.e. off_t is 64-bit), the
+seek offset of -BOOTCONFIG_FOOTER_SIZE now turns into a positive
+value.
+
+Fix this by casting the size to off_t before negating it.
+
+Just in case someone changes BOOTCONFIG_MAGIC_LEN to have type size_t
+later, do the same thing to the seek offset of -BOOTCONFIG_MAGIC_LEN.
+
+Fixes: 26dda5769509 ("tools/bootconfig: Cleanup bootconfig footer size calculations")
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+ tools/bootconfig/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
+@@ -193,7 +193,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (stat.st_size < BOOTCONFIG_FOOTER_SIZE)
+ 		return 0;
+ 
+-	if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
+	if (lseek(fd, -(off_t)BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for magic", -errno);
+ 
+ 	if (read(fd, magic, BOOTCONFIG_MAGIC_LEN) < 0)
+@@ -203,7 +203,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0)
+ 		return 0;
+ 
+-	if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
+	if (lseek(fd, -(off_t)BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for size", -errno);
+ 
+ 	if (read(fd, &size, sizeof(uint32_t)) < 0)
--- a/debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch
+++ b/debian/patches/bugfix/all/bootconfig-fix-unaligned-access-when-building-footer.patch
@@ -0,0 +1,71 @@
+From: Ben Hutchings <benh@debian.org>
+Date: Wed, 23 Jul 2025 12:17:14 +0200
+Subject: bootconfig: Fix unaligned access when building footer
+Forwarded: https://lore.kernel.org/linux-trace-kernel/aIC-NTw-cdm9ZGFw@decadent.org.uk/T/
+
+Currently we add padding between the bootconfig text and footer to
+ensure that the footer is aligned within the initramfs image.
+However, because only the bootconfig data is held in memory, not the
+full initramfs image, the footer may not be naturally aligned in
+memory.
+
+This can result in an alignment fault (SIGBUS) when writing the footer
+on some architectures, such as sparc.
+
+Build the footer in a struct on the stack before adding it to the
+buffer.
+
+References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0
+Signed-off-by: Ben Hutchings <benh@debian.org>
+---
+ tools/bootconfig/main.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
+@@ -11,6 +11,7 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <endian.h>
+#include <assert.h>
+ 
+ #include <linux/bootconfig.h>
+ 
+@@ -363,7 +364,12 @@ static int delete_xbc(const char *path)
+ 
+ static int apply_xbc(const char *path, const char *xbc_path)
+ {
+-	char *buf, *data, *p;
+	struct {
+		uint32_t size;
+		uint32_t csum;
+		char magic[BOOTCONFIG_MAGIC_LEN];
+	} footer;
+	char *buf, *data;
+ 	size_t total_size;
+ 	struct stat stat;
+ 	const char *msg;
+@@ -433,17 +439,13 @@ static int apply_xbc(const char *path, c
+ 	size += pad;
+ 
+ 	/* Add a footer */
+-	p = data + size;
+-	*(uint32_t *)p = htole32(size);
+-	p += sizeof(uint32_t);
+	footer.size = htole32(size);
+	footer.csum = htole32(csum);
+	memcpy(footer.magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
+	static_assert(sizeof(footer) == BOOTCONFIG_FOOTER_SIZE);
+	memcpy(data + size, &footer, BOOTCONFIG_FOOTER_SIZE);
+ 
+-	*(uint32_t *)p = htole32(csum);
+-	p += sizeof(uint32_t);
+-
+-	memcpy(p, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN);
+-	p += BOOTCONFIG_MAGIC_LEN;
+-
+-	total_size = p - data;
+	total_size = size + BOOTCONFIG_FOOTER_SIZE;
+ 
+ 	ret = write(fd, data, total_size);
+ 	if (ret < total_size) {
--- a/debian/patches/bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch
+++ b/debian/patches/bugfix/all/ext4-don-t-try-to-clear-the-orphan_present-feature-b.patch
@@ -0,0 +1,45 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Thu, 7 Aug 2025 09:35:20 -0400
+Subject: ext4: don't try to clear the orphan_present feature block device is
+ r/o
+Origin: https://git.kernel.org/linus/c5e104a91e7b6fa12c1dc2d8bf84abb7ef9b89ad
+Bug-Debian: https://bugs.debian.org/1108271
+
+When the file system is frozen in preparation for taking an LVM
+snapshot, the journal is checkpointed and if the orphan_file feature
+is enabled, and the orphan file is empty, we clear the orphan_present
+feature flag.  But if there are pending inodes that need to be removed
+the orphan_present feature flag can't be cleared.
+
+The problem comes if the block device is read-only.  In that case, we
+can't process the orphan inode list, so it is skipped in
+ext4_orphan_cleanup().  But then in ext4_mark_recovery_complete(),
+this results in the ext4 error "Orphan file not empty on read-only fs"
+firing and the file system mount is aborted.
+
+Fix this by clearing the needs_recovery flag in the block device is
+read-only.  We do this after the call to ext4_load_and_init-journal()
+since there are some error checks need to be done in case the journal
+needs to be replayed and the block device is read-only, or if the
+block device containing the externa journal is read-only, etc.
+
+Cc: stable@kernel.org
+Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108271
+Cc: stable@vger.kernel.org
+Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling")
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
+@@ -5414,6 +5414,8 @@ static int __ext4_fill_super(struct fs_c
+ 		err = ext4_load_and_init_journal(sb, es, ctx);
+ 		if (err)
+ 			goto failed_mount3a;
+		if (bdev_read_only(sb->s_bdev))
+		    needs_recovery = 0;
+ 	} else if (test_opt(sb, NOLOAD) && !sb_rdonly(sb) &&
+ 		   ext4_has_feature_journal_needs_recovery(sb)) {
+ 		ext4_msg(sb, KERN_ERR, "required journal recovery "
--- a/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
+++ b/debian/patches/bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch
@@ -18,7 +18,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
-@@ -2630,7 +2630,7 @@ module_exit(exit_btrfs_fs)
+@@ -2622,7 +2622,7 @@ module_exit(exit_btrfs_fs)
 
 MODULE_DESCRIPTION("B-Tree File System (BTRFS)");
 MODULE_LICENSE("GPL");
@@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 MODULE_SOFTDEP("pre: blake2b-256");
 --- a/fs/jbd2/journal.c
 +++ b/fs/jbd2/journal.c
-@@ -3158,6 +3158,7 @@ static void __exit journal_exit(void)
+@@ -3157,6 +3157,7 @@ static void __exit journal_exit(void)
 
 MODULE_DESCRIPTION("Generic filesystem journal-writing module");
 MODULE_LICENSE("GPL");
@@ -39,7 +39,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 --- a/fs/nfsd/nfsctl.c
 +++ b/fs/nfsd/nfsctl.c
-@@ -2349,5 +2349,8 @@ static void __exit exit_nfsd(void)
+@@ -2353,5 +2353,8 @@ static void __exit exit_nfsd(void)
 MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
 MODULE_DESCRIPTION("In-kernel NFS server");
 MODULE_LICENSE("GPL");
--- a/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch
+++ b/debian/patches/bugfix/all/kbuild-bpf-fix-btf-reproducibility.patch
@@ -24,7 +24,7 @@ Signed-off-by: Ben Hutchings <benh@debian.org>
 pahole-flags-$(call test-ge, $(pahole-ver), 125)	+= --skip_encoding_btf_inconsistent_proto --btf_gen_optimized
 
 else
-@@ -29,6 +27,18 @@ endif
+@@ -31,6 +29,18 @@ endif
 
 endif
 
--- a/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch
+++ b/debian/patches/bugfix/all/kbuild-fix-recordmcount-dependency.patch
@@ -9,7 +9,7 @@ sources.

 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -184,6 +184,11 @@ cmd_record_mcount = $(if $(findstring $(
+@@ -268,6 +268,11 @@ cmd_record_mcount = $(if $(findstring $(
 	$(sub_cmd_record_mcount))
 endif # CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT
 
--- a/debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch
+++ b/debian/patches/bugfix/all/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch
@@ -0,0 +1,90 @@
+From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
+Date: Thu, 10 Jul 2025 11:24:17 +0900
+Subject: tools/bootconfig: Cleanup bootconfig footer size calculations
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git/commit?id=26dda57695090e05c1a99c3e8f802f862d1ac474
+
+There are many same pattern of 8 + BOOTCONFIG_MAGIC_LEN for calculating
+the size of bootconfig footer. Use BOOTCONFIG_FOOTER_SIZE macro to
+clean up those magic numbers.
+
+Link: https://lore.kernel.org/all/175211425693.2591046.16029516706923643510.stgit@mhiramat.tok.corp.google.com/
+
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+---
+ tools/bootconfig/main.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
+@@ -16,6 +16,10 @@
+ 
+ #define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__)
+ 
+/* Bootconfig footer is [size][csum][BOOTCONFIG_MAGIC]. */
+#define BOOTCONFIG_FOOTER_SIZE	\
+	(sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN)
+
+ static int xbc_show_value(struct xbc_node *node, bool semicolon)
+ {
+ 	const char *val, *eol;
+@@ -185,7 +189,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (ret < 0)
+ 		return -errno;
+ 
+-	if (stat.st_size < 8 + BOOTCONFIG_MAGIC_LEN)
+	if (stat.st_size < BOOTCONFIG_FOOTER_SIZE)
+ 		return 0;
+ 
+ 	if (lseek(fd, -BOOTCONFIG_MAGIC_LEN, SEEK_END) < 0)
+@@ -198,7 +202,7 @@ static int load_xbc_from_initrd(int fd,
+ 	if (memcmp(magic, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN) != 0)
+ 		return 0;
+ 
+-	if (lseek(fd, -(8 + BOOTCONFIG_MAGIC_LEN), SEEK_END) < 0)
+	if (lseek(fd, -BOOTCONFIG_FOOTER_SIZE, SEEK_END) < 0)
+ 		return pr_errno("Failed to lseek for size", -errno);
+ 
+ 	if (read(fd, &size, sizeof(uint32_t)) < 0)
+@@ -210,12 +214,12 @@ static int load_xbc_from_initrd(int fd,
+ 	csum = le32toh(csum);
+ 
+ 	/* Wrong size error  */
+-	if (stat.st_size < size + 8 + BOOTCONFIG_MAGIC_LEN) {
+	if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
+ 		pr_err("bootconfig size is too big\n");
+ 		return -E2BIG;
+ 	}
+ 
+-	if (lseek(fd, stat.st_size - (size + 8 + BOOTCONFIG_MAGIC_LEN),
+	if (lseek(fd, stat.st_size - (size + BOOTCONFIG_FOOTER_SIZE),
+ 		  SEEK_SET) < 0)
+ 		return pr_errno("Failed to lseek", -errno);
+ 
+@@ -346,7 +350,7 @@ static int delete_xbc(const char *path)
+ 		ret = fstat(fd, &stat);
+ 		if (!ret)
+ 			ret = ftruncate(fd, stat.st_size
+-					- size - 8 - BOOTCONFIG_MAGIC_LEN);
+					- size - BOOTCONFIG_FOOTER_SIZE);
+ 		if (ret)
+ 			ret = -errno;
+ 	} /* Ignore if there is no boot config in initrd */
+@@ -376,8 +380,7 @@ static int apply_xbc(const char *path, c
+ 	csum = xbc_calc_checksum(buf, size);
+ 
+ 	/* Backup the bootconfig data */
+-	data = calloc(size + BOOTCONFIG_ALIGN +
+-		      sizeof(uint32_t) + sizeof(uint32_t) + BOOTCONFIG_MAGIC_LEN, 1);
+	data = calloc(size + BOOTCONFIG_ALIGN + BOOTCONFIG_FOOTER_SIZE, 1);
+ 	if (!data)
+ 		return -ENOMEM;
+ 	memcpy(data, buf, size);
+@@ -425,7 +428,7 @@ static int apply_xbc(const char *path, c
+ 	}
+ 
+ 	/* To align up the total size to BOOTCONFIG_ALIGN, get padding size */
+-	total_size = stat.st_size + size + sizeof(uint32_t) * 2 + BOOTCONFIG_MAGIC_LEN;
+	total_size = stat.st_size + size + BOOTCONFIG_FOOTER_SIZE;
+ 	pad = ((total_size + BOOTCONFIG_ALIGN - 1) & (~BOOTCONFIG_ALIGN_MASK)) - total_size;
+ 	size += pad;
+ 
--- a/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch
+++ b/debian/patches/bugfix/powerpc/powerpc-boot-fix-missing-crc32poly.h-when-building-with-kernel_xz.patch
@@ -26,7 +26,7 @@ Tested-by: Michal Kubecek <mkubecek@suse.cz>

 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -97,7 +97,7 @@ BOOTCFLAGS	+= -fno-stack-protector
+@@ -98,7 +98,7 @@ BOOTCFLAGS	+= -fno-stack-protector
 endif
 
 BOOTCFLAGS	+= -include $(srctree)/include/linux/compiler_attributes.h
--- a/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
+++ b/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
@@ -21,7 +21,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

 --- a/kernel/fork.c
 +++ b/kernel/fork.c
-@@ -119,6 +119,12 @@
+@@ -122,6 +122,12 @@
 
 #include <kunit/visibility.h>
 
@@ -34,7 +34,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
 /*
  * Minimum number of threads to boot the kernel
  */
-@@ -2194,6 +2200,10 @@ __latent_entropy struct task_struct *cop
+@@ -1933,6 +1939,10 @@ __latent_entropy struct task_struct *cop
 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
 		return ERR_PTR(-EINVAL);
 
@@ -45,7 +45,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
 	/*
 	 * Thread groups must share signals as well, and detached threads
 	 * can only be started up within the thread group.
-@@ -3354,6 +3364,12 @@ int ksys_unshare(unsigned long unshare_f
+@@ -3099,6 +3109,12 @@ int ksys_unshare(unsigned long unshare_f
 	if (unshare_flags & CLONE_NEWNS)
 		unshare_flags |= CLONE_FS;
 
@@ -60,7 +60,7 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
 		goto bad_unshare_out;
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
-@@ -84,6 +84,10 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals);
+@@ -77,6 +77,10 @@ EXPORT_SYMBOL_GPL(sysctl_long_vals);
 static const int ngroups_max = NGROUPS_MAX;
 static const int cap_last_cap = CAP_LAST_CAP;
 
@@ -71,10 +71,10 @@ Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
 #ifdef CONFIG_PROC_SYSCTL
 
 /**
-@@ -1595,6 +1599,15 @@ static const struct ctl_table kern_table
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec,
- 	},
+@@ -1581,6 +1585,15 @@ int proc_do_static_key(const struct ctl_
+ }
+ 
+ static const struct ctl_table kern_table[] = {
 +#ifdef CONFIG_USER_NS
 +	{
 +		.procname	= "unprivileged_userns_clone",
--- a/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch
+++ b/debian/patches/debian/btrfs-warn-about-raid5-6-being-experimental-at-mount.patch
@@ -22,7 +22,7 @@ implementation went from disk-io.c to super.c; forwarded the issue]

 --- a/fs/btrfs/super.c
 +++ b/fs/btrfs/super.c
-@@ -769,6 +769,18 @@ static void set_device_specific_options(
+@@ -761,6 +761,18 @@ static void set_device_specific_options(
 		btrfs_set_opt(fs_info->mount_opt, SSD);
 
 	/*
--- a/debian/patches/debian/documentation-drop-sphinx-version-check.patch
+++ b/debian/patches/debian/documentation-drop-sphinx-version-check.patch
@@ -10,7 +10,7 @@ Forwarded: not-needed

 --- a/Documentation/Makefile
 +++ b/Documentation/Makefile
-@@ -118,7 +118,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.
+@@ -119,7 +119,6 @@ $(YNL_RST_DIR)/%.rst: $(YNL_YAML_DIR)/%.
 htmldocs texinfodocs latexdocs epubdocs xmldocs: $(YNL_INDEX)
 
 htmldocs:
@@ -18,7 +18,7 @@ Forwarded: not-needed
 	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,html,$(var),,$(var)))
 
 # If Rust support is available and .config exists, add rustdoc generated contents.
-@@ -132,7 +131,6 @@ endif
+@@ -133,7 +132,6 @@ endif
 endif
 
 texinfodocs:
@@ -26,7 +26,7 @@ Forwarded: not-needed
 	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,texinfo,$(var),texinfo,$(var)))
 
 # Note: the 'info' Make target is generated by sphinx itself when
-@@ -144,7 +142,6 @@ linkcheckdocs:
+@@ -145,7 +143,6 @@ linkcheckdocs:
 	@$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,linkcheck,$(var),,$(var)))
 
 latexdocs:
@@ -34,7 +34,7 @@ Forwarded: not-needed
 	@+$(foreach var,$(SPHINXDIRS),$(call loop_cmd,sphinx,latex,$(var),latex,$(var)))
 
 ifeq ($(HAVE_PDFLATEX),0)
-@@ -157,7 +154,6 @@ else # HAVE_PDFLATEX
+@@ -158,7 +155,6 @@ else # HAVE_PDFLATEX
 
 pdfdocs: DENY_VF = XDG_CONFIG_HOME=$(FONTS_CONF_DENY_VF)
 pdfdocs: latexdocs
@@ -42,7 +42,7 @@ Forwarded: not-needed
 	$(foreach var,$(SPHINXDIRS), \
 	   $(MAKE) PDFLATEX="$(PDFLATEX)" LATEXOPTS="$(LATEXOPTS)" $(DENY_VF) -C $(BUILDDIR)/$(var)/latex || sh $(srctree)/scripts/check-variable-fonts.sh || exit; \
 	   mkdir -p $(BUILDDIR)/$(var)/pdf; \
-@@ -167,11 +163,9 @@ pdfdocs: latexdocs
+@@ -168,11 +164,9 @@ pdfdocs: latexdocs
 endif # HAVE_PDFLATEX
 
 epubdocs:
--- a/debian/patches/debian/export-symbols-needed-by-binder.patch
+++ b/debian/patches/debian/export-symbols-needed-by-binder.patch
@@ -17,9 +17,10 @@ Export the currently un-exported symbols it depends on.
 kernel/sched/wait.c     |    1 +
 kernel/task_work.c      |    1 +
 mm/list_lru.c           |    2 ++
- mm/memory.c             |    2 ++
+ mm/memory.c             |    1 +
+ mm/mmap_lock.c          |    1 +
 security/security.c     |    4 ++++
- 9 files changed, 14 insertions(+)
+ 10 files changed, 14 insertions(+)

 --- a/fs/file.c
 +++ b/fs/file.c
@@ -101,22 +102,24 @@ Export the currently un-exported symbols it depends on.
 {
 --- a/mm/memory.c
 +++ b/mm/memory.c
-@@ -2020,6 +2020,7 @@ void zap_page_range_single(struct vm_are
+@@ -2050,6 +2050,7 @@ void zap_page_range_single(struct vm_are
+ 	zap_page_range_single_batched(&tlb, vma, address, size, details);
 	tlb_finish_mmu(&tlb);
- 	hugetlb_zap_end(vma, details);
 }
 +EXPORT_SYMBOL_GPL(zap_page_range_single);
 
 /**
  * zap_vma_ptes - remove ptes mapping the vma
-@@ -6567,6 +6568,7 @@ inval:
+--- a/mm/mmap_lock.c
+++ b/mm/mmap_lock.c
+@@ -177,6 +177,7 @@ inval:
 	count_vm_vma_lock_event(VMA_LOCK_ABORT);
 	return NULL;
 }
 +EXPORT_SYMBOL_GPL(lock_vma_under_rcu);
 #endif /* CONFIG_PER_VMA_LOCK */
 
- #ifndef __PAGETABLE_P4D_FOLDED
+ #ifdef CONFIG_LOCK_MM_AND_FIND_VMA
 --- a/security/security.c
 +++ b/security/security.c
@@ -996,6 +996,7 @@ int security_binder_set_context_mgr(cons
--- a/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch
+++ b/debian/patches/debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch
@@ -12,7 +12,7 @@ actually used.
 ---
 --- a/fs/notify/fanotify/fanotify_user.c
 +++ b/fs/notify/fanotify/fanotify_user.c
-@@ -1881,6 +1881,14 @@ static int do_fanotify_mark(int fanotify
+@@ -1878,6 +1878,14 @@ static int do_fanotify_mark(int fanotify
 		umask = FANOTIFY_EVENT_FLAGS;
 	}
 
--- a/debian/patches/debian/kernelvariables.patch
+++ b/debian/patches/debian/kernelvariables.patch
@@ -56,7 +56,7 @@ use of $(ARCH) needs to be moved after this.
 KCONFIG_CONFIG	?= .config
 export KCONFIG_CONFIG
 
-@@ -551,6 +521,35 @@ RUSTFLAGS_KERNEL =
+@@ -556,6 +526,35 @@ RUSTFLAGS_KERNEL =
 AFLAGS_KERNEL	=
 LDFLAGS_vmlinux =
 
--- a/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch
+++ b/debian/patches/debian/linux-perf-remove-remaining-source-filenames-from-executable.patch
@@ -15,7 +15,7 @@ to the installed location.
 ---
 --- a/tools/perf/builtin-report.c
 +++ b/tools/perf/builtin-report.c
-@@ -666,10 +666,12 @@ static int report__browse_hists(struct r
+@@ -669,10 +669,12 @@ static int report__browse_hists(struct r
 
 	path = system_path(TIPDIR);
 	if (perf_tip(&help, path) || help == NULL) {
@@ -30,7 +30,7 @@ to the installed location.
 	free(path);
 --- a/tools/perf/tests/Build
 +++ b/tools/perf/tests/Build
-@@ -73,7 +73,7 @@ ifeq ($(SRCARCH),$(filter $(SRCARCH),x86
+@@ -74,7 +74,7 @@ ifeq ($(SRCARCH),$(filter $(SRCARCH),x86
 perf-test-$(CONFIG_DWARF_UNWIND) += dwarf-unwind.o
 endif
 
--- a/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch
+++ b/debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch
@@ -31,7 +31,7 @@ cc: linux-efi@vger.kernel.org

 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -1127,19 +1127,7 @@ void __init setup_arch(char **cmdline_p)
+@@ -1149,19 +1149,7 @@ void __init setup_arch(char **cmdline_p)
 	/* Allocate bigger log buffer */
 	setup_log_buf(1);
 
--- a/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
+++ b/debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch
@@ -26,7 +26,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>

 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
-@@ -964,6 +964,8 @@ void __init setup_arch(char **cmdline_p)
+@@ -986,6 +986,8 @@ void __init setup_arch(char **cmdline_p)
 	if (efi_enabled(EFI_BOOT))
 		efi_init();
 
@@ -35,7 +35,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
 	reserve_ibft_region();
 	x86_init.resources.dmi_setup();
 
-@@ -1127,8 +1129,6 @@ void __init setup_arch(char **cmdline_p)
+@@ -1149,8 +1151,6 @@ void __init setup_arch(char **cmdline_p)
 	/* Allocate bigger log buffer */
 	setup_log_buf(1);
 
@@ -67,7 +67,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
 		default:
 --- a/include/linux/security.h
 +++ b/include/linux/security.h
-@@ -574,6 +574,7 @@ int security_inode_notifysecctx(struct i
+@@ -573,6 +573,7 @@ int security_inode_notifysecctx(struct i
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, struct lsm_context *cp);
 int security_locked_down(enum lockdown_reason what);
@@ -75,7 +75,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
 int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
 		      void *val, size_t val_len, u64 id, u64 flags);
 int security_bdev_alloc(struct block_device *bdev);
-@@ -1580,6 +1581,11 @@ static inline int security_locked_down(e
+@@ -1574,6 +1575,11 @@ static inline int security_locked_down(e
 {
 	return 0;
 }
--- a/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
+++ b/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

 --- a/include/linux/perf_event.h
 +++ b/include/linux/perf_event.h
-@@ -1684,6 +1684,11 @@ extern int sysctl_perf_event_sample_rate
+@@ -1761,6 +1761,11 @@ extern int sysctl_perf_event_sample_rate
 
 extern void perf_sample_event_took(u64 sample_len_ns);
 
@@ -50,7 +50,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 /* Minimum for 512 kiB + 1 user control page. 'free' kiB per user. */
 static int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024);
-@@ -13164,6 +13169,9 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -13376,6 +13381,9 @@ SYSCALL_DEFINE5(perf_event_open,
 	if (err)
 		return err;
 
--- a/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch
+++ b/debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch
@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -2288,6 +2288,8 @@
+@@ -2306,6 +2306,8 @@
 			bypassed by not enabling DMAR with this option. In
 			this case, gfx device will use physical address for
 			DMA.
@@ -68,7 +68,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 		} else if (!strncmp(str, "forcedac", 8)) {
 			pr_warn("intel_iommu=forcedac deprecated; use iommu.forcedac instead\n");
 			iommu_dma_forcedac = true;
-@@ -1949,6 +1957,9 @@ static int device_def_domain_type(struct
+@@ -1899,6 +1907,9 @@ static int device_def_domain_type(struct
 
 		if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
 			return IOMMU_DOMAIN_IDENTITY;
@@ -78,7 +78,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 	}
 
 	return 0;
-@@ -2243,6 +2254,9 @@ static int __init init_dmars(void)
+@@ -2189,6 +2200,9 @@ static int __init init_dmars(void)
 		iommu_set_root_entry(iommu);
 	}
 
--- a/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch
+++ b/debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch
@@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -7044,6 +7044,10 @@
+@@ -7117,6 +7117,10 @@
 			later by a loaded module cannot be set this way.
 			Example: sysctl.vm.swappiness=40
 
@@ -42,7 +42,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 			Ignore sysrq setting - this boot parameter will
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
-@@ -3178,6 +3178,14 @@ config COMPAT_32
+@@ -3150,6 +3150,14 @@ config COMPAT_32
 	select HAVE_UID16
 	select OLD_SIGSUSPEND3
 
@@ -69,7 +69,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 
 typedef unsigned long elf_greg_t;
 
-@@ -152,7 +155,8 @@ do {						\
+@@ -148,7 +151,8 @@ do {						\
 
 #define compat_elf_check_arch(x)					\
 	((elf_check_arch_ia32(x) && ia32_enabled_verbose()) ||		\
--- a/debian/patches/krd/0002-local-ports.patch
+++ b/debian/patches/krd/0002-local-ports.patch
@@ -1,6 +1,6 @@
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1790,7 +1790,7 @@ static __net_init int inet_init_net(stru
+@@ -1787,7 +1787,7 @@ static __net_init int inet_init_net(stru
 	/*
 	 * Set defaults for local port range
 	 */
--- a/debian/patches/krd/0003-bridge-group_fwd_mask.patch
+++ b/debian/patches/krd/0003-bridge-group_fwd_mask.patch
@@ -1,6 +1,6 @@
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -383,7 +383,11 @@ static rx_handler_result_t br_handle_fra
+@@ -384,7 +384,11 @@ static rx_handler_result_t br_handle_fra
 
 		case 0x01:	/* IEEE MAC (Pause) */
 			reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL;
--- a/debian/patches/misc-openwrt/0101-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch
+++ b/debian/patches/misc-openwrt/0101-mac80211-ignore-AP-power-level-when-tx-power-type-is.patch
--- a/debian/patches/misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch
+++ b/debian/patches/misc-openwrt/0102-mac80211-avoid-crashing-missing-band.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>

 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2467,6 +2467,13 @@ static void sta_stats_decode_rate(struct
+@@ -2468,6 +2468,13 @@ static void sta_stats_decode_rate(struct
 
 		sband = local->hw.wiphy->bands[band];
 
--- a/debian/patches/misc-openwrt/0103-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/debian/patches/misc-openwrt/0103-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
--- a/debian/patches/misc-openwrt/0104-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
+++ b/debian/patches/misc-openwrt/0104-mac80211-minstrel_ht-fix-MINSTREL_FRAC-macro.patch
--- a/debian/patches/misc-openwrt/0105-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
+++ b/debian/patches/misc-openwrt/0105-mac80211-minstrel_ht-reduce-fluctuations-in-rate-pro.patch
--- a/debian/patches/misc-openwrt/0106-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
+++ b/debian/patches/misc-openwrt/0106-mac80211-minstrel_ht-rework-rate-downgrade-code-and-.patch
--- a/debian/patches/misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/debian/patches/misc-openwrt/0107-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4085,7 +4085,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4074,7 +4074,7 @@ struct ieee80211_txq *ieee80211_next_txq
 
 		if (deficit < 0)
 			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 		if (deficit < 0 || !aql_check) {
 			list_move_tail(&txqi->schedule_order,
-@@ -4230,7 +4230,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4219,7 +4219,8 @@ bool ieee80211_txq_may_transmit(struct i
 		}
 		sta = container_of(iter->txq.sta, struct sta_info, sta);
 		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
 	}
 
-@@ -4238,7 +4239,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4227,7 +4228,7 @@ bool ieee80211_txq_may_transmit(struct i
 	if (sta->airtime[ac].deficit >= 0)
 		goto out;
 
--- a/debian/patches/misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch
+++ b/debian/patches/misc-openwrt/0108-mac80211-add-AQL-support-for-broadcast-packets.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3464,6 +3464,7 @@ enum wiphy_params_flags {
+@@ -3434,6 +3434,7 @@ enum wiphy_params_flags {
 /* The per TXQ device queue limit in airtime */
 #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L	5000
 #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H	12000
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1377,10 +1377,12 @@ struct ieee80211_local {
+@@ -1392,10 +1392,12 @@ struct ieee80211_local {
 	spinlock_t handle_wake_tx_queue_lock;
 
 	u16 airtime_flags;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		spin_lock_init(&local->active_txq_lock[i]);
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2381,13 +2381,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
+@@ -2382,13 +2382,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
 
 void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
 					  struct sta_info *sta, u8 ac,
@@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			atomic_add(tx_airtime,
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2556,7 +2556,7 @@ static u16 ieee80211_store_ack_skb(struc
+@@ -2546,7 +2546,7 @@ static u16 ieee80211_store_ack_skb(struc
 
 		spin_lock_irqsave(&local->ack_status_lock, flags);
 		id = idr_alloc(&local->ack_status_frames, ack_skb,
@@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		spin_unlock_irqrestore(&local->ack_status_lock, flags);
 
 		if (id >= 0) {
-@@ -3986,20 +3986,20 @@ begin:
+@@ -3975,20 +3975,20 @@ begin:
 encap_out:
 	info->control.vif = vif;
 
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	}
 
 	return skb;
-@@ -4051,6 +4051,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4040,6 +4040,7 @@ struct ieee80211_txq *ieee80211_next_txq
 	struct ieee80211_txq *ret = NULL;
 	struct txq_info *txqi = NULL, *head = NULL;
 	bool found_eligible_txq = false;
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	spin_lock_bh(&local->active_txq_lock[ac]);
 
-@@ -4074,26 +4075,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4063,26 +4064,26 @@ struct ieee80211_txq *ieee80211_next_txq
 	if (!head)
 		head = txqi;
 
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	if (txqi->schedule_round == local->schedule_round[ac])
 		goto out;
 
-@@ -4160,7 +4161,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4149,7 +4150,8 @@ bool ieee80211_txq_airtime_check(struct
 		return true;
 
 	if (!txq->sta)
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
 		return true;
-@@ -4209,15 +4211,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4198,15 +4200,15 @@ bool ieee80211_txq_may_transmit(struct i
 
 	spin_lock_bh(&local->active_txq_lock[ac]);
 
@@ -245,7 +245,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		if (iter == txqi)
 --- a/include/net/mac80211.h
 +++ b/include/net/mac80211.h
-@@ -1238,8 +1238,8 @@ struct ieee80211_tx_info {
+@@ -1245,8 +1245,8 @@ struct ieee80211_tx_info {
 	    status_data_idr:1,
 	    status_data:13,
 	    hw_queue:4,
--- a/debian/patches/misc-openwrt/0109-mac80211-txq-tune.patch
+++ b/debian/patches/misc-openwrt/0109-mac80211-txq-tune.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -1606,8 +1606,8 @@ int ieee80211_txq_setup_flows(struct iee
+@@ -1596,8 +1596,8 @@ int ieee80211_txq_setup_flows(struct iee
 		fq->memory_limit = 4 << 20; /* 4 Mbytes */
 
 	codel_params_init(&local->cparams);
--- a/debian/patches/misc-openwrt/0110-cfg80211-aql-txq-limit.patch
+++ b/debian/patches/misc-openwrt/0110-cfg80211-aql-txq-limit.patch
@@ -1,6 +1,6 @@
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3462,12 +3462,12 @@ enum wiphy_params_flags {
+@@ -3432,12 +3432,12 @@ enum wiphy_params_flags {
 #define IEEE80211_DEFAULT_AIRTIME_WEIGHT	256
 
 /* The per TXQ device queue limit in airtime */
--- a/debian/patches/misc-openwrt/0201-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch
+++ b/debian/patches/misc-openwrt/0201-sched-sch_cake-fix-bulk-flow-accounting-logic-for-host.patch
--- a/debian/patches/misc-openwrt/0301-fq-adjust-memory-size.patch
+++ b/debian/patches/misc-openwrt/0301-fq-adjust-memory-size.patch
--- a/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch
+++ b/debian/patches/mixed-arch/0001-graysky2-more-ISA-levels-and-uarches.patch
@@ -1,10 +1,6 @@
-From 906ed24dfc7e1bbceacc087ba38aecfd22a9890b Mon Sep 17 00:00:00 2001
+From 6b1d270f55e3143bcb3ad914adf920774351a6b9 Mon Sep 17 00:00:00 2001
 From: graysky <therealgraysky AT proton DOT me>
-Date: Mon, 16 Sep 2024 14:47:03 -0400
-
-FEATURES
-This patch adds additional tunings via new x86-64 ISA levels and
-more micro-architecture options to the Linux kernel in three classes.
+Date: Mon, 18 Aug 2025 04:14:48 -0400

 1. New generic x86-64 ISA levels

@@ -103,7 +99,7 @@ See the following experimental evidence supporting this statement:
 https://github.com/graysky2/kernel_compiler_patch?tab=readme-ov-file#benchmarks

 REQUIREMENTS
-linux version 6.1.79+
+linux version 6.16+
 gcc version >=9.0 or clang version >=9.0

 ACKNOWLEDGMENTS
@@ -116,9 +112,9 @@ REFERENCES
 4.  http://www.linuxforge.net/docs/linux/linux-gcc.php

 ---
- arch/x86/Kconfig.cpu | 462 ++++++++++++++++++++++++++++++++++++++++++-
- arch/x86/Makefile    | 222 +++++++++++++++++++++
- 2 files changed, 675 insertions(+), 9 deletions(-)
+ arch/x86/Kconfig.cpu | 427 ++++++++++++++++++++++++++++++++++++++++++-
+ arch/x86/Makefile    | 213 ++++++++++++++++++++-
+ 2 files changed, 631 insertions(+), 9 deletions(-)

 --- a/arch/x86/Kconfig.cpu
 +++ b/arch/x86/Kconfig.cpu
@@ -163,38 +159,15 @@ REFERENCES
 
 config MK6
 	bool "K6/K6-II/K6-III"
-@@ -245,6 +260,435 @@ config MATOM
+@@ -281,6 +296,402 @@ config X86_GENERIC
+ 	  This is really intended for distributors who need more
+ 	  generic optimizations.
 
- endchoice
- 
-+config CC_HAS_MARCH_NATIVE
-+	# This flag might not be available in cross-compilers:
-+	def_bool $(cc-option, -march=native)
-+	# LLVM 18 has an easily triggered internal compiler error in core
-+	# networking code with '-march=native' on certain systems:
-+	# https://github.com/llvm/llvm-project/issues/72026
-+	# LLVM 19 introduces an optimization that resolves some high stack
-+	# usage warnings that only appear wth '-march=native'.
-+	depends on CC_IS_GCC || CLANG_VERSION >= 190100
-+
 +choice
 +	prompt "x86_64 Compiler Build Optimization"
+	depends on !X86_NATIVE_CPU
 +	default GENERIC_CPU
 +
-+config X86_NATIVE_CPU
-+	bool "Build and optimize for local/native CPU"
-+	depends on X86_64
-+	depends on CC_HAS_MARCH_NATIVE
-+	help
-+	  Optimize for the current CPU used to compile the kernel.
-+	  Use this option if you intend to build the kernel for your
-+	  local machine.
-+
-+	  Note that such a kernel might not work optimally on a
-+	  different x86 machine.
-+
-+	  If unsure, say N.
-+
 +config GENERIC_CPU
 +	bool "Generic-x86-64"
 +	depends on X86_64
@@ -202,26 +175,6 @@ REFERENCES
 +	  Generic x86-64 CPU.
 +	  Runs equally well on all x86-64 CPUs.
 +
-+config MNATIVE_INTEL
-+	bool "Intel-Native optimizations autodetected by the compiler"
-+	help
-+
-+	  Clang 3.8, GCC 4.2 and above support -march=native, which automatically detects
-+	  the optimum settings to use based on your processor. Do NOT use this
-+	  for AMD CPUs.  Intel Only!
-+
-+	  Enables -march=native
-+
-+config MNATIVE_AMD
-+	bool "AMD-Native optimizations autodetected by the compiler"
-+	help
-+
-+	  Clang 3.8, GCC 4.2 and above support -march=native, which automatically detects
-+	  the optimum settings to use based on your processor. Do NOT use this
-+	  for Intel CPUs.  AMD Only!
-+
-+	  Enables -march=native
-+
 +config MK8
 +	bool "AMD Opteron/Athlon64/Hammer/K8"
 +	help
@@ -445,20 +398,20 @@ REFERENCES
 +	  Enables -march=skylake
 +
 +config MSKYLAKEX
-+	bool "Intel Skylake X"
+	bool "Intel Skylake-X (7th Gen Core i7/i9)"
 +	depends on X86_64
 +	help
 +
-+	  Select this for 6th Gen Core processors in the Skylake X family.
+	  Select this for 7th Gen Core i7/i9 processors in the Skylake-X family.
 +
 +	  Enables -march=skylake-avx512
 +
 +config MCANNONLAKE
-+	bool "Intel Cannon Lake"
+	bool "Intel Coffee Lake/Kaby Lake Refresh (8th Gen Core i3/i5/i7)"
 +	depends on X86_64
 +	help
 +
-+	  Select this for 8th Gen Core processors
+	  Select this for 8th Gen Core i3/i5/i7 processors in the Coffee Lake or Kaby Lake Refresh families.
 +
 +	  Enables -march=cannonlake
 +
@@ -472,11 +425,11 @@ REFERENCES
 +	  Enables -march=icelake-client
 +
 +config MICELAKE_SERVER
-+	bool "Intel Ice Lake Server"
+	bool "Intel Ice Lake-SP (3rd Gen Xeon Scalable)"
 +	depends on X86_64
 +	help
 +
-+	  Select this for 10th Gen Core server processors in the Ice Lake family.
+	  Select this for 3rd Gen Xeon Scalable processors in the Ice Lake-SP family.
 +
 +	  Enables -march=icelake-server
 +
@@ -566,10 +519,20 @@ REFERENCES
 +	depends on (CC_IS_GCC && GCC_VERSION > 130000) || (CC_IS_CLANG && CLANG_VERSION >= 150500)
 +	help
 +
-+	  Select this for fifth-generation 10 nm process processors in the Emerald Rapids family.
+	  Select this for fifth-generation Xeon Scalable processors in the Emerald Rapids family.
 +
 +	  Enables -march=emeraldrapids
 +
+config MDIAMONDRAPIDS
+	bool "Intel Diamond Rapids (7th Gen Xeon Scalable)"
+	depends on X86_64
+	depends on (CC_IS_GCC && GCC_VERSION > 150000) || (CC_IS_CLANG && CLANG_VERSION >= 200000)
+	help
+
+	  Select this for seventh-generation Xeon Scalable processors in the Diamond Rapids family.
+
+	  Enables -march=diamondrapids
+
 +endchoice
 +
 +config X86_64_VERSION
@@ -596,31 +559,31 @@ REFERENCES
 +	  /lib/ld-linux-x86-64.so.2 --help | grep supported
 +	  /lib64/ld-linux-x86-64.so.2 --help | grep supported
 +
- config X86_GENERIC
- 	bool "Generic x86 support"
- 	depends on X86_32
-@@ -266,8 +710,8 @@ config X86_INTERNODE_CACHE_SHIFT
+ #
+ # Define implied options from the CPU selection here
+ config X86_INTERNODE_CACHE_SHIFT
+@@ -290,8 +701,8 @@ config X86_INTERNODE_CACHE_SHIFT
 
 config X86_L1_CACHE_SHIFT
 	int
 -	default "7" if MPENTIUM4
 -	default "6" if MK7 || MPENTIUMM || MATOM || MVIAC7 || X86_GENERIC || X86_64
 +	default "7" if MPENTIUM4 || MPSC
-+	default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL || MNATIVE_AMD
+	default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MATOM || MVIAC7 || X86_GENERIC || GENERIC_CPU || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS || X86_NATIVE_CPU
 	default "4" if MELAN || M486SX || M486 || MGEODEGX1
 	default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
 
-@@ -285,19 +729,19 @@ config X86_ALIGNMENT_16
+@@ -309,19 +720,19 @@ config X86_ALIGNMENT_16
 
 config X86_INTEL_USERCOPY
 	def_bool y
 -	depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK7 || MEFFICEON
-+	depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL
+	depends on MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M586MMX || X86_GENERIC || MK8 || MK7 || MEFFICEON || MCORE2 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS
 
 config X86_USE_PPRO_CHECKSUM
 	def_bool y
 -	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MATOM
-+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MNATIVE_INTEL || MNATIVE_AMD
+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MK8 || MVIAC3_2 || MVIAC7 || MEFFICEON || MGEODE_LX || MCORE2 || MATOM || MK8SSE3 || MK10 || MBARCELONA || MBOBCAT || MJAGUAR || MBULLDOZER || MPILEDRIVER || MSTEAMROLLER || MEXCAVATOR || MZEN || MZEN2 || MZEN3 || MZEN4 || MZEN5 || MNEHALEM || MWESTMERE || MSILVERMONT || MGOLDMONT || MGOLDMONTPLUS || MSANDYBRIDGE || MIVYBRIDGE || MHASWELL || MBROADWELL || MSKYLAKE || MSKYLAKEX || MCANNONLAKE || MICELAKE_CLIENT || MICELAKE_SERVER || MCASCADELAKE || MCOOPERLAKE || MTIGERLAKE || MSAPPHIRERAPIDS || MROCKETLAKE || MALDERLAKE || MRAPTORLAKE || MMETEORLAKE || MEMERALDRAPIDS || MDIAMONDRAPIDS
 
 config X86_TSC
 	def_bool y
@@ -634,7 +597,7 @@ REFERENCES
 
 config X86_CX8
 	def_bool y
-@@ -307,13 +751,13 @@ config X86_CX8
+@@ -331,12 +742,12 @@ config X86_CX8
 # generates cmov.
 config X86_CMOV
 	def_bool y
@@ -645,33 +608,16 @@ REFERENCES
 	int
 	default "64" if X86_64
 -	default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MK7)
-	default "5" if X86_32 && X86_CX8
 +	default "6" if X86_32 && (MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MEFFICEON || MATOM || MCORE2 || MK7 || MK8)
-+	default "5" if X86_32 && X86_CMPXCHG64
+ 	default "5" if X86_32 && X86_CX8
 	default "4"
 
- config X86_DEBUGCTLMSR
 --- a/arch/x86/Makefile
 +++ b/arch/x86/Makefile
-@@ -173,8 +173,230 @@ else
- 	# Use -mskip-rax-setup if supported.
- 	KBUILD_CFLAGS += $(call cc-option,-mskip-rax-setup)
- 
-+ifdef CONFIG_X86_NATIVE_CPU
-+        KBUILD_CFLAGS += -march=native
-+        KBUILD_RUSTFLAGS += -Ctarget-cpu=native
-+endif
-+
-+ifdef CONFIG_MNATIVE_INTEL
-+        KBUILD_CFLAGS += -march=native
-+        KBUILD_RUSTFLAGS += -Ctarget-cpu=native
-+endif
-+
-+ifdef CONFIG_MNATIVE_AMD
-+        KBUILD_CFLAGS += -march=native
-+        KBUILD_RUSTFLAGS += -Ctarget-cpu=native
-+endif
-+
+@@ -177,10 +177,221 @@ ifdef CONFIG_X86_NATIVE_CPU
+         KBUILD_CFLAGS += -march=native
+         KBUILD_RUSTFLAGS += -Ctarget-cpu=native
+ else
 +ifdef CONFIG_MK8
 +        KBUILD_CFLAGS += -march=k8
 +        KBUILD_RUSTFLAGS += -Ctarget-cpu=k8
@@ -872,6 +818,11 @@ REFERENCES
 +        KBUILD_RUSTFLAGS += -Ctarget-cpu=emeraldrapids
 +endif
 +
+ifdef CONFIG_MDIAMONDRAPIDS
+        KBUILD_CFLAGS += -march=diamondrapids
+        KBUILD_RUSTFLAGS += -Ctarget-cpu=diamondrapids
+endif
+
 +ifdef CONFIG_GENERIC_CPU
 +ifeq ($(CONFIG_X86_64_VERSION),1)
         KBUILD_CFLAGS += -march=x86-64 -mtune=generic
@@ -879,8 +830,10 @@ REFERENCES
 +else
 +        KBUILD_CFLAGS +=-march=x86-64-v$(CONFIG_X86_64_VERSION)
 +        KBUILD_RUSTFLAGS += -Ctarget-cpu=x86-64-v$(CONFIG_X86_64_VERSION)
-+endif # CONFIG_X86_64_VERSION
-+endif # CONFIG_GENERIC_CPU
- 
+endif
+endif
+ endif
+-
         KBUILD_CFLAGS += -mno-red-zone
         KBUILD_CFLAGS += -mcmodel=kernel
+         KBUILD_RUSTFLAGS += -Cno-redzone=y
--- a/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch
+++ b/debian/patches/mixed-arch/0002-ZEN-Restore-CONFIG_OPTIMIZE_FOR_PERFORMANCE_O3.patch
@@ -13,7 +13,7 @@ dependency on CONFIG_ARC and adds RUSTFLAGS.

 --- a/Makefile
 +++ b/Makefile
-@@ -868,6 +868,9 @@ KBUILD_CFLAGS	+= -fno-delete-null-pointe
+@@ -873,6 +873,9 @@ KBUILD_CFLAGS	+= -fno-delete-null-pointe
 ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
 KBUILD_CFLAGS += -O2
 KBUILD_RUSTFLAGS += -Copt-level=2
@@ -25,7 +25,7 @@ dependency on CONFIG_ARC and adds RUSTFLAGS.
 KBUILD_RUSTFLAGS += -Copt-level=s
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1479,6 +1479,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE
+@@ -1498,6 +1498,12 @@ config CC_OPTIMIZE_FOR_PERFORMANCE
 	  with the "-O2" compiler flag for best performance and most
 	  helpful compile-time warnings.
 
--- a/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch
+++ b/debian/patches/mixed-arch/0003-krd-adjust-CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -876,6 +876,10 @@ KBUILD_CFLAGS += -Os
+@@ -881,6 +881,10 @@ KBUILD_CFLAGS += -Os
 KBUILD_RUSTFLAGS += -Copt-level=s
 endif
 
--- a/debian/patches/mixed-arch/0004-XANMOD-x86-build-prevent-generating-avx2-floating-point-code.patch
+++ b/debian/patches/mixed-arch/0004-XANMOD-x86-build-prevent-generating-avx2-floating-point-code.patch
--- a/debian/patches/mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch
+++ b/debian/patches/mixed-arch/0006-XANMOD-kbuild-add-GCC-SMS-based-modulo-scheduling-flags.patch
@@ -11,7 +11,7 @@ Signed-off-by: Alexandre Frade <kernel@xanmod.org>

 --- a/Makefile
 +++ b/Makefile
-@@ -880,6 +880,13 @@ ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
+@@ -885,6 +885,13 @@ ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
 KBUILD_CFLAGS += $(call cc-option,-fivopts)
 endif
 
--- a/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch
+++ b/debian/patches/patchset-pf/cpuidle/0001-cpuidle-Prefer-teo-over-menu-governor.patch
@@ -1,4 +1,4 @@
-From 1cb9f09cead0ba384729bfdc74d6fa21d586530c Mon Sep 17 00:00:00 2001
+From 2f7f5a0cd283219e09f8b05b7bfef26b518685ee Mon Sep 17 00:00:00 2001
 From: Christian Loehle <christian.loehle@arm.com>
 Date: Thu, 5 Sep 2024 10:26:39 +0100
 Subject: cpuidle: Prefer teo over menu governor
--- a/debian/patches/patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch
+++ b/debian/patches/patchset-pf/fixes/0001-Revert-Disable-FOP_DONTCACHE-for-now-due-to-bugs.patch
@@ -1,29 +0,0 @@
-From b3dc27f64b5d62505ae9f03a6c342a43b0b7e0b2 Mon Sep 17 00:00:00 2001
-From: Jens Axboe <axboe@kernel.dk>
-Date: Tue, 27 May 2025 07:28:54 -0600
-Subject: Revert "Disable FOP_DONTCACHE for now due to bugs"
-
-This reverts commit 478ad02d6844217cc7568619aeb0809d93ade43d.
-
-Both the read and write side dirty && writeback races should be resolved
-now, revert the commit that disabled FOP_DONTCACHE for filesystems.
-
-Link: https://lore.kernel.org/linux-fsdevel/20250525083209.GS2023217@ZenIV/
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Link: https://lore.kernel.org/20250527133255.452431-4-axboe@kernel.dk
-Signed-off-by: Christian Brauner <brauner@kernel.org>
---
- include/linux/fs.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
--- a/include/linux/fs.h
-+++ b/include/linux/fs.h
-@@ -2186,7 +2186,7 @@ struct file_operations {
- /* Supports asynchronous lock callbacks */
- #define FOP_ASYNC_LOCK		((__force fop_flags_t)(1 << 6))
- /* File system supports uncached read/write buffered IO */
-#define FOP_DONTCACHE		0 /* ((__force fop_flags_t)(1 << 7)) */
-+#define FOP_DONTCACHE		((__force fop_flags_t)(1 << 7))
- 
- /* Wrap a directory iterator that needs exclusive inode access */
- int wrap_directory_iterator(struct file *, struct dir_context *,
--- a/debian/patches/patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch
+++ b/debian/patches/patchset-pf/fixes/0002-mm-filemap-unify-read-write-dropbehind-naming.patch
@@ -1,36 +0,0 @@
-From 0b8d9b7ae677a03629218f69037be3f342c5ee81 Mon Sep 17 00:00:00 2001
-From: Jens Axboe <axboe@kernel.dk>
-Date: Tue, 27 May 2025 07:28:55 -0600
-Subject: mm/filemap: unify read/write dropbehind naming
-
-The read side is filemap_end_dropbehind_read(), while the write side
-used folio_ as the prefix rather than filemap_. The read side makes more
-sense, unify the naming such that the write side follows that.
-
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Link: https://lore.kernel.org/20250527133255.452431-5-axboe@kernel.dk
-Signed-off-by: Christian Brauner <brauner@kernel.org>
---
- mm/filemap.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
--- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1604,7 +1604,7 @@ static void filemap_end_dropbehind(struc
-  * completes. Do that now. If we fail, it's likely because of a big folio -
-  * just reset dropbehind for that case and latter completions should invalidate.
-  */
-static void folio_end_dropbehind_write(struct folio *folio)
-+static void filemap_end_dropbehind_write(struct folio *folio)
- {
- 	/*
- 	 * Hitting !in_task() should not happen off RWF_DONTCACHE writeback,
-@@ -1659,7 +1659,7 @@ void folio_end_writeback(struct folio *f
- 	acct_reclaim_writeback(folio);
- 
- 	if (folio_dropbehind)
-		folio_end_dropbehind_write(folio);
-+		filemap_end_dropbehind_write(folio);
- 	folio_put(folio);
- }
- EXPORT_SYMBOL(folio_end_writeback);
--- a/debian/patches/patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch
+++ b/debian/patches/patchset-pf/fixes/0003-mm-filemap-unify-dropbehind-flag-testing-and-clearin.patch
@@ -1,78 +0,0 @@
-From 2c1c3b3aafb153cbc3bd298db57cc7313d1601b1 Mon Sep 17 00:00:00 2001
-From: Jens Axboe <axboe@kernel.dk>
-Date: Tue, 27 May 2025 07:28:56 -0600
-Subject: mm/filemap: unify dropbehind flag testing and clearing
-
-The read and write side does this a bit differently, unify it such that
-the _{read,write} helpers check the bit before locking, and the generic
-handler is in charge of clearing the bit and invalidating, once under
-the folio lock.
-
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Link: https://lore.kernel.org/20250527133255.452431-6-axboe@kernel.dk
-Signed-off-by: Christian Brauner <brauner@kernel.org>
---
- mm/filemap.c | 21 +++++++++++----------
- 1 file changed, 11 insertions(+), 10 deletions(-)
-
--- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1595,7 +1595,11 @@ static void filemap_end_dropbehind(struc
- 
- 	VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
- 
-	if (mapping && !folio_test_writeback(folio) && !folio_test_dirty(folio))
-+	if (folio_test_writeback(folio) || folio_test_dirty(folio))
-+		return;
-+	if (!folio_test_clear_dropbehind(folio))
-+		return;
-+	if (mapping)
- 		folio_unmap_invalidate(mapping, folio, 0);
- }
- 
-@@ -1606,6 +1610,9 @@ static void filemap_end_dropbehind(struc
-  */
- static void filemap_end_dropbehind_write(struct folio *folio)
- {
-+	if (!folio_test_dropbehind(folio))
-+		return;
-+
- 	/*
- 	 * Hitting !in_task() should not happen off RWF_DONTCACHE writeback,
- 	 * but can happen if normal writeback just happens to find dirty folios
-@@ -1629,8 +1636,6 @@ static void filemap_end_dropbehind_write
-  */
- void folio_end_writeback(struct folio *folio)
- {
-	bool folio_dropbehind = false;
-
- 	VM_BUG_ON_FOLIO(!folio_test_writeback(folio), folio);
- 
- 	/*
-@@ -1652,14 +1657,11 @@ void folio_end_writeback(struct folio *f
- 	 * reused before the folio_wake_bit().
- 	 */
- 	folio_get(folio);
-	if (!folio_test_dirty(folio))
-		folio_dropbehind = folio_test_clear_dropbehind(folio);
- 	if (__folio_end_writeback(folio))
- 		folio_wake_bit(folio, PG_writeback);
-	acct_reclaim_writeback(folio);
- 
-	if (folio_dropbehind)
-		filemap_end_dropbehind_write(folio);
-+	filemap_end_dropbehind_write(folio);
-+	acct_reclaim_writeback(folio);
- 	folio_put(folio);
- }
- EXPORT_SYMBOL(folio_end_writeback);
-@@ -2651,8 +2653,7 @@ static void filemap_end_dropbehind_read(
- 	if (folio_test_writeback(folio) || folio_test_dirty(folio))
- 		return;
- 	if (folio_trylock(folio)) {
-		if (folio_test_clear_dropbehind(folio))
-			filemap_end_dropbehind(folio);
-+		filemap_end_dropbehind(folio);
- 		folio_unlock(folio);
- 	}
- }
--- a/debian/patches/patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch
+++ b/debian/patches/patchset-pf/fixes/0004-mm-khugepaged-fix-race-with-folio-split-free-using-t.patch
@@ -1,98 +0,0 @@
-From 61d27e9dadb2eb2b7596a11a37402452d97625f7 Mon Sep 17 00:00:00 2001
-From: Shivank Garg <shivankg@amd.com>
-Date: Mon, 26 May 2025 18:28:18 +0000
-Subject: mm/khugepaged: fix race with folio split/free using temporary
- reference
-
-hpage_collapse_scan_file() calls is_refcount_suitable(), which in turn
-calls folio_mapcount().  folio_mapcount() checks folio_test_large() before
-proceeding to folio_large_mapcount(), but there is a race window where the
-folio may get split/freed between these checks, triggering:
-
-  VM_WARN_ON_FOLIO(!folio_test_large(folio), folio)
-
-Take a temporary reference to the folio in hpage_collapse_scan_file().
-This stabilizes the folio during refcount check and prevents incorrect
-large folio detection due to concurrent split/free.  Use helper
-folio_expected_ref_count() + 1 to compare with folio_ref_count() instead
-of using is_refcount_suitable().
-
-Link: https://lkml.kernel.org/r/20250526182818.37978-1-shivankg@amd.com
-Fixes: 05c5323b2a34 ("mm: track mapcount of large folios in single value")
-Signed-off-by: Shivank Garg <shivankg@amd.com>
-Reported-by: syzbot+2b99589e33edbe9475ca@syzkaller.appspotmail.com
-Closes: https://lore.kernel.org/all/6828470d.a70a0220.38f255.000c.GAE@google.com
-Suggested-by: David Hildenbrand <david@redhat.com>
-Acked-by: David Hildenbrand <david@redhat.com>
-Acked-by: Dev Jain <dev.jain@arm.com>
-Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
-Cc: Bharata B Rao <bharata@amd.com>
-Cc: Fengwei Yin <fengwei.yin@intel.com>
-Cc: Liam Howlett <liam.howlett@oracle.com>
-Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
-Cc: Mariano Pache <npache@redhat.com>
-Cc: Ryan Roberts <ryan.roberts@arm.com>
-Cc: Zi Yan <ziy@nvidia.com>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
- mm/khugepaged.c | 18 +++++++++++++++++-
- 1 file changed, 17 insertions(+), 1 deletion(-)
-
--- a/mm/khugepaged.c
-+++ b/mm/khugepaged.c
-@@ -2295,6 +2295,17 @@ static int hpage_collapse_scan_file(stru
- 			continue;
- 		}
- 
-+		if (!folio_try_get(folio)) {
-+			xas_reset(&xas);
-+			continue;
-+		}
-+
-+		if (unlikely(folio != xas_reload(&xas))) {
-+			folio_put(folio);
-+			xas_reset(&xas);
-+			continue;
-+		}
-+
- 		if (folio_order(folio) == HPAGE_PMD_ORDER &&
- 		    folio->index == start) {
- 			/* Maybe PMD-mapped */
-@@ -2305,23 +2316,27 @@ static int hpage_collapse_scan_file(stru
- 			 * it's safe to skip LRU and refcount checks before
- 			 * returning.
- 			 */
-+			folio_put(folio);
- 			break;
- 		}
- 
- 		node = folio_nid(folio);
- 		if (hpage_collapse_scan_abort(node, cc)) {
- 			result = SCAN_SCAN_ABORT;
-+			folio_put(folio);
- 			break;
- 		}
- 		cc->node_load[node]++;
- 
- 		if (!folio_test_lru(folio)) {
- 			result = SCAN_PAGE_LRU;
-+			folio_put(folio);
- 			break;
- 		}
- 
-		if (!is_refcount_suitable(folio)) {
-+		if (folio_expected_ref_count(folio) + 1 != folio_ref_count(folio)) {
- 			result = SCAN_PAGE_COUNT;
-+			folio_put(folio);
- 			break;
- 		}
- 
-@@ -2333,6 +2348,7 @@ static int hpage_collapse_scan_file(stru
- 		 */
- 
- 		present += folio_nr_pages(folio);
-+		folio_put(folio);
- 
- 		if (need_resched()) {
- 			xas_pause(&xas);
--- a/debian/patches/patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch
+++ b/debian/patches/patchset-pf/fixes/0005-mm-add-folio_expected_ref_count-for-reference-count-.patch
@@ -1,198 +0,0 @@
-From 8135974e9e512fdf6d15f59947f95e44f2834c37 Mon Sep 17 00:00:00 2001
-From: Shivank Garg <shivankg@amd.com>
-Date: Wed, 30 Apr 2025 10:01:51 +0000
-Subject: mm: add folio_expected_ref_count() for reference count calculation
-
-Patch series " JFS: Implement migrate_folio for jfs_metapage_aops" v5.
-
-This patchset addresses a warning that occurs during memory compaction due
-to JFS's missing migrate_folio operation.  The warning was introduced by
-commit 7ee3647243e5 ("migrate: Remove call to ->writepage") which added
-explicit warnings when filesystem don't implement migrate_folio.
-
-The syzbot reported following [1]:
-  jfs_metapage_aops does not implement migrate_folio
-  WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 fallback_migrate_folio mm/migrate.c:953 [inline]
-  WARNING: CPU: 1 PID: 5861 at mm/migrate.c:955 move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
-  Modules linked in:
-  CPU: 1 UID: 0 PID: 5861 Comm: syz-executor280 Not tainted 6.15.0-rc1-next-20250411-syzkaller #0 PREEMPT(full)
-  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
-  RIP: 0010:fallback_migrate_folio mm/migrate.c:953 [inline]
-  RIP: 0010:move_to_new_folio+0x70e/0x840 mm/migrate.c:1007
-
-To fix this issue, this series implement metapage_migrate_folio() for JFS
-which handles both single and multiple metapages per page configurations.
-
-While most filesystems leverage existing migration implementations like
-filemap_migrate_folio(), buffer_migrate_folio_norefs() or
-buffer_migrate_folio() (which internally used folio_expected_refs()),
-JFS's metapage architecture requires special handling of its private data
-during migration.  To support this, this series introduce the
-folio_expected_ref_count(), which calculates external references to a
-folio from page/swap cache, private data, and page table mappings.
-
-This standardized implementation replaces the previous ad-hoc
-folio_expected_refs() function and enables JFS to accurately determine
-whether a folio has unexpected references before attempting migration.
-
-
-
-
-Implement folio_expected_ref_count() to calculate expected folio reference
-counts from:
- Page/swap cache (1 per page)
- Private data (1)
- Page table mappings (1 per map)
-
-While originally needed for page migration operations, this improved
-implementation standardizes reference counting by consolidating all
-refcount contributors into a single, reusable function that can benefit
-any subsystem needing to detect unexpected references to folios.
-
-The folio_expected_ref_count() returns the sum of these external
-references without including any reference the caller itself might hold.
-Callers comparing against the actual folio_ref_count() must account for
-their own references separately.
-
-Link: https://syzkaller.appspot.com/bug?extid=8bb6fd945af4e0ad9299 [1]
-Link: https://lkml.kernel.org/r/20250430100150.279751-1-shivankg@amd.com
-Link: https://lkml.kernel.org/r/20250430100150.279751-2-shivankg@amd.com
-Signed-off-by: David Hildenbrand <david@redhat.com>
-Signed-off-by: Shivank Garg <shivankg@amd.com>
-Suggested-by: Matthew Wilcox <willy@infradead.org>
-Co-developed-by: David Hildenbrand <david@redhat.com>
-Cc: Alistair Popple <apopple@nvidia.com>
-Cc: Dave Kleikamp <shaggy@kernel.org>
-Cc: Donet Tom <donettom@linux.ibm.com>
-Cc: Jane Chu <jane.chu@oracle.com>
-Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
-Cc: Zi Yan <ziy@nvidia.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
- include/linux/mm.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++
- mm/migrate.c       | 22 ++++---------------
- 2 files changed, 59 insertions(+), 18 deletions(-)
-
--- a/include/linux/mm.h
-+++ b/include/linux/mm.h
-@@ -2337,6 +2337,61 @@ static inline bool folio_maybe_mapped_sh
- 	return folio_test_large_maybe_mapped_shared(folio);
- }
- 
-+/**
-+ * folio_expected_ref_count - calculate the expected folio refcount
-+ * @folio: the folio
-+ *
-+ * Calculate the expected folio refcount, taking references from the pagecache,
-+ * swapcache, PG_private and page table mappings into account. Useful in
-+ * combination with folio_ref_count() to detect unexpected references (e.g.,
-+ * GUP or other temporary references).
-+ *
-+ * Does currently not consider references from the LRU cache. If the folio
-+ * was isolated from the LRU (which is the case during migration or split),
-+ * the LRU cache does not apply.
-+ *
-+ * Calling this function on an unmapped folio -- !folio_mapped() -- that is
-+ * locked will return a stable result.
-+ *
-+ * Calling this function on a mapped folio will not result in a stable result,
-+ * because nothing stops additional page table mappings from coming (e.g.,
-+ * fork()) or going (e.g., munmap()).
-+ *
-+ * Calling this function without the folio lock will also not result in a
-+ * stable result: for example, the folio might get dropped from the swapcache
-+ * concurrently.
-+ *
-+ * However, even when called without the folio lock or on a mapped folio,
-+ * this function can be used to detect unexpected references early (for example,
-+ * if it makes sense to even lock the folio and unmap it).
-+ *
-+ * The caller must add any reference (e.g., from folio_try_get()) it might be
-+ * holding itself to the result.
-+ *
-+ * Returns the expected folio refcount.
-+ */
-+static inline int folio_expected_ref_count(const struct folio *folio)
-+{
-+	const int order = folio_order(folio);
-+	int ref_count = 0;
-+
-+	if (WARN_ON_ONCE(folio_test_slab(folio)))
-+		return 0;
-+
-+	if (folio_test_anon(folio)) {
-+		/* One reference per page from the swapcache. */
-+		ref_count += folio_test_swapcache(folio) << order;
-+	} else if (!((unsigned long)folio->mapping & PAGE_MAPPING_FLAGS)) {
-+		/* One reference per page from the pagecache. */
-+		ref_count += !!folio->mapping << order;
-+		/* One reference from PG_private. */
-+		ref_count += folio_test_private(folio);
-+	}
-+
-+	/* One reference per page table mapping. */
-+	return ref_count + folio_mapcount(folio);
-+}
-+
- #ifndef HAVE_ARCH_MAKE_FOLIO_ACCESSIBLE
- static inline int arch_make_folio_accessible(struct folio *folio)
- {
--- a/mm/migrate.c
-+++ b/mm/migrate.c
-@@ -445,20 +445,6 @@ unlock:
- }
- #endif
- 
-static int folio_expected_refs(struct address_space *mapping,
-		struct folio *folio)
-{
-	int refs = 1;
-	if (!mapping)
-		return refs;
-
-	refs += folio_nr_pages(folio);
-	if (folio_test_private(folio))
-		refs++;
-
-	return refs;
-}
-
- /*
-  * Replace the folio in the mapping.
-  *
-@@ -601,7 +587,7 @@ static int __folio_migrate_mapping(struc
- int folio_migrate_mapping(struct address_space *mapping,
- 		struct folio *newfolio, struct folio *folio, int extra_count)
- {
-	int expected_count = folio_expected_refs(mapping, folio) + extra_count;
-+	int expected_count = folio_expected_ref_count(folio) + extra_count + 1;
- 
- 	if (folio_ref_count(folio) != expected_count)
- 		return -EAGAIN;
-@@ -618,7 +604,7 @@ int migrate_huge_page_move_mapping(struc
- 				   struct folio *dst, struct folio *src)
- {
- 	XA_STATE(xas, &mapping->i_pages, folio_index(src));
-	int rc, expected_count = folio_expected_refs(mapping, src);
-+	int rc, expected_count = folio_expected_ref_count(src) + 1;
- 
- 	if (folio_ref_count(src) != expected_count)
- 		return -EAGAIN;
-@@ -749,7 +735,7 @@ static int __migrate_folio(struct addres
- 			   struct folio *src, void *src_private,
- 			   enum migrate_mode mode)
- {
-	int rc, expected_count = folio_expected_refs(mapping, src);
-+	int rc, expected_count = folio_expected_ref_count(src) + 1;
- 
- 	/* Check whether src does not have extra refs before we do more work */
- 	if (folio_ref_count(src) != expected_count)
-@@ -837,7 +823,7 @@ static int __buffer_migrate_folio(struct
- 		return migrate_folio(mapping, dst, src, mode);
- 
- 	/* Check whether page does not have extra refs before we do more work */
-	expected_count = folio_expected_refs(mapping, src);
-+	expected_count = folio_expected_ref_count(src) + 1;
- 	if (folio_ref_count(src) != expected_count)
- 		return -EAGAIN;
- 
--- a/debian/patches/patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch
+++ b/debian/patches/patchset-pf/fixes/0006-drm-i915-snps_hdmi_pll-Fix-64-bit-divisor-truncation.patch
@@ -1,40 +0,0 @@
-From 3d1a493525955678c231ab7ccf0950c0ba2b9f45 Mon Sep 17 00:00:00 2001
-From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Date: Fri, 13 Jun 2025 11:42:46 +0530
-Subject: drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using
- div64_u64
-
-DIV_ROUND_CLOSEST_ULL uses do_div(), which expects a 32-bit divisor.
-When passing a 64-bit constant like CURVE2_MULTIPLIER, the value is
-silently truncated to u32, potentially leading to incorrect results
-on large divisors.
-
-Replace DIV_ROUND_CLOSEST_ULL with div64_u64(), which correctly
-handles full 64-bit division. Since the result is clamped between
-1 and 127, rounding is unnecessary and truncating division
-is sufficient.
-
-Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2")
-Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Cc: Suraj Kandpal <suraj.kandpal@intel.com>
-Cc: Jani Nikula <jani.nikula@intel.com>
-Cc: <stable@vger.kernel.org> # v6.15+
-Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Cherry-picked-for: https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues/145
---
- drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
--- a/drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c
-+++ b/drivers/gpu/drm/i915/display/intel_snps_hdmi_pll.c
-@@ -103,8 +103,8 @@ static void get_ana_cp_int_prop(u64 vco_
- 			    DIV_ROUND_DOWN_ULL(curve_1_interpolated, CURVE0_MULTIPLIER)));
- 
- 	ana_cp_int_temp =
-		DIV64_U64_ROUND_CLOSEST(DIV_ROUND_DOWN_ULL(adjusted_vco_clk1, curve_2_scaled1),
-					CURVE2_MULTIPLIER);
-+		div64_u64(DIV_ROUND_DOWN_ULL(adjusted_vco_clk1, curve_2_scaled1),
-+			  CURVE2_MULTIPLIER);
- 
- 	*ana_cp_int = max(1, min(ana_cp_int_temp, 127));
- 
--- a/debian/patches/patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch
+++ b/debian/patches/patchset-pf/fixes/0007-mm-compaction-use-folio-in-hugetlb-pathway.patch
@@ -1,86 +0,0 @@
-From 336152e6ec30b13f5617ee9b702beb5bc310c6a7 Mon Sep 17 00:00:00 2001
-From: "Vishal Moola (Oracle)" <vishal.moola@gmail.com>
-Date: Mon, 31 Mar 2025 19:10:25 -0700
-Subject: mm/compaction: use folio in hugetlb pathway
-
-Use a folio in the hugetlb pathway during the compaction migrate-able
-pageblock scan.
-
-This removes a call to compound_head().
-
-Link: https://lkml.kernel.org/r/20250401021025.637333-2-vishal.moola@gmail.com
-Signed-off-by: Vishal Moola (Oracle) <vishal.moola@gmail.com>
-Acked-by: Oscar Salvador <osalvador@suse.de>
-Reviewed-by: Zi Yan <ziy@nvidia.com>
-Cc: Muchun Song <muchun.song@linux.dev>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
- include/linux/hugetlb.h | 4 ++--
- mm/compaction.c         | 8 ++++----
- mm/hugetlb.c            | 3 +--
- 3 files changed, 7 insertions(+), 8 deletions(-)
-
--- a/include/linux/hugetlb.h
-+++ b/include/linux/hugetlb.h
-@@ -703,7 +703,7 @@ struct huge_bootmem_page {
- 
- bool hugetlb_bootmem_page_zones_valid(int nid, struct huge_bootmem_page *m);
- 
-int isolate_or_dissolve_huge_page(struct page *page, struct list_head *list);
-+int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list);
- int replace_free_hugepage_folios(unsigned long start_pfn, unsigned long end_pfn);
- void wait_for_freed_hugetlb_folios(void);
- struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
-@@ -1091,7 +1091,7 @@ static inline struct folio *filemap_lock
- 	return NULL;
- }
- 
-static inline int isolate_or_dissolve_huge_page(struct page *page,
-+static inline int isolate_or_dissolve_huge_folio(struct folio *folio,
- 						struct list_head *list)
- {
- 	return -ENOMEM;
--- a/mm/compaction.c
-+++ b/mm/compaction.c
-@@ -1001,10 +1001,11 @@ isolate_migratepages_block(struct compac
- 				locked = NULL;
- 			}
- 
-			ret = isolate_or_dissolve_huge_page(page, &cc->migratepages);
-+			folio = page_folio(page);
-+			ret = isolate_or_dissolve_huge_folio(folio, &cc->migratepages);
- 
- 			/*
-			 * Fail isolation in case isolate_or_dissolve_huge_page()
-+			 * Fail isolation in case isolate_or_dissolve_huge_folio()
- 			 * reports an error. In case of -ENOMEM, abort right away.
- 			 */
- 			if (ret < 0) {
-@@ -1016,12 +1017,11 @@ isolate_migratepages_block(struct compac
- 				goto isolate_fail;
- 			}
- 
-			if (PageHuge(page)) {
-+			if (folio_test_hugetlb(folio)) {
- 				/*
- 				 * Hugepage was successfully isolated and placed
- 				 * on the cc->migratepages list.
- 				 */
-				folio = page_folio(page);
- 				low_pfn += folio_nr_pages(folio) - 1;
- 				goto isolate_success_no_list;
- 			}
--- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2896,10 +2896,9 @@ free_new:
- 	return ret;
- }
- 
-int isolate_or_dissolve_huge_page(struct page *page, struct list_head *list)
-+int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list)
- {
- 	struct hstate *h;
-	struct folio *folio = page_folio(page);
- 	int ret = -EBUSY;
- 
- 	/*
--- a/debian/patches/patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch
+++ b/debian/patches/patchset-pf/fixes/0008-mm-hugetlb-remove-unnecessary-holding-of-hugetlb_loc.patch
@@ -1,154 +0,0 @@
-From 2e50b415d59dda319bb3208c5ed5234a23f307e9 Mon Sep 17 00:00:00 2001
-From: Ge Yang <yangge1116@126.com>
-Date: Tue, 27 May 2025 11:36:50 +0800
-Subject: mm/hugetlb: remove unnecessary holding of hugetlb_lock
-
-In isolate_or_dissolve_huge_folio(), after acquiring the hugetlb_lock, it
-is only for the purpose of obtaining the correct hstate, which is then
-passed to alloc_and_dissolve_hugetlb_folio().
-
-alloc_and_dissolve_hugetlb_folio() itself also acquires the hugetlb_lock.
-We can have alloc_and_dissolve_hugetlb_folio() obtain the hstate by
-itself, so that isolate_or_dissolve_huge_folio() no longer needs to
-acquire the hugetlb_lock.  In addition, we keep the folio_test_hugetlb()
-check within isolate_or_dissolve_huge_folio().  By doing so, we can avoid
-disrupting the normal path by vainly holding the hugetlb_lock.
-
-replace_free_hugepage_folios() has the same issue, and we should address
-it as well.
-
-Addresses a possible performance problem which was added by the hotfix
-113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when
-replacing free hugetlb folios").
-
-Link: https://lkml.kernel.org/r/1748317010-16272-1-git-send-email-yangge1116@126.com
-Fixes: 113ed54ad276 ("mm/hugetlb: fix kernel NULL pointer dereference when replacing free hugetlb folios")
-Signed-off-by: Ge Yang <yangge1116@126.com>
-Suggested-by: Oscar Salvador <osalvador@suse.de>
-Reviewed-by: Muchun Song <muchun.song@linux.dev>
-Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
-Cc: Barry Song <21cnbao@gmail.com>
-Cc: David Hildenbrand <david@redhat.com>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
- mm/hugetlb.c | 54 +++++++++++++++++-----------------------------------
- 1 file changed, 17 insertions(+), 37 deletions(-)
-
--- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2811,20 +2811,24 @@ void restore_reserve_on_error(struct hst
- /*
-  * alloc_and_dissolve_hugetlb_folio - Allocate a new folio and dissolve
-  * the old one
- * @h: struct hstate old page belongs to
-  * @old_folio: Old folio to dissolve
-  * @list: List to isolate the page in case we need to
-  * Returns 0 on success, otherwise negated error.
-  */
-static int alloc_and_dissolve_hugetlb_folio(struct hstate *h,
-			struct folio *old_folio, struct list_head *list)
-+static int alloc_and_dissolve_hugetlb_folio(struct folio *old_folio,
-+			struct list_head *list)
- {
-	gfp_t gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE;
-+	gfp_t gfp_mask;
-+	struct hstate *h;
- 	int nid = folio_nid(old_folio);
- 	struct folio *new_folio = NULL;
- 	int ret = 0;
- 
- retry:
-+	/*
-+	 * The old_folio might have been dissolved from under our feet, so make sure
-+	 * to carefully check the state under the lock.
-+	 */
- 	spin_lock_irq(&hugetlb_lock);
- 	if (!folio_test_hugetlb(old_folio)) {
- 		/*
-@@ -2853,8 +2857,10 @@ retry:
- 		cond_resched();
- 		goto retry;
- 	} else {
-+		h = folio_hstate(old_folio);
- 		if (!new_folio) {
- 			spin_unlock_irq(&hugetlb_lock);
-+			gfp_mask = htlb_alloc_mask(h) | __GFP_THISNODE;
- 			new_folio = alloc_buddy_hugetlb_folio(h, gfp_mask, nid,
- 							      NULL, NULL);
- 			if (!new_folio)
-@@ -2898,35 +2904,24 @@ free_new:
- 
- int isolate_or_dissolve_huge_folio(struct folio *folio, struct list_head *list)
- {
-	struct hstate *h;
- 	int ret = -EBUSY;
- 
-	/*
-	 * The page might have been dissolved from under our feet, so make sure
-	 * to carefully check the state under the lock.
-	 * Return success when racing as if we dissolved the page ourselves.
-	 */
-	spin_lock_irq(&hugetlb_lock);
-	if (folio_test_hugetlb(folio)) {
-		h = folio_hstate(folio);
-	} else {
-		spin_unlock_irq(&hugetlb_lock);
-+	/* Not to disrupt normal path by vainly holding hugetlb_lock */
-+	if (!folio_test_hugetlb(folio))
- 		return 0;
-	}
-	spin_unlock_irq(&hugetlb_lock);
- 
- 	/*
- 	 * Fence off gigantic pages as there is a cyclic dependency between
- 	 * alloc_contig_range and them. Return -ENOMEM as this has the effect
- 	 * of bailing out right away without further retrying.
- 	 */
-	if (hstate_is_gigantic(h))
-+	if (folio_order(folio) > MAX_PAGE_ORDER)
- 		return -ENOMEM;
- 
- 	if (folio_ref_count(folio) && folio_isolate_hugetlb(folio, list))
- 		ret = 0;
- 	else if (!folio_ref_count(folio))
-		ret = alloc_and_dissolve_hugetlb_folio(h, folio, list);
-+		ret = alloc_and_dissolve_hugetlb_folio(folio, list);
- 
- 	return ret;
- }
-@@ -2940,7 +2935,6 @@ int isolate_or_dissolve_huge_folio(struc
-  */
- int replace_free_hugepage_folios(unsigned long start_pfn, unsigned long end_pfn)
- {
-	struct hstate *h;
- 	struct folio *folio;
- 	int ret = 0;
- 
-@@ -2949,23 +2943,9 @@ int replace_free_hugepage_folios(unsigne
- 	while (start_pfn < end_pfn) {
- 		folio = pfn_folio(start_pfn);
- 
-		/*
-		 * The folio might have been dissolved from under our feet, so make sure
-		 * to carefully check the state under the lock.
-		 */
-		spin_lock_irq(&hugetlb_lock);
-		if (folio_test_hugetlb(folio)) {
-			h = folio_hstate(folio);
-		} else {
-			spin_unlock_irq(&hugetlb_lock);
-			start_pfn++;
-			continue;
-		}
-		spin_unlock_irq(&hugetlb_lock);
-
-		if (!folio_ref_count(folio)) {
-			ret = alloc_and_dissolve_hugetlb_folio(h, folio,
-							       &isolate_list);
-+		/* Not to disrupt normal path by vainly holding hugetlb_lock */
-+		if (folio_test_hugetlb(folio) && !folio_ref_count(folio)) {
-+			ret = alloc_and_dissolve_hugetlb_folio(folio, &isolate_list);
- 			if (ret)
- 				break;
- 
--- a/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch
+++ b/debian/patches/patchset-pf/fixes/0009-netfs-Provide-helpers-to-perform-NETFS_RREQ_IN_PROGR.patch
@@ -1,136 +0,0 @@
-From b885aa903c313644f7ba8d46d4c09ead1b52f1f1 Mon Sep 17 00:00:00 2001
-From: David Howells <dhowells@redhat.com>
-Date: Tue, 1 Jul 2025 17:38:38 +0100
-Subject: netfs: Provide helpers to perform NETFS_RREQ_IN_PROGRESS flag
- wangling
-
-Provide helpers to clear and test the NETFS_RREQ_IN_PROGRESS and to insert
-the appropriate barrierage.
-
-Signed-off-by: David Howells <dhowells@redhat.com>
-Link: https://lore.kernel.org/20250701163852.2171681-4-dhowells@redhat.com
-Tested-by: Steve French <sfrench@samba.org>
-Reviewed-by: Paulo Alcantara <pc@manguebit.org>
-cc: netfs@lists.linux.dev
-cc: linux-fsdevel@vger.kernel.org
-Signed-off-by: Christian Brauner <brauner@kernel.org>
---
- fs/netfs/internal.h      | 18 ++++++++++++++++++
- fs/netfs/misc.c          | 10 +++++-----
- fs/netfs/read_collect.c  |  4 ++--
- fs/netfs/write_collect.c |  4 ++--
- 4 files changed, 27 insertions(+), 9 deletions(-)
-
--- a/fs/netfs/internal.h
-+++ b/fs/netfs/internal.h
-@@ -275,6 +275,24 @@ static inline void netfs_wake_rreq_flag(
- }
- 
- /*
-+ * Test the NETFS_RREQ_IN_PROGRESS flag, inserting an appropriate barrier.
-+ */
-+static inline bool netfs_check_rreq_in_progress(const struct netfs_io_request *rreq)
-+{
-+	/* Order read of flags before read of anything else, such as error. */
-+	return test_bit_acquire(NETFS_RREQ_IN_PROGRESS, &rreq->flags);
-+}
-+
-+/*
-+ * Test the NETFS_SREQ_IN_PROGRESS flag, inserting an appropriate barrier.
-+ */
-+static inline bool netfs_check_subreq_in_progress(const struct netfs_io_subrequest *subreq)
-+{
-+	/* Order read of flags before read of anything else, such as error. */
-+	return test_bit_acquire(NETFS_SREQ_IN_PROGRESS, &subreq->flags);
-+}
-+
-+/*
-  * fscache-cache.c
-  */
- #ifdef CONFIG_PROC_FS
--- a/fs/netfs/misc.c
-+++ b/fs/netfs/misc.c
-@@ -356,14 +356,14 @@ void netfs_wait_for_in_progress_stream(s
- 	DEFINE_WAIT(myself);
- 
- 	list_for_each_entry(subreq, &stream->subrequests, rreq_link) {
-		if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags))
-+		if (!netfs_check_subreq_in_progress(subreq))
- 			continue;
- 
- 		trace_netfs_rreq(rreq, netfs_rreq_trace_wait_queue);
- 		for (;;) {
- 			prepare_to_wait(&rreq->waitq, &myself, TASK_UNINTERRUPTIBLE);
- 
-			if (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags))
-+			if (!netfs_check_subreq_in_progress(subreq))
- 				break;
- 
- 			trace_netfs_sreq(subreq, netfs_sreq_trace_wait_for);
-@@ -400,7 +400,7 @@ static int netfs_collect_in_app(struct n
- 						  struct netfs_io_subrequest,
- 						  rreq_link);
- 		if (subreq &&
-		    (!test_bit(NETFS_SREQ_IN_PROGRESS, &subreq->flags) ||
-+		    (!netfs_check_subreq_in_progress(subreq) ||
- 		     test_bit(NETFS_SREQ_MADE_PROGRESS, &subreq->flags))) {
- 			need_collect = true;
- 			break;
-@@ -454,7 +454,7 @@ static ssize_t netfs_wait_for_in_progres
- 			}
- 		}
- 
-		if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags))
-+		if (!netfs_check_rreq_in_progress(rreq))
- 			break;
- 
- 		schedule();
-@@ -525,7 +525,7 @@ static void netfs_wait_for_pause(struct
- 			}
- 		}
- 
-		if (!test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags) ||
-+		if (!netfs_check_rreq_in_progress(rreq) ||
- 		    !test_bit(NETFS_RREQ_PAUSE, &rreq->flags))
- 			break;
- 
--- a/fs/netfs/read_collect.c
-+++ b/fs/netfs/read_collect.c
-@@ -220,7 +220,7 @@ reassess:
- 			stream->collected_to = front->start;
- 		}
- 
-		if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags))
-+		if (netfs_check_subreq_in_progress(front))
- 			notes |= HIT_PENDING;
- 		smp_rmb(); /* Read counters after IN_PROGRESS flag. */
- 		transferred = READ_ONCE(front->transferred);
-@@ -447,7 +447,7 @@ void netfs_read_collection_worker(struct
- 	struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work);
- 
- 	netfs_see_request(rreq, netfs_rreq_trace_see_work);
-	if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) {
-+	if (netfs_check_rreq_in_progress(rreq)) {
- 		if (netfs_read_collection(rreq))
- 			/* Drop the ref from the IN_PROGRESS flag. */
- 			netfs_put_request(rreq, netfs_rreq_trace_put_work_ip);
--- a/fs/netfs/write_collect.c
-+++ b/fs/netfs/write_collect.c
-@@ -240,7 +240,7 @@ reassess_streams:
- 			}
- 
- 			/* Stall if the front is still undergoing I/O. */
-			if (test_bit(NETFS_SREQ_IN_PROGRESS, &front->flags)) {
-+			if (netfs_check_subreq_in_progress(front)) {
- 				notes |= HIT_PENDING;
- 				break;
- 			}
-@@ -434,7 +434,7 @@ void netfs_write_collection_worker(struc
- 	struct netfs_io_request *rreq = container_of(work, struct netfs_io_request, work);
- 
- 	netfs_see_request(rreq, netfs_rreq_trace_see_work);
-	if (test_bit(NETFS_RREQ_IN_PROGRESS, &rreq->flags)) {
-+	if (netfs_check_rreq_in_progress(rreq)) {
- 		if (netfs_write_collection(rreq))
- 			/* Drop the ref from the IN_PROGRESS flag. */
- 			netfs_put_request(rreq, netfs_rreq_trace_put_work_ip);
--- a/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch
+++ b/debian/patches/patchset-pf/kbuild/0001-ice-mark-ice_write_prof_mask_reg-as-noinline.patch
@@ -1,4 +1,4 @@
-From 3400d11fad849dae6015e448c83d6e90f8a6ef35 Mon Sep 17 00:00:00 2001
+From cb67be41cf8b19fed3b1cc08a42417aa1c7550e0 Mon Sep 17 00:00:00 2001
 From: Oleksandr Natalenko <oleksandr@natalenko.name>
 Date: Tue, 8 Apr 2025 12:02:36 +0200
 Subject: ice: mark ice_write_prof_mask_reg() as noinline
--- a/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch
+++ b/debian/patches/patchset-pf/kbuild/0002-wifi-mac80211-mark-copy_mesh_setup-as-noinline.patch
@@ -1,4 +1,4 @@
-From 1615cc0c7d979a1c211f349c8c28ee8afb9ad57d Mon Sep 17 00:00:00 2001
+From a3c672256ccc59b07f007b569e1e7507b0a82dce Mon Sep 17 00:00:00 2001
 From: Oleksandr Natalenko <oleksandr@natalenko.name>
 Date: Thu, 1 May 2025 20:22:53 +0200
 Subject: wifi: mac80211: mark copy_mesh_setup() as noinline
@@ -24,7 +24,7 @@ Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name>

 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2515,7 +2515,7 @@ static inline bool _chg_mesh_attr(enum n
+@@ -2539,7 +2539,7 @@ static inline bool _chg_mesh_attr(enum n
 	return (mask >> (parm-1)) & 0x1;
 }
 
--- a/debian/patches/patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch
+++ b/debian/patches/patchset-pf/steady/0001-PCI-Fix-link-speed-calculation-on-retrain-failure.patch
@@ -0,0 +1,91 @@
+From e9efb8c2e0d662c1d28a95732f0a085e81c365ab Mon Sep 17 00:00:00 2001
+From: Jiwei Sun <sunjw10@lenovo.com>
+Date: Thu, 23 Jan 2025 13:51:54 +0800
+Subject: PCI: Fix link speed calculation on retrain failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When pcie_failed_link_retrain() fails to retrain, it tries to revert to the
+previous link speed.  However it calculates that speed from the Link
+Control 2 register without masking out non-speed bits first.
+
+PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to
+PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in
+pcie_set_target_speed():
+
+  pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port
+  pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s
+  pci 0000:00:01.1: retraining failed
+  WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed
+  RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000
+  pcie_failed_link_retrain
+  pci_device_add
+  pci_scan_single_device
+
+Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and
+PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN.
+
+Fixes: de9a6c8d5dbf ("PCI/bwctrl: Add pcie_set_target_speed() to set PCIe Link Speed")
+Reported-by: Andrew <andreasx0@protonmail.com>
+Closes: https://lore.kernel.org/r/7iNzXbCGpf8yUMJZBQjLdbjPcXrEJqBxy5-bHfppz0ek-h4_-G93b1KUrm106r2VNF2FV_sSq0nENv4RsRIUGnlYZMlQr2ZD2NyB5sdj5aU=@protonmail.com/
+Suggested-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Jiwei Sun <sunjw10@lenovo.com>
+[bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Cc: stable@vger.kernel.org	# v6.13+
+Link: https://patch.msgid.link/20250123055155.22648-2-sjiwei@163.com
+---
+ drivers/pci/pci.h | 32 +++++++++++++++++++-------------
+ 1 file changed, 19 insertions(+), 13 deletions(-)
+
+--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
+@@ -391,12 +391,14 @@ void pci_bus_put(struct pci_bus *bus);
+ 
+ #define PCIE_LNKCAP_SLS2SPEED(lnkcap)					\
+ ({									\
+-	((lnkcap) == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT :	\
+-	 (lnkcap) == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT :	\
+-	 (lnkcap) == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT :	\
+-	 (lnkcap) == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT :	\
+-	 (lnkcap) == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT :	\
+-	 (lnkcap) == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT :	\
+	u32 lnkcap_sls = (lnkcap) & PCI_EXP_LNKCAP_SLS;			\
+									\
+	(lnkcap_sls == PCI_EXP_LNKCAP_SLS_64_0GB ? PCIE_SPEED_64_0GT :	\
+	 lnkcap_sls == PCI_EXP_LNKCAP_SLS_32_0GB ? PCIE_SPEED_32_0GT :	\
+	 lnkcap_sls == PCI_EXP_LNKCAP_SLS_16_0GB ? PCIE_SPEED_16_0GT :	\
+	 lnkcap_sls == PCI_EXP_LNKCAP_SLS_8_0GB ? PCIE_SPEED_8_0GT :	\
+	 lnkcap_sls == PCI_EXP_LNKCAP_SLS_5_0GB ? PCIE_SPEED_5_0GT :	\
+	 lnkcap_sls == PCI_EXP_LNKCAP_SLS_2_5GB ? PCIE_SPEED_2_5GT :	\
+ 	 PCI_SPEED_UNKNOWN);						\
+ })
+ 
+@@ -411,13 +413,17 @@ void pci_bus_put(struct pci_bus *bus);
+ 	 PCI_SPEED_UNKNOWN)
+ 
+ #define PCIE_LNKCTL2_TLS2SPEED(lnkctl2) \
+-	((lnkctl2) == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT : \
+-	 (lnkctl2) == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT : \
+-	 (lnkctl2) == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT : \
+-	 (lnkctl2) == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT : \
+-	 (lnkctl2) == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT : \
+-	 (lnkctl2) == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT : \
+-	 PCI_SPEED_UNKNOWN)
+({									\
+	u16 lnkctl2_tls = (lnkctl2) & PCI_EXP_LNKCTL2_TLS;		\
+									\
+	(lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_64_0GT ? PCIE_SPEED_64_0GT :	\
+	 lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_32_0GT ? PCIE_SPEED_32_0GT :	\
+	 lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_16_0GT ? PCIE_SPEED_16_0GT :	\
+	 lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_8_0GT ? PCIE_SPEED_8_0GT :	\
+	 lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_5_0GT ? PCIE_SPEED_5_0GT :	\
+	 lnkctl2_tls == PCI_EXP_LNKCTL2_TLS_2_5GT ? PCIE_SPEED_2_5GT :	\
+	 PCI_SPEED_UNKNOWN);						\
+})
+ 
+ /* PCIe speed to Mb/s reduced by encoding overhead */
+ #define PCIE_SPEED2MBS_ENC(speed) \
--- a/debian/patches/patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch
+++ b/debian/patches/patchset-pf/steady/0002-PCI-endpoint-Fix-configfs-group-list-head-handling.patch
@@ -0,0 +1,57 @@
+From ab8a3c32946686d57d720dc4a1b23635fb4a39bd Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 24 Jun 2025 20:45:43 +0900
+Subject: PCI: endpoint: Fix configfs group list head handling
+
+Doing a list_del() on the epf_group field of struct pci_epf_driver in
+pci_epf_remove_cfs() is not correct as this field is a list head, not
+a list entry. This list_del() call triggers a KASAN warning when an
+endpoint function driver which has a configfs attribute group is torn
+down:
+
+==================================================================
+BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198
+Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319
+
+CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE
+Hardware name: Radxa ROCK 5B (DT)
+Call trace:
+show_stack+0x2c/0x84 (C)
+dump_stack_lvl+0x70/0x98
+print_report+0x17c/0x538
+kasan_report+0xb8/0x190
+__asan_report_store8_noabort+0x20/0x2c
+pci_epf_remove_cfs+0x17c/0x198
+pci_epf_unregister_driver+0x18/0x30
+nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf]
+__arm64_sys_delete_module+0x264/0x424
+invoke_syscall+0x70/0x260
+el0_svc_common.constprop.0+0xac/0x230
+do_el0_svc+0x40/0x58
+el0_svc+0x48/0xdc
+el0t_64_sync_handler+0x10c/0x138
+el0t_64_sync+0x198/0x19c
+...
+
+Remove this incorrect list_del() call from pci_epf_remove_cfs().
+
+Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry")
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250624114544.342159-2-dlemoal@kernel.org
+---
+ drivers/pci/endpoint/pci-epf-core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
+@@ -338,7 +338,6 @@ static void pci_epf_remove_cfs(struct pc
+ 	mutex_lock(&pci_epf_mutex);
+ 	list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry)
+ 		pci_ep_cfs_remove_epf_group(group);
+-	list_del(&driver->epf_group);
+ 	mutex_unlock(&pci_epf_mutex);
+ }
+ 
--- a/debian/patches/patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch
+++ b/debian/patches/patchset-pf/steady/0003-PCI-endpoint-Fix-configfs-group-removal-on-driver-te.patch
@@ -0,0 +1,48 @@
+From ac49c252132396b1910ea5aad0541f550c55679c Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 24 Jun 2025 20:45:44 +0900
+Subject: PCI: endpoint: Fix configfs group removal on driver teardown
+
+An endpoint driver configfs attributes group is added to the
+epf_group list of struct pci_epf_driver by pci_epf_add_cfs() but an
+added group is not removed from this list when the attribute group is
+unregistered with pci_ep_cfs_remove_epf_group().
+
+Add the missing list_del() call in pci_ep_cfs_remove_epf_group()
+to correctly remove the attribute group from the driver list.
+
+With this change, once the loop over all attribute groups in
+pci_epf_remove_cfs() completes, the driver epf_group list should be
+empty. Add a WARN_ON() to make sure of that.
+
+Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry")
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Niklas Cassel <cassel@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20250624114544.342159-3-dlemoal@kernel.org
+---
+ drivers/pci/endpoint/pci-ep-cfs.c   | 1 +
+ drivers/pci/endpoint/pci-epf-core.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/pci/endpoint/pci-ep-cfs.c
+++ b/drivers/pci/endpoint/pci-ep-cfs.c
+@@ -691,6 +691,7 @@ void pci_ep_cfs_remove_epf_group(struct
+ 	if (IS_ERR_OR_NULL(group))
+ 		return;
+ 
+	list_del(&group->group_entry);
+ 	configfs_unregister_default_group(group);
+ }
+ EXPORT_SYMBOL(pci_ep_cfs_remove_epf_group);
+--- a/drivers/pci/endpoint/pci-epf-core.c
+++ b/drivers/pci/endpoint/pci-epf-core.c
+@@ -338,6 +338,7 @@ static void pci_epf_remove_cfs(struct pc
+ 	mutex_lock(&pci_epf_mutex);
+ 	list_for_each_entry_safe(group, tmp, &driver->epf_group, group_entry)
+ 		pci_ep_cfs_remove_epf_group(group);
+	WARN_ON(!list_empty(&driver->epf_group));
+ 	mutex_unlock(&pci_epf_mutex);
+ }
+ 
--- a/debian/patches/patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch
+++ b/debian/patches/patchset-pf/steady/0004-media-v4l2-ctrls-Don-t-reset-handler-s-error-in-v4l2.patch
@@ -0,0 +1,40 @@
+From bb8fada608c868a04288371c76dd387bb9ce5101 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+Date: Thu, 8 May 2025 18:55:38 +0300
+Subject: media: v4l2-ctrls: Don't reset handler's error in
+ v4l2_ctrl_handler_free()
+
+It's a common pattern in drivers to free the control handler's resources
+and then return the handler's error code on drivers' error handling paths.
+Alas, the v4l2_ctrl_handler_free() function also zeroes the error field,
+effectively indicating successful return to the caller.
+
+There's no apparent need to touch the error field while releasing the
+control handler's resources and cleaning up stale pointers. Not touching
+the handler's error field is a more certain way to address this problem
+than changing all the users, in which case the pattern would be likely to
+re-emerge in new drivers.
+
+Do just that, don't touch the control handler's error field in
+v4l2_ctrl_handler_free().
+
+Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+---
+ drivers/media/v4l2-core/v4l2-ctrls-core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/v4l2-ctrls-core.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls-core.c
+@@ -1661,7 +1661,6 @@ void v4l2_ctrl_handler_free(struct v4l2_
+ 	kvfree(hdl->buckets);
+ 	hdl->buckets = NULL;
+ 	hdl->cached = NULL;
+-	hdl->error = 0;
+ 	mutex_unlock(hdl->lock);
+ 	mutex_destroy(&hdl->_lock);
+ }
--- a/debian/patches/patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch
+++ b/debian/patches/patchset-pf/steady/0005-dm-dm-crypt-Do-not-partially-accept-write-BIOs-with-.patch
@@ -0,0 +1,145 @@
+From e90295abea9dd31f84e7784e19e988be0dfcfb83 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 25 Jun 2025 18:33:26 +0900
+Subject: dm: dm-crypt: Do not partially accept write BIOs with zoned targets
+
+Read and write operations issued to a dm-crypt target may be split
+according to the dm-crypt internal limits defined by the max_read_size
+and max_write_size module parameters (default is 128 KB). The intent is
+to improve processing time of large BIOs by splitting them into smaller
+operations that can be parallelized on different CPUs.
+
+For zoned dm-crypt targets, this BIO splitting is still done but without
+the parallel execution to ensure that the issuing order of write
+operations to the underlying devices remains sequential. However, the
+splitting itself causes other problems:
+
+1) Since dm-crypt relies on the block layer zone write plugging to
+   handle zone append emulation using regular write operations, the
+   reminder of a split write BIO will always be plugged into the target
+   zone write plugged. Once the on-going write BIO finishes, this
+   reminder BIO is unplugged and issued from the zone write plug work.
+   If this reminder BIO itself needs to be split, the reminder will be
+   re-issued and plugged again, but that causes a call to a
+   blk_queue_enter(), which may block if a queue freeze operation was
+   initiated. This results in a deadlock as DM submission still holds
+   BIOs that the queue freeze side is waiting for.
+
+2) dm-crypt relies on the emulation done by the block layer using
+   regular write operations for processing zone append operations. This
+   still requires to properly return the written sector as the BIO
+   sector of the original BIO. However, this can be done correctly only
+   and only if there is a single clone BIO used for processing the
+   original zone append operation issued by the user. If the size of a
+   zone append operation is larger than dm-crypt max_write_size, then
+   the orginal BIO will be split and processed as a chain of regular
+   write operations. Such chaining result in an incorrect written sector
+   being returned to the zone append issuer using the original BIO
+   sector.  This in turn results in file system data corruptions using
+   xfs or btrfs.
+
+Fix this by modifying get_max_request_size() to always return the size
+of the BIO to avoid it being split with dm_accpet_partial_bio() in
+crypt_map(). get_max_request_size() is renamed to
+get_max_request_sectors() to clarify the unit of the value returned
+and its interface is changed to take a struct dm_target pointer and a
+pointer to the struct bio being processed. In addition to this change,
+to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt
+device max_hw_sectors limit to be at most
+BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture).
+This forces DM core to split write BIOs before passing them to
+crypt_map(), and thus guaranteeing that dm-crypt can always accept an
+entire write BIO without needing to split it.
+
+This change does not have any effect on the read path of dm-crypt. Read
+operations can still be split and the BIO fragments processed in
+parallel. There is also no impact on the performance of the write path
+given that all zone write BIOs were already processed inline instead of
+in parallel.
+
+This change also does not affect in any way regular dm-crypt block
+devices.
+
+Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Link: https://lore.kernel.org/r/20250625093327.548866-5-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ drivers/md/dm-crypt.c | 49 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 39 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
+@@ -253,17 +253,35 @@ MODULE_PARM_DESC(max_read_size, "Maximum
+ static unsigned int max_write_size = 0;
+ module_param(max_write_size, uint, 0644);
+ MODULE_PARM_DESC(max_write_size, "Maximum size of a write request");
+-static unsigned get_max_request_size(struct crypt_config *cc, bool wrt)
+
+static unsigned get_max_request_sectors(struct dm_target *ti, struct bio *bio)
+ {
+	struct crypt_config *cc = ti->private;
+ 	unsigned val, sector_align;
+-	val = !wrt ? READ_ONCE(max_read_size) : READ_ONCE(max_write_size);
+-	if (likely(!val))
+-		val = !wrt ? DM_CRYPT_DEFAULT_MAX_READ_SIZE : DM_CRYPT_DEFAULT_MAX_WRITE_SIZE;
+-	if (wrt || cc->used_tag_size) {
+-		if (unlikely(val > BIO_MAX_VECS << PAGE_SHIFT))
+-			val = BIO_MAX_VECS << PAGE_SHIFT;
+	bool wrt = op_is_write(bio_op(bio));
+
+	if (wrt) {
+		/*
+		 * For zoned devices, splitting write operations creates the
+		 * risk of deadlocking queue freeze operations with zone write
+		 * plugging BIO work when the reminder of a split BIO is
+		 * issued. So always allow the entire BIO to proceed.
+		 */
+		if (ti->emulate_zone_append)
+			return bio_sectors(bio);
+
+		val = min_not_zero(READ_ONCE(max_write_size),
+				   DM_CRYPT_DEFAULT_MAX_WRITE_SIZE);
+	} else {
+		val = min_not_zero(READ_ONCE(max_read_size),
+				   DM_CRYPT_DEFAULT_MAX_READ_SIZE);
+ 	}
+-	sector_align = max(bdev_logical_block_size(cc->dev->bdev), (unsigned)cc->sector_size);
+
+	if (wrt || cc->used_tag_size)
+		val = min(val, BIO_MAX_VECS << PAGE_SHIFT);
+
+	sector_align = max(bdev_logical_block_size(cc->dev->bdev),
+			   (unsigned)cc->sector_size);
+ 	val = round_down(val, sector_align);
+ 	if (unlikely(!val))
+ 		val = sector_align;
+@@ -3496,7 +3514,7 @@ static int crypt_map(struct dm_target *t
+ 	/*
+ 	 * Check if bio is too large, split as needed.
+ 	 */
+-	max_sectors = get_max_request_size(cc, bio_data_dir(bio) == WRITE);
+	max_sectors = get_max_request_sectors(ti, bio);
+ 	if (unlikely(bio_sectors(bio) > max_sectors))
+ 		dm_accept_partial_bio(bio, max_sectors);
+ 
+@@ -3733,6 +3751,17 @@ static void crypt_io_hints(struct dm_tar
+ 		max_t(unsigned int, limits->physical_block_size, cc->sector_size);
+ 	limits->io_min = max_t(unsigned int, limits->io_min, cc->sector_size);
+ 	limits->dma_alignment = limits->logical_block_size - 1;
+
+	/*
+	 * For zoned dm-crypt targets, there will be no internal splitting of
+	 * write BIOs to avoid exceeding BIO_MAX_VECS vectors per BIO. But
+	 * without respecting this limit, crypt_alloc_buffer() will trigger a
+	 * BUG(). Avoid this by forcing DM core to split write BIOs to this
+	 * limit.
+	 */
+	if (ti->emulate_zone_append)
+		limits->max_hw_sectors = min(limits->max_hw_sectors,
+					     BIO_MAX_VECS << PAGE_SECTORS_SHIFT);
+ }
+ 
+ static struct target_type crypt_target = {
--- a/debian/patches/patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch
+++ b/debian/patches/patchset-pf/steady/0006-dm-Check-for-forbidden-splitting-of-zone-write-opera.patch
@@ -0,0 +1,62 @@
+From 32eefb128e8ca539632595379da05e5662b72161 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Wed, 25 Jun 2025 18:33:27 +0900
+Subject: dm: Check for forbidden splitting of zone write operations
+
+DM targets must not split zone append and write operations using
+dm_accept_partial_bio() as doing so is forbidden for zone append BIOs,
+breaks zone append emulation using regular write BIOs and potentially
+creates deadlock situations with queue freeze operations.
+
+Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all
+these cases, that is, check that the BIO is a write or write zeroes
+operation. This change packs all the zone related checks together under
+a static_branch_unlikely(&zoned_enabled) and done only if the target is
+a zoned device.
+
+Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Link: https://lore.kernel.org/r/20250625093327.548866-6-dlemoal@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ drivers/md/dm.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
+@@ -1293,8 +1293,9 @@ out:
+ /*
+  * A target may call dm_accept_partial_bio only from the map routine.  It is
+  * allowed for all bio types except REQ_PREFLUSH, REQ_OP_ZONE_* zone management
+- * operations, REQ_OP_ZONE_APPEND (zone append writes) and any bio serviced by
+- * __send_duplicate_bios().
+ * operations, zone append writes (native with REQ_OP_ZONE_APPEND or emulated
+ * with write BIOs flagged with BIO_EMULATES_ZONE_APPEND) and any bio serviced
+ * by __send_duplicate_bios().
+  *
+  * dm_accept_partial_bio informs the dm that the target only wants to process
+  * additional n_sectors sectors of the bio and the rest of the data should be
+@@ -1327,11 +1328,19 @@ void dm_accept_partial_bio(struct bio *b
+ 	unsigned int bio_sectors = bio_sectors(bio);
+ 
+ 	BUG_ON(dm_tio_flagged(tio, DM_TIO_IS_DUPLICATE_BIO));
+-	BUG_ON(op_is_zone_mgmt(bio_op(bio)));
+-	BUG_ON(bio_op(bio) == REQ_OP_ZONE_APPEND);
+ 	BUG_ON(bio_sectors > *tio->len_ptr);
+ 	BUG_ON(n_sectors > bio_sectors);
+ 
+	if (static_branch_unlikely(&zoned_enabled) &&
+	    unlikely(bdev_is_zoned(bio->bi_bdev))) {
+		enum req_op op = bio_op(bio);
+
+		BUG_ON(op_is_zone_mgmt(op));
+		BUG_ON(op == REQ_OP_WRITE);
+		BUG_ON(op == REQ_OP_WRITE_ZEROES);
+		BUG_ON(op == REQ_OP_ZONE_APPEND);
+	}
+
+ 	*tio->len_ptr -= bio_sectors - n_sectors;
+ 	bio->bi_iter.bi_size = n_sectors << SECTOR_SHIFT;
+ 
--- a/debian/patches/patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch
+++ b/debian/patches/patchset-pf/steady/0007-mtd-spi-nor-Fix-spi_nor_try_unlock_all.patch
@@ -0,0 +1,110 @@
+From 457eadbe8b4399d1c64d99536f5a2029f5e793d6 Mon Sep 17 00:00:00 2001
+From: Michael Walle <mwalle@kernel.org>
+Date: Tue, 1 Jul 2025 16:04:26 +0200
+Subject: mtd: spi-nor: Fix spi_nor_try_unlock_all()
+
+Commit ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()")
+moved all initialization of the mtd fields at the end of spi_nor_scan().
+Normally, the mtd info is only needed for the mtd ops on the device,
+with one exception: spi_nor_try_unlock_all(), which will also make use
+of the mtd->size parameter. With that commit, the size will always be
+zero because it is not initialized. Fix that by not using the size of
+the mtd_info struct, but use the size from struct spi_nor_flash_parameter.
+
+Fixes: ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()")
+Cc: stable@vger.kernel.org
+Reported-by: Jean-Marc Ranger <jmranger@hotmail.com>
+Closes: https://lore.kernel.org/all/DM6PR06MB561177323DC5207E34AF2A06C547A@DM6PR06MB5611.namprd06.prod.outlook.com/
+Tested-by: Jean-Marc Ranger <jmranger@hotmail.com>
+Signed-off-by: Michael Walle <mwalle@kernel.org>
+Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
+Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
+Link: https://lore.kernel.org/r/20250701140426.2355182-1-mwalle@kernel.org
+---
+ drivers/mtd/spi-nor/swp.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/mtd/spi-nor/swp.c
+++ b/drivers/mtd/spi-nor/swp.c
+@@ -56,7 +56,6 @@ static u64 spi_nor_get_min_prot_length_s
+ static void spi_nor_get_locked_range_sr(struct spi_nor *nor, u8 sr, loff_t *ofs,
+ 					u64 *len)
+ {
+-	struct mtd_info *mtd = &nor->mtd;
+ 	u64 min_prot_len;
+ 	u8 mask = spi_nor_get_sr_bp_mask(nor);
+ 	u8 tb_mask = spi_nor_get_sr_tb_mask(nor);
+@@ -77,13 +76,13 @@ static void spi_nor_get_locked_range_sr(
+ 	min_prot_len = spi_nor_get_min_prot_length_sr(nor);
+ 	*len = min_prot_len << (bp - 1);
+ 
+-	if (*len > mtd->size)
+-		*len = mtd->size;
+	if (*len > nor->params->size)
+		*len = nor->params->size;
+ 
+ 	if (nor->flags & SNOR_F_HAS_SR_TB && sr & tb_mask)
+ 		*ofs = 0;
+ 	else
+-		*ofs = mtd->size - *len;
+		*ofs = nor->params->size - *len;
+ }
+ 
+ /*
+@@ -158,7 +157,6 @@ static bool spi_nor_is_unlocked_sr(struc
+  */
+ static int spi_nor_sr_lock(struct spi_nor *nor, loff_t ofs, u64 len)
+ {
+-	struct mtd_info *mtd = &nor->mtd;
+ 	u64 min_prot_len;
+ 	int ret, status_old, status_new;
+ 	u8 mask = spi_nor_get_sr_bp_mask(nor);
+@@ -183,7 +181,7 @@ static int spi_nor_sr_lock(struct spi_no
+ 		can_be_bottom = false;
+ 
+ 	/* If anything above us is unlocked, we can't use 'top' protection */
+-	if (!spi_nor_is_locked_sr(nor, ofs + len, mtd->size - (ofs + len),
+	if (!spi_nor_is_locked_sr(nor, ofs + len, nor->params->size - (ofs + len),
+ 				  status_old))
+ 		can_be_top = false;
+ 
+@@ -195,11 +193,11 @@ static int spi_nor_sr_lock(struct spi_no
+ 
+ 	/* lock_len: length of region that should end up locked */
+ 	if (use_top)
+-		lock_len = mtd->size - ofs;
+		lock_len = nor->params->size - ofs;
+ 	else
+ 		lock_len = ofs + len;
+ 
+-	if (lock_len == mtd->size) {
+	if (lock_len == nor->params->size) {
+ 		val = mask;
+ 	} else {
+ 		min_prot_len = spi_nor_get_min_prot_length_sr(nor);
+@@ -248,7 +246,6 @@ static int spi_nor_sr_lock(struct spi_no
+  */
+ static int spi_nor_sr_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
+ {
+-	struct mtd_info *mtd = &nor->mtd;
+ 	u64 min_prot_len;
+ 	int ret, status_old, status_new;
+ 	u8 mask = spi_nor_get_sr_bp_mask(nor);
+@@ -273,7 +270,7 @@ static int spi_nor_sr_unlock(struct spi_
+ 		can_be_top = false;
+ 
+ 	/* If anything above us is locked, we can't use 'bottom' protection */
+-	if (!spi_nor_is_unlocked_sr(nor, ofs + len, mtd->size - (ofs + len),
+	if (!spi_nor_is_unlocked_sr(nor, ofs + len, nor->params->size - (ofs + len),
+ 				    status_old))
+ 		can_be_bottom = false;
+ 
+@@ -285,7 +282,7 @@ static int spi_nor_sr_unlock(struct spi_
+ 
+ 	/* lock_len: length of region that should remain locked */
+ 	if (use_top)
+-		lock_len = mtd->size - (ofs + len);
+		lock_len = nor->params->size - (ofs + len);
+ 	else
+ 		lock_len = ofs;
+ 
--- a/debian/patches/patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch
+++ b/debian/patches/patchset-pf/steady/0008-readahead-fix-return-value-of-page_cache_next_miss-w.patch
@@ -0,0 +1,40 @@
+From dd30d1837412d22457fc47562da3e4ae9c7d70ae Mon Sep 17 00:00:00 2001
+From: Chi Zhiling <chizhiling@kylinos.cn>
+Date: Thu, 5 Jun 2025 13:49:35 +0800
+Subject: readahead: fix return value of page_cache_next_miss() when no hole is
+ found
+
+max_scan in page_cache_next_miss always decreases to zero when no hole is
+found, causing the return value to be index + 0.
+
+Fix this by preserving the max_scan value throughout the loop.
+
+Jan said "From what I know and have seen in the past, wrong responses
+from page_cache_next_miss() can lead to readahead window reduction and
+thus reduced read speeds."
+
+Link: https://lkml.kernel.org/r/20250605054935.2323451-1-chizhiling@163.com
+Fixes: 901a269ff3d5 ("filemap: fix page_cache_next_miss() when no hole found")
+Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: Josef Bacik <josef@toxicpanda.com>
+Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/filemap.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/filemap.c
+++ b/mm/filemap.c
+@@ -1778,8 +1778,9 @@ pgoff_t page_cache_next_miss(struct addr
+ 			     pgoff_t index, unsigned long max_scan)
+ {
+ 	XA_STATE(xas, &mapping->i_pages, index);
+	unsigned long nr = max_scan;
+ 
+-	while (max_scan--) {
+	while (nr--) {
+ 		void *entry = xas_next(&xas);
+ 		if (!entry || xa_is_value(entry))
+ 			return xas.xa_index;
--- a/debian/patches/patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch
+++ b/debian/patches/patchset-pf/steady/0009-PM-runtime-Take-active-children-into-account-in-pm_r.patch
@@ -0,0 +1,77 @@
+From 143c76ac94eddb9c2cb5ff4f57d78f60e22d9e20 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 9 Jul 2025 12:41:45 +0200
+Subject: PM: runtime: Take active children into account in
+ pm_runtime_get_if_in_use()
+
+For all practical purposes, there is no difference between the situation
+in which a given device is not ignoring children and its active child
+count is nonzero and the situation in which its runtime PM usage counter
+is nonzero.  However, pm_runtime_get_if_in_use() will only increment the
+device's usage counter and return 1 in the latter case.
+
+For consistency, make it do so in the former case either by adjusting
+pm_runtime_get_conditional() and update the related kerneldoc comments
+accordingly.
+
+Fixes: c111566bea7c ("PM: runtime: Add pm_runtime_get_if_active()")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Cc: 5.10+ <stable@vger.kernel.org> # 5.10+: c0ef3df8dbae: PM: runtime: Simplify pm_runtime_get_if_active() usage
+Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
+Link: https://patch.msgid.link/12700973.O9o76ZdvQC@rjwysocki.net
+---
+ drivers/base/power/runtime.c | 27 ++++++++++++++++++---------
+ 1 file changed, 18 insertions(+), 9 deletions(-)
+
+--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
+@@ -1191,10 +1191,12 @@ EXPORT_SYMBOL_GPL(__pm_runtime_resume);
+  *
+  * Return -EINVAL if runtime PM is disabled for @dev.
+  *
+- * Otherwise, if the runtime PM status of @dev is %RPM_ACTIVE and either
+- * @ign_usage_count is %true or the runtime PM usage counter of @dev is not
+- * zero, increment the usage counter of @dev and return 1. Otherwise, return 0
+- * without changing the usage counter.
+ * Otherwise, if its runtime PM status is %RPM_ACTIVE and (1) @ign_usage_count
+ * is set, or (2) @dev is not ignoring children and its active child count is
+ * nonero, or (3) the runtime PM usage counter of @dev is not zero, increment
+ * the usage counter of @dev and return 1.
+ *
+ * Otherwise, return 0 without changing the usage counter.
+  *
+  * If @ign_usage_count is %true, this function can be used to prevent suspending
+  * the device when its runtime PM status is %RPM_ACTIVE.
+@@ -1216,7 +1218,8 @@ static int pm_runtime_get_conditional(st
+ 		retval = -EINVAL;
+ 	} else if (dev->power.runtime_status != RPM_ACTIVE) {
+ 		retval = 0;
+-	} else if (ign_usage_count) {
+	} else if (ign_usage_count || (!dev->power.ignore_children &&
+		   atomic_read(&dev->power.child_count) > 0)) {
+ 		retval = 1;
+ 		atomic_inc(&dev->power.usage_count);
+ 	} else {
+@@ -1249,10 +1252,16 @@ EXPORT_SYMBOL_GPL(pm_runtime_get_if_acti
+  * @dev: Target device.
+  *
+  * Increment the runtime PM usage counter of @dev if its runtime PM status is
+- * %RPM_ACTIVE and its runtime PM usage counter is greater than 0, in which case
+- * it returns 1. If the device is in a different state or its usage_count is 0,
+- * 0 is returned. -EINVAL is returned if runtime PM is disabled for the device,
+- * in which case also the usage_count will remain unmodified.
+ * %RPM_ACTIVE and its runtime PM usage counter is greater than 0 or it is not
+ * ignoring children and its active child count is nonzero.  1 is returned in
+ * this case.
+ *
+ * If @dev is in a different state or it is not in use (that is, its usage
+ * counter is 0, or it is ignoring children, or its active child count is 0),
+ * 0 is returned.
+ *
+ * -EINVAL is returned if runtime PM is disabled for the device, in which case
+ * also the usage counter of @dev is not updated.
+  */
+ int pm_runtime_get_if_in_use(struct device *dev)
+ {
--- a/debian/patches/patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch
+++ b/debian/patches/patchset-pf/steady/0010-io_uring-zcrx-always-pass-page-to-io_zcrx_copy_chunk.patch
@@ -0,0 +1,77 @@
+From 0958a5878e3cbeb42c0e6dbad00000c15a44c544 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 2 Jul 2025 15:29:04 +0100
+Subject: io_uring/zcrx: always pass page to io_zcrx_copy_chunk
+
+io_zcrx_copy_chunk() currently takes either a page or virtual address.
+Unify the parameters, make it take pages and resolve the linear part
+into a page the same way general networking code does that.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Reviewed-by: David Wei <dw@davidwei.uk>
+Link: https://lore.kernel.org/r/b8f9f4bac027f5f44a9ccf85350912d1db41ceb8.1751466461.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ io_uring/zcrx.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
+@@ -968,8 +968,8 @@ static struct net_iov *io_zcrx_alloc_fal
+ }
+ 
+ static ssize_t io_zcrx_copy_chunk(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
+-				  void *src_base, struct page *src_page,
+-				  unsigned int src_offset, size_t len)
+				  struct page *src_page, unsigned int src_offset,
+				  size_t len)
+ {
+ 	struct io_zcrx_area *area = ifq->area;
+ 	size_t copied = 0;
+@@ -983,7 +983,7 @@ static ssize_t io_zcrx_copy_chunk(struct
+ 		const int dst_off = 0;
+ 		struct net_iov *niov;
+ 		struct page *dst_page;
+-		void *dst_addr;
+		void *dst_addr, *src_addr;
+ 
+ 		niov = io_zcrx_alloc_fallback(area);
+ 		if (!niov) {
+@@ -993,13 +993,11 @@ static ssize_t io_zcrx_copy_chunk(struct
+ 
+ 		dst_page = io_zcrx_iov_page(niov);
+ 		dst_addr = kmap_local_page(dst_page);
+-		if (src_page)
+-			src_base = kmap_local_page(src_page);
+		src_addr = kmap_local_page(src_page);
+ 
+-		memcpy(dst_addr, src_base + src_offset, copy_size);
+		memcpy(dst_addr, src_addr + src_offset, copy_size);
+ 
+-		if (src_page)
+-			kunmap_local(src_base);
+		kunmap_local(src_addr);
+ 		kunmap_local(dst_addr);
+ 
+ 		if (!io_zcrx_queue_cqe(req, niov, ifq, dst_off, copy_size)) {
+@@ -1028,7 +1026,7 @@ static int io_zcrx_copy_frag(struct io_k
+ 
+ 	skb_frag_foreach_page(frag, off, len,
+ 			      page, p_off, p_len, t) {
+-		ret = io_zcrx_copy_chunk(req, ifq, NULL, page, p_off, p_len);
+		ret = io_zcrx_copy_chunk(req, ifq, page, p_off, p_len);
+ 		if (ret < 0)
+ 			return copied ? copied : ret;
+ 		copied += ret;
+@@ -1090,8 +1088,9 @@ io_zcrx_recv_skb(read_descriptor_t *desc
+ 		size_t to_copy;
+ 
+ 		to_copy = min_t(size_t, skb_headlen(skb) - offset, len);
+-		copied = io_zcrx_copy_chunk(req, ifq, skb->data, NULL,
+-					    offset, to_copy);
+		copied = io_zcrx_copy_chunk(req, ifq, virt_to_page(skb->data),
+					    offset_in_page(skb->data) + offset,
+					    to_copy);
+ 		if (copied < 0) {
+ 			ret = copied;
+ 			goto out;
--- a/debian/patches/patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch
+++ b/debian/patches/patchset-pf/steady/0011-io_uring-zcrx-assert-area-type-in-io_zcrx_iov_page.patch
@@ -0,0 +1,26 @@
+From 221ca821b4f8439aa9749e41f1a35b0b19c4d825 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 2 Jul 2025 15:29:08 +0100
+Subject: io_uring/zcrx: assert area type in io_zcrx_iov_page
+
+Add a simple debug assertion to io_zcrx_iov_page() making it's not
+trying to return pages for a dmabuf area.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/c3c30a926a18436a399a1768f3cc86c76cd17fa7.1751466461.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ io_uring/zcrx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
+@@ -44,6 +44,8 @@ static inline struct page *io_zcrx_iov_p
+ {
+ 	struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
+ 
+	lockdep_assert(!area->mem.is_dmabuf);
+
+ 	return area->mem.pages[net_iov_idx(niov)];
+ }
+ 
--- a/debian/patches/patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch
+++ b/debian/patches/patchset-pf/steady/0012-io_uring-zcrx-prepare-fallback-for-larger-pages.patch
@@ -0,0 +1,142 @@
+From ace17dfbf605c4eab9eb68c897ace0708d466bca Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 2 Jul 2025 15:29:09 +0100
+Subject: io_uring/zcrx: prepare fallback for larger pages
+
+io_zcrx_copy_chunk() processes one page at a time, which won't be
+sufficient when the net_iov size grows. Introduce a structure keeping
+the target niov page and other parameters, it's more convenient and can
+be reused later. And add a helper function that can efficient copy
+buffers of an arbitrary length. For 64bit archs the loop inside should
+be compiled out.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/e84bc705a4e1edeb9aefff470d96558d8232388f.1751466461.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ io_uring/zcrx.c | 83 +++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 56 insertions(+), 27 deletions(-)
+
+--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
+@@ -969,6 +969,51 @@ static struct net_iov *io_zcrx_alloc_fal
+ 	return niov;
+ }
+ 
+struct io_copy_cache {
+	struct page		*page;
+	unsigned long		offset;
+	size_t			size;
+};
+
+static ssize_t io_copy_page(struct io_copy_cache *cc, struct page *src_page,
+			    unsigned int src_offset, size_t len)
+{
+	size_t copied = 0;
+
+	len = min(len, cc->size);
+
+	while (len) {
+		void *src_addr, *dst_addr;
+		struct page *dst_page = cc->page;
+		unsigned dst_offset = cc->offset;
+		size_t n = len;
+
+		if (folio_test_partial_kmap(page_folio(dst_page)) ||
+		    folio_test_partial_kmap(page_folio(src_page))) {
+			dst_page = nth_page(dst_page, dst_offset / PAGE_SIZE);
+			dst_offset = offset_in_page(dst_offset);
+			src_page = nth_page(src_page, src_offset / PAGE_SIZE);
+			src_offset = offset_in_page(src_offset);
+			n = min(PAGE_SIZE - src_offset, PAGE_SIZE - dst_offset);
+			n = min(n, len);
+		}
+
+		dst_addr = kmap_local_page(dst_page) + dst_offset;
+		src_addr = kmap_local_page(src_page) + src_offset;
+
+		memcpy(dst_addr, src_addr, n);
+
+		kunmap_local(src_addr);
+		kunmap_local(dst_addr);
+
+		cc->size -= n;
+		cc->offset += n;
+		len -= n;
+		copied += n;
+	}
+	return copied;
+}
+
+ static ssize_t io_zcrx_copy_chunk(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
+ 				  struct page *src_page, unsigned int src_offset,
+ 				  size_t len)
+@@ -981,11 +1026,9 @@ static ssize_t io_zcrx_copy_chunk(struct
+ 		return -EFAULT;
+ 
+ 	while (len) {
+-		size_t copy_size = min_t(size_t, PAGE_SIZE, len);
+-		const int dst_off = 0;
+		struct io_copy_cache cc;
+ 		struct net_iov *niov;
+-		struct page *dst_page;
+-		void *dst_addr, *src_addr;
+		size_t n;
+ 
+ 		niov = io_zcrx_alloc_fallback(area);
+ 		if (!niov) {
+@@ -993,25 +1036,22 @@ static ssize_t io_zcrx_copy_chunk(struct
+ 			break;
+ 		}
+ 
+-		dst_page = io_zcrx_iov_page(niov);
+-		dst_addr = kmap_local_page(dst_page);
+-		src_addr = kmap_local_page(src_page);
+-
+-		memcpy(dst_addr, src_addr + src_offset, copy_size);
+		cc.page = io_zcrx_iov_page(niov);
+		cc.offset = 0;
+		cc.size = PAGE_SIZE;
+ 
+-		kunmap_local(src_addr);
+-		kunmap_local(dst_addr);
+		n = io_copy_page(&cc, src_page, src_offset, len);
+ 
+-		if (!io_zcrx_queue_cqe(req, niov, ifq, dst_off, copy_size)) {
+		if (!io_zcrx_queue_cqe(req, niov, ifq, 0, n)) {
+ 			io_zcrx_return_niov(niov);
+ 			ret = -ENOSPC;
+ 			break;
+ 		}
+ 
+ 		io_zcrx_get_niov_uref(niov);
+-		src_offset += copy_size;
+-		len -= copy_size;
+-		copied += copy_size;
+		src_offset += n;
+		len -= n;
+		copied += n;
+ 	}
+ 
+ 	return copied ? copied : ret;
+@@ -1021,19 +1061,8 @@ static int io_zcrx_copy_frag(struct io_k
+ 			     const skb_frag_t *frag, int off, int len)
+ {
+ 	struct page *page = skb_frag_page(frag);
+-	u32 p_off, p_len, t, copied = 0;
+-	int ret = 0;
+ 
+-	off += skb_frag_off(frag);
+-
+-	skb_frag_foreach_page(frag, off, len,
+-			      page, p_off, p_len, t) {
+-		ret = io_zcrx_copy_chunk(req, ifq, page, p_off, p_len);
+-		if (ret < 0)
+-			return copied ? copied : ret;
+-		copied += ret;
+-	}
+-	return copied;
+	return io_zcrx_copy_chunk(req, ifq, page, off + skb_frag_off(frag), len);
+ }
+ 
+ static int io_zcrx_recv_frag(struct io_kiocb *req, struct io_zcrx_ifq *ifq,
--- a/debian/patches/patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch
+++ b/debian/patches/patchset-pf/steady/0013-crypto-x86-aegis-Fix-sleeping-when-disallowed-on-PRE.patch
@@ -0,0 +1,57 @@
+From 127ab7f801b3ec9cf94d2436ef1f579a1fc09dd6 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Tue, 8 Jul 2025 12:38:28 -0700
+Subject: crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT
+
+skcipher_walk_done() can call kfree(), which takes a spinlock, which
+makes it incorrect to call while preemption is disabled on PREEMPT_RT.
+Therefore, end the kernel-mode FPU section before calling
+skcipher_walk_done(), and restart it afterwards.
+
+Moreover, pass atomic=false to skcipher_walk_aead_encrypt() instead of
+atomic=true.  The point of atomic=true was to make skcipher_walk_done()
+safe to call while in a kernel-mode FPU section, but that does not
+actually work.  So just use the usual atomic=false.
+
+Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ arch/x86/crypto/aegis128-aesni-glue.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/crypto/aegis128-aesni-glue.c
+++ b/arch/x86/crypto/aegis128-aesni-glue.c
+@@ -119,7 +119,9 @@ crypto_aegis128_aesni_process_crypt(stru
+ 					   walk->dst.virt.addr,
+ 					   round_down(walk->nbytes,
+ 						      AEGIS128_BLOCK_SIZE));
+		kernel_fpu_end();
+ 		skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE);
+		kernel_fpu_begin();
+ 	}
+ 
+ 	if (walk->nbytes) {
+@@ -131,7 +133,9 @@ crypto_aegis128_aesni_process_crypt(stru
+ 			aegis128_aesni_dec_tail(state, walk->src.virt.addr,
+ 						walk->dst.virt.addr,
+ 						walk->nbytes);
+		kernel_fpu_end();
+ 		skcipher_walk_done(walk, 0);
+		kernel_fpu_begin();
+ 	}
+ }
+ 
+@@ -176,9 +180,9 @@ crypto_aegis128_aesni_crypt(struct aead_
+ 	struct aegis_state state;
+ 
+ 	if (enc)
+-		skcipher_walk_aead_encrypt(&walk, req, true);
+		skcipher_walk_aead_encrypt(&walk, req, false);
+ 	else
+-		skcipher_walk_aead_decrypt(&walk, req, true);
+		skcipher_walk_aead_decrypt(&walk, req, false);
+ 
+ 	kernel_fpu_begin();
+ 
--- a/debian/patches/patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch
+++ b/debian/patches/patchset-pf/steady/0014-crypto-x86-aegis-Add-missing-error-checks.patch
@@ -0,0 +1,122 @@
+From 3bc9bc41e634767f001b7b37b6f1f89fc0214b8a Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Tue, 8 Jul 2025 12:38:29 -0700
+Subject: crypto: x86/aegis - Add missing error checks
+
+The skcipher_walk functions can allocate memory and can fail, so
+checking for errors is necessary.
+
+Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ arch/x86/crypto/aegis128-aesni-glue.c | 36 +++++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/crypto/aegis128-aesni-glue.c
+++ b/arch/x86/crypto/aegis128-aesni-glue.c
+@@ -104,10 +104,12 @@ static void crypto_aegis128_aesni_proces
+ 	}
+ }
+ 
+-static __always_inline void
+static __always_inline int
+ crypto_aegis128_aesni_process_crypt(struct aegis_state *state,
+ 				    struct skcipher_walk *walk, bool enc)
+ {
+	int err = 0;
+
+ 	while (walk->nbytes >= AEGIS128_BLOCK_SIZE) {
+ 		if (enc)
+ 			aegis128_aesni_enc(state, walk->src.virt.addr,
+@@ -120,7 +122,8 @@ crypto_aegis128_aesni_process_crypt(stru
+ 					   round_down(walk->nbytes,
+ 						      AEGIS128_BLOCK_SIZE));
+ 		kernel_fpu_end();
+-		skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE);
+		err = skcipher_walk_done(walk,
+					 walk->nbytes % AEGIS128_BLOCK_SIZE);
+ 		kernel_fpu_begin();
+ 	}
+ 
+@@ -134,9 +137,10 @@ crypto_aegis128_aesni_process_crypt(stru
+ 						walk->dst.virt.addr,
+ 						walk->nbytes);
+ 		kernel_fpu_end();
+-		skcipher_walk_done(walk, 0);
+		err = skcipher_walk_done(walk, 0);
+ 		kernel_fpu_begin();
+ 	}
+	return err;
+ }
+ 
+ static struct aegis_ctx *crypto_aegis128_aesni_ctx(struct crypto_aead *aead)
+@@ -169,7 +173,7 @@ static int crypto_aegis128_aesni_setauth
+ 	return 0;
+ }
+ 
+-static __always_inline void
+static __always_inline int
+ crypto_aegis128_aesni_crypt(struct aead_request *req,
+ 			    struct aegis_block *tag_xor,
+ 			    unsigned int cryptlen, bool enc)
+@@ -178,20 +182,24 @@ crypto_aegis128_aesni_crypt(struct aead_
+ 	struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm);
+ 	struct skcipher_walk walk;
+ 	struct aegis_state state;
+	int err;
+ 
+ 	if (enc)
+-		skcipher_walk_aead_encrypt(&walk, req, false);
+		err = skcipher_walk_aead_encrypt(&walk, req, false);
+ 	else
+-		skcipher_walk_aead_decrypt(&walk, req, false);
+		err = skcipher_walk_aead_decrypt(&walk, req, false);
+	if (err)
+		return err;
+ 
+ 	kernel_fpu_begin();
+ 
+ 	aegis128_aesni_init(&state, &ctx->key, req->iv);
+ 	crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen);
+-	crypto_aegis128_aesni_process_crypt(&state, &walk, enc);
+-	aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
+-
+	err = crypto_aegis128_aesni_process_crypt(&state, &walk, enc);
+	if (err == 0)
+		aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen);
+ 	kernel_fpu_end();
+	return err;
+ }
+ 
+ static int crypto_aegis128_aesni_encrypt(struct aead_request *req)
+@@ -200,8 +208,11 @@ static int crypto_aegis128_aesni_encrypt
+ 	struct aegis_block tag = {};
+ 	unsigned int authsize = crypto_aead_authsize(tfm);
+ 	unsigned int cryptlen = req->cryptlen;
+	int err;
+ 
+-	crypto_aegis128_aesni_crypt(req, &tag, cryptlen, true);
+	err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, true);
+	if (err)
+		return err;
+ 
+ 	scatterwalk_map_and_copy(tag.bytes, req->dst,
+ 				 req->assoclen + cryptlen, authsize, 1);
+@@ -216,11 +227,14 @@ static int crypto_aegis128_aesni_decrypt
+ 	struct aegis_block tag;
+ 	unsigned int authsize = crypto_aead_authsize(tfm);
+ 	unsigned int cryptlen = req->cryptlen - authsize;
+	int err;
+ 
+ 	scatterwalk_map_and_copy(tag.bytes, req->src,
+ 				 req->assoclen + cryptlen, authsize, 0);
+ 
+-	crypto_aegis128_aesni_crypt(req, &tag, cryptlen, false);
+	err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, false);
+	if (err)
+		return err;
+ 
+ 	return crypto_memneq(tag.bytes, zeros.bytes, authsize) ? -EBADMSG : 0;
+ }
--- a/debian/patches/patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch
+++ b/debian/patches/patchset-pf/steady/0015-hwmon-gsc-hwmon-fix-fan-pwm-setpoint-show-functions.patch
@@ -0,0 +1,54 @@
+From 8b4284861b77422d25c46fe00402754ab1a156cc Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Fri, 18 Jul 2025 13:02:59 -0700
+Subject: hwmon: (gsc-hwmon) fix fan pwm setpoint show functions
+
+The Linux hwmon sysfs API values for pwmX_auto_pointY_pwm represent an
+integer value between 0 (0%) to 255 (100%) and the pwmX_auto_pointY_temp
+represent millidegrees Celcius.
+
+Commit a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature
+scaling") properly addressed the incorrect scaling in the
+pwm_auto_point_temp_store implementation but erroneously scaled
+the pwm_auto_point_pwm_show (pwm value) instead of the
+pwm_auto_point_temp_show (temp value) resulting in:
+ # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm
+ 25500
+ # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp
+ 4500
+
+Fix the scaling of these attributes:
+ # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm
+ 255
+ # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp
+ 45000
+
+Fixes: a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling")
+Cc: stable@vger.kernel.org
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Link: https://lore.kernel.org/r/20250718200259.1840792-1-tharvey@gateworks.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+---
+ drivers/hwmon/gsc-hwmon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/gsc-hwmon.c
+++ b/drivers/hwmon/gsc-hwmon.c
+@@ -64,7 +64,7 @@ static ssize_t pwm_auto_point_temp_show(
+ 		return ret;
+ 
+ 	ret = regs[0] | regs[1] << 8;
+-	return sprintf(buf, "%d\n", ret * 10);
+	return sprintf(buf, "%d\n", ret * 100);
+ }
+ 
+ static ssize_t pwm_auto_point_temp_store(struct device *dev,
+@@ -99,7 +99,7 @@ static ssize_t pwm_auto_point_pwm_show(s
+ {
+ 	struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+ 
+-	return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)));
+	return sprintf(buf, "%d\n", 255 * (50 + (attr->index * 10)) / 100);
+ }
+ 
+ static SENSOR_DEVICE_ATTR_RO(pwm1_auto_point1_pwm, pwm_auto_point_pwm, 0);
--- a/debian/patches/patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch
+++ b/debian/patches/patchset-pf/steady/0016-vt-keyboard-Don-t-process-Unicode-characters-in-K_OF.patch
@@ -0,0 +1,31 @@
+From 3f91f07c241bea4ec294315cb41df81f123fa0bb Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:57 +0700
+Subject: vt: keyboard: Don't process Unicode characters in K_OFF mode
+
+We don't process Unicode characters if the virtual terminal is in raw
+mode, so there's no reason why we shouldn't do the same for K_OFF
+(especially since people would expect K_OFF to actually turn off all VT
+key processing).
+
+Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/keyboard.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
+@@ -1487,7 +1487,7 @@ static void kbd_keycode(unsigned int key
+ 		rc = atomic_notifier_call_chain(&keyboard_notifier_list,
+ 						KBD_UNICODE, &param);
+ 		if (rc != NOTIFY_STOP)
+-			if (down && !raw_mode)
+			if (down && !(raw_mode || kbd->kbdmode == VC_OFF))
+ 				k_unicode(vc, keysym, !down);
+ 		return;
+ 	}
--- a/debian/patches/patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch
+++ b/debian/patches/patchset-pf/steady/0017-vt-defkeymap-Map-keycodes-above-127-to-K_HOLE.patch
@@ -0,0 +1,190 @@
+From f575281d91029d2dbfa0fa628cdc72e80fcd626f Mon Sep 17 00:00:00 2001
+From: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Date: Wed, 2 Jul 2025 21:17:58 +0700
+Subject: vt: defkeymap: Map keycodes above 127 to K_HOLE
+
+The maximum number of keycodes got bumped to 256 a very long time ago,
+but the default keymaps were never adjusted to match. This is causing
+the kernel to interpret keycodes above 127 as U+0000 if the shipped
+generated keymap is used.
+
+Fix this by mapping all keycodes above 127 to K_HOLE so the kernel
+ignores them.
+
+The contents of this patche were generated by rerunning `loadkeys
+--mktable --unicode` and only including the changes to map keycodes
+above 127 to K_HOLE.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Myrrh Periwinkle <myrrhperiwinkle@qtmlabs.xyz>
+Cc: stable <stable@kernel.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/vt/defkeymap.c_shipped | 112 +++++++++++++++++++++++++++++
+ 1 file changed, 112 insertions(+)
+
+--- a/drivers/tty/vt/defkeymap.c_shipped
+++ b/drivers/tty/vt/defkeymap.c_shipped
+@@ -23,6 +23,22 @@ unsigned short plain_map[NR_KEYS] = {
+ 	0xf118,	0xf601,	0xf602,	0xf117,	0xf600,	0xf119,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short shift_map[NR_KEYS] = {
+@@ -42,6 +58,22 @@ static unsigned short shift_map[NR_KEYS]
+ 	0xf20b,	0xf601,	0xf602,	0xf117,	0xf600,	0xf20a,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short altgr_map[NR_KEYS] = {
+@@ -61,6 +93,22 @@ static unsigned short altgr_map[NR_KEYS]
+ 	0xf118,	0xf601,	0xf602,	0xf117,	0xf600,	0xf119,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short ctrl_map[NR_KEYS] = {
+@@ -80,6 +128,22 @@ static unsigned short ctrl_map[NR_KEYS]
+ 	0xf118,	0xf601,	0xf602,	0xf117,	0xf600,	0xf119,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short shift_ctrl_map[NR_KEYS] = {
+@@ -99,6 +163,22 @@ static unsigned short shift_ctrl_map[NR_
+ 	0xf118,	0xf601,	0xf602,	0xf117,	0xf600,	0xf119,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short alt_map[NR_KEYS] = {
+@@ -118,6 +198,22 @@ static unsigned short alt_map[NR_KEYS] =
+ 	0xf118,	0xf210,	0xf211,	0xf117,	0xf600,	0xf119,	0xf115,	0xf116,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ static unsigned short ctrl_alt_map[NR_KEYS] = {
+@@ -137,6 +233,22 @@ static unsigned short ctrl_alt_map[NR_KE
+ 	0xf118,	0xf601,	0xf602,	0xf117,	0xf600,	0xf119,	0xf115,	0xf20c,
+ 	0xf11a,	0xf10c,	0xf10d,	0xf11b,	0xf11c,	0xf110,	0xf311,	0xf11d,
+ 	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,	0xf200,
+ };
+ 
+ unsigned short *key_maps[MAX_NR_KEYMAPS] = {
--- a/debian/patches/patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch
+++ b/debian/patches/patchset-pf/steady/0018-serial-8250-fix-panic-due-to-PSLVERR.patch
@@ -0,0 +1,55 @@
+From c0bcd8c710c48ab93f0b72c1a3611c39a68c3a74 Mon Sep 17 00:00:00 2001
+From: Yunhui Cui <cuiyunhui@bytedance.com>
+Date: Wed, 23 Jul 2025 10:33:22 +0800
+Subject: serial: 8250: fix panic due to PSLVERR
+
+When the PSLVERR_RESP_EN parameter is set to 1, the device generates
+an error response if an attempt is made to read an empty RBR (Receive
+Buffer Register) while the FIFO is enabled.
+
+In serial8250_do_startup(), calling serial_port_out(port, UART_LCR,
+UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes
+dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter
+function enables the FIFO via serial_out(p, UART_FCR, p->fcr).
+Execution proceeds to the serial_port_in(port, UART_RX).
+This satisfies the PSLVERR trigger condition.
+
+When another CPU (e.g., using printk()) is accessing the UART (UART
+is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==
+(lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter
+dw8250_force_idle().
+
+Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock
+to fix this issue.
+
+Panic backtrace:
+[    0.442336] Oops - unknown exception [#1]
+[    0.442343] epc : dw8250_serial_in32+0x1e/0x4a
+[    0.442351]  ra : serial8250_do_startup+0x2c8/0x88e
+...
+[    0.442416] console_on_rootfs+0x26/0x70
+
+Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround")
+Link: https://lore.kernel.org/all/84cydt5peu.fsf@jogness.linutronix.de/T/
+Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
+Reviewed-by: John Ogness <john.ogness@linutronix.de>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20250723023322.464-2-cuiyunhui@bytedance.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2376,9 +2376,9 @@ int serial8250_do_startup(struct uart_po
+ 	/*
+ 	 * Now, initialize the UART
+ 	 */
+	uart_port_lock_irqsave(port, &flags);
+ 	serial_port_out(port, UART_LCR, UART_LCR_WLEN8);
+ 
+-	uart_port_lock_irqsave(port, &flags);
+ 	if (up->port.flags & UPF_FOURPORT) {
+ 		if (!up->port.irq)
+ 			up->port.mctrl |= TIOCM_OUT1;
--- a/debian/patches/patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch
+++ b/debian/patches/patchset-pf/steady/0019-mm-damon-paddr-use-alloc_migartion_target-with-no-mi.patch
@@ -0,0 +1,74 @@
+From 2ee6decb1435c8331404d590f7a5a2d6a5711760 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Mon, 16 Jun 2025 10:23:44 -0700
+Subject: mm/damon/paddr: use alloc_migartion_target() with no migration
+ fallback nodemask
+
+Patch series "mm/damon: use alloc_migrate_target() for
+DAMOS_MIGRATE_{HOT,COLD}".
+
+DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for demotion, and
+hence the behavior is also similar to that.  But, since those are not only
+for demotion but general migrations, it would be better to match with that
+for move_pages() system call.  Make the implementation and the behavior
+more similar to move_pages() by not setting migration fallback nodes, and
+using alloc_migration_target() instead of alloc_migrate_folio().
+
+alloc_migrate_folio() was renamed from alloc_demote_folio() and been
+non-static function, to let DAMOS_MIGRATE_{HOT,COLD} call it.  As
+alloc_migration_target() is called instead, the renaming and de-static
+changes are no more required but could only make future code readers be
+confused.  Revert the changes, too.
+
+
+This patch (of 3):
+
+DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for
+demote_folio_list().  Because those are not only for demotion but general
+folio migrations, it makes more sense to behave similarly to move_pages()
+system call.  Make the behavior more similar to move_pages(), by using
+alloc_migration_target() instead of alloc_migrate_folio(), without
+fallback nodemask.
+
+Link: https://lkml.kernel.org/r/20250616172346.67659-2-sj@kernel.org
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
+Cc: David Hildenbrand <david@redhat.com>
+Cc: Honggyu Kim <honggyu.kim@sk.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Qi Zheng <zhengqi.arch@bytedance.com>
+Cc: Shakeel Butt <shakeel.butt@linux.dev>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/damon/paddr.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
+@@ -386,7 +386,6 @@ static unsigned int __damon_pa_migrate_f
+ 		int target_nid)
+ {
+ 	unsigned int nr_succeeded = 0;
+-	nodemask_t allowed_mask = NODE_MASK_NONE;
+ 	struct migration_target_control mtc = {
+ 		/*
+ 		 * Allocate from 'node', or fail quickly and quietly.
+@@ -396,7 +395,6 @@ static unsigned int __damon_pa_migrate_f
+ 		.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
+ 			__GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT,
+ 		.nid = target_nid,
+-		.nmask = &allowed_mask
+ 	};
+ 
+ 	if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE)
+@@ -406,7 +404,7 @@ static unsigned int __damon_pa_migrate_f
+ 		return 0;
+ 
+ 	/* Migration ignores all cpuset and mempolicy settings */
+-	migrate_pages(migrate_folios, alloc_migrate_folio, NULL,
+	migrate_pages(migrate_folios, alloc_migration_target, NULL,
+ 		      (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON,
+ 		      &nr_succeeded);
+ 
--- a/debian/patches/patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch
+++ b/debian/patches/patchset-pf/steady/0020-mm-damon-move-migration-helpers-from-paddr-to-ops-co.patch
@@ -0,0 +1,318 @@
+From 9292d9753eeab6dd9492ec28b79045ab4890652a Mon Sep 17 00:00:00 2001
+From: Bijan Tabatabai <bijantabatab@micron.com>
+Date: Tue, 8 Jul 2025 19:59:38 -0500
+Subject: mm/damon: move migration helpers from paddr to ops-common
+
+This patch moves the damon_pa_migrate_pages function along with its
+corresponding helper functions from paddr to ops-common.  The function
+prefix of "damon_pa_" was also changed to just "damon_" accordingly.
+
+This patch will allow page migration to be available to vaddr schemes as
+well as paddr schemes.
+
+Link: https://lkml.kernel.org/r/20250709005952.17776-9-bijan311@gmail.com
+Co-developed-by: Ravi Shankar Jonnalagadda <ravis.opensrc@micron.com>
+Signed-off-by: Ravi Shankar Jonnalagadda <ravis.opensrc@micron.com>
+Signed-off-by: Bijan Tabatabai <bijantabatab@micron.com>
+Reviewed-by: SeongJae Park <sj@kernel.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/damon/ops-common.c | 120 +++++++++++++++++++++++++++++++++++++++++
+ mm/damon/ops-common.h |   2 +
+ mm/damon/paddr.c      | 122 +-----------------------------------------
+ 3 files changed, 123 insertions(+), 121 deletions(-)
+
+--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
+@@ -5,6 +5,7 @@
+  * Author: SeongJae Park <sj@kernel.org>
+  */
+ 
+#include <linux/migrate.h>
+ #include <linux/mmu_notifier.h>
+ #include <linux/page_idle.h>
+ #include <linux/pagemap.h>
+@@ -12,6 +13,7 @@
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
+ 
+#include "../internal.h"
+ #include "ops-common.h"
+ 
+ /*
+@@ -138,3 +140,121 @@ int damon_cold_score(struct damon_ctx *c
+ 	/* Return coldness of the region */
+ 	return DAMOS_MAX_SCORE - hotness;
+ }
+
+static unsigned int __damon_migrate_folio_list(
+		struct list_head *migrate_folios, struct pglist_data *pgdat,
+		int target_nid)
+{
+	unsigned int nr_succeeded = 0;
+	struct migration_target_control mtc = {
+		/*
+		 * Allocate from 'node', or fail quickly and quietly.
+		 * When this happens, 'page' will likely just be discarded
+		 * instead of migrated.
+		 */
+		.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
+			__GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT,
+		.nid = target_nid,
+	};
+
+	if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE)
+		return 0;
+
+	if (list_empty(migrate_folios))
+		return 0;
+
+	/* Migration ignores all cpuset and mempolicy settings */
+	migrate_pages(migrate_folios, alloc_migration_target, NULL,
+		      (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON,
+		      &nr_succeeded);
+
+	return nr_succeeded;
+}
+
+static unsigned int damon_migrate_folio_list(struct list_head *folio_list,
+						struct pglist_data *pgdat,
+						int target_nid)
+{
+	unsigned int nr_migrated = 0;
+	struct folio *folio;
+	LIST_HEAD(ret_folios);
+	LIST_HEAD(migrate_folios);
+
+	while (!list_empty(folio_list)) {
+		struct folio *folio;
+
+		cond_resched();
+
+		folio = lru_to_folio(folio_list);
+		list_del(&folio->lru);
+
+		if (!folio_trylock(folio))
+			goto keep;
+
+		/* Relocate its contents to another node. */
+		list_add(&folio->lru, &migrate_folios);
+		folio_unlock(folio);
+		continue;
+keep:
+		list_add(&folio->lru, &ret_folios);
+	}
+	/* 'folio_list' is always empty here */
+
+	/* Migrate folios selected for migration */
+	nr_migrated += __damon_migrate_folio_list(
+			&migrate_folios, pgdat, target_nid);
+	/*
+	 * Folios that could not be migrated are still in @migrate_folios.  Add
+	 * those back on @folio_list
+	 */
+	if (!list_empty(&migrate_folios))
+		list_splice_init(&migrate_folios, folio_list);
+
+	try_to_unmap_flush();
+
+	list_splice(&ret_folios, folio_list);
+
+	while (!list_empty(folio_list)) {
+		folio = lru_to_folio(folio_list);
+		list_del(&folio->lru);
+		folio_putback_lru(folio);
+	}
+
+	return nr_migrated;
+}
+
+unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid)
+{
+	int nid;
+	unsigned long nr_migrated = 0;
+	LIST_HEAD(node_folio_list);
+	unsigned int noreclaim_flag;
+
+	if (list_empty(folio_list))
+		return nr_migrated;
+
+	noreclaim_flag = memalloc_noreclaim_save();
+
+	nid = folio_nid(lru_to_folio(folio_list));
+	do {
+		struct folio *folio = lru_to_folio(folio_list);
+
+		if (nid == folio_nid(folio)) {
+			list_move(&folio->lru, &node_folio_list);
+			continue;
+		}
+
+		nr_migrated += damon_migrate_folio_list(&node_folio_list,
+							   NODE_DATA(nid),
+							   target_nid);
+		nid = folio_nid(lru_to_folio(folio_list));
+	} while (!list_empty(folio_list));
+
+	nr_migrated += damon_migrate_folio_list(&node_folio_list,
+						   NODE_DATA(nid),
+						   target_nid);
+
+	memalloc_noreclaim_restore(noreclaim_flag);
+
+	return nr_migrated;
+}
+--- a/mm/damon/ops-common.h
+++ b/mm/damon/ops-common.h
+@@ -16,3 +16,5 @@ int damon_cold_score(struct damon_ctx *c
+ 			struct damos *s);
+ int damon_hot_score(struct damon_ctx *c, struct damon_region *r,
+ 			struct damos *s);
+
+unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid);
+--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
+@@ -13,7 +13,6 @@
+ #include <linux/rmap.h>
+ #include <linux/swap.h>
+ #include <linux/memory-tiers.h>
+-#include <linux/migrate.h>
+ #include <linux/mm_inline.h>
+ 
+ #include "../internal.h"
+@@ -381,125 +380,6 @@ static unsigned long damon_pa_deactivate
+ 			sz_filter_passed);
+ }
+ 
+-static unsigned int __damon_pa_migrate_folio_list(
+-		struct list_head *migrate_folios, struct pglist_data *pgdat,
+-		int target_nid)
+-{
+-	unsigned int nr_succeeded = 0;
+-	struct migration_target_control mtc = {
+-		/*
+-		 * Allocate from 'node', or fail quickly and quietly.
+-		 * When this happens, 'page' will likely just be discarded
+-		 * instead of migrated.
+-		 */
+-		.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
+-			__GFP_NOWARN | __GFP_NOMEMALLOC | GFP_NOWAIT,
+-		.nid = target_nid,
+-	};
+-
+-	if (pgdat->node_id == target_nid || target_nid == NUMA_NO_NODE)
+-		return 0;
+-
+-	if (list_empty(migrate_folios))
+-		return 0;
+-
+-	/* Migration ignores all cpuset and mempolicy settings */
+-	migrate_pages(migrate_folios, alloc_migration_target, NULL,
+-		      (unsigned long)&mtc, MIGRATE_ASYNC, MR_DAMON,
+-		      &nr_succeeded);
+-
+-	return nr_succeeded;
+-}
+-
+-static unsigned int damon_pa_migrate_folio_list(struct list_head *folio_list,
+-						struct pglist_data *pgdat,
+-						int target_nid)
+-{
+-	unsigned int nr_migrated = 0;
+-	struct folio *folio;
+-	LIST_HEAD(ret_folios);
+-	LIST_HEAD(migrate_folios);
+-
+-	while (!list_empty(folio_list)) {
+-		struct folio *folio;
+-
+-		cond_resched();
+-
+-		folio = lru_to_folio(folio_list);
+-		list_del(&folio->lru);
+-
+-		if (!folio_trylock(folio))
+-			goto keep;
+-
+-		/* Relocate its contents to another node. */
+-		list_add(&folio->lru, &migrate_folios);
+-		folio_unlock(folio);
+-		continue;
+-keep:
+-		list_add(&folio->lru, &ret_folios);
+-	}
+-	/* 'folio_list' is always empty here */
+-
+-	/* Migrate folios selected for migration */
+-	nr_migrated += __damon_pa_migrate_folio_list(
+-			&migrate_folios, pgdat, target_nid);
+-	/*
+-	 * Folios that could not be migrated are still in @migrate_folios.  Add
+-	 * those back on @folio_list
+-	 */
+-	if (!list_empty(&migrate_folios))
+-		list_splice_init(&migrate_folios, folio_list);
+-
+-	try_to_unmap_flush();
+-
+-	list_splice(&ret_folios, folio_list);
+-
+-	while (!list_empty(folio_list)) {
+-		folio = lru_to_folio(folio_list);
+-		list_del(&folio->lru);
+-		folio_putback_lru(folio);
+-	}
+-
+-	return nr_migrated;
+-}
+-
+-static unsigned long damon_pa_migrate_pages(struct list_head *folio_list,
+-					    int target_nid)
+-{
+-	int nid;
+-	unsigned long nr_migrated = 0;
+-	LIST_HEAD(node_folio_list);
+-	unsigned int noreclaim_flag;
+-
+-	if (list_empty(folio_list))
+-		return nr_migrated;
+-
+-	noreclaim_flag = memalloc_noreclaim_save();
+-
+-	nid = folio_nid(lru_to_folio(folio_list));
+-	do {
+-		struct folio *folio = lru_to_folio(folio_list);
+-
+-		if (nid == folio_nid(folio)) {
+-			list_move(&folio->lru, &node_folio_list);
+-			continue;
+-		}
+-
+-		nr_migrated += damon_pa_migrate_folio_list(&node_folio_list,
+-							   NODE_DATA(nid),
+-							   target_nid);
+-		nid = folio_nid(lru_to_folio(folio_list));
+-	} while (!list_empty(folio_list));
+-
+-	nr_migrated += damon_pa_migrate_folio_list(&node_folio_list,
+-						   NODE_DATA(nid),
+-						   target_nid);
+-
+-	memalloc_noreclaim_restore(noreclaim_flag);
+-
+-	return nr_migrated;
+-}
+-
+ static unsigned long damon_pa_migrate(struct damon_region *r, struct damos *s,
+ 		unsigned long *sz_filter_passed)
+ {
+@@ -527,7 +407,7 @@ put_folio:
+ 		addr += folio_size(folio);
+ 		folio_put(folio);
+ 	}
+-	applied = damon_pa_migrate_pages(&folio_list, s->target_nid);
+	applied = damon_migrate_pages(&folio_list, s->target_nid);
+ 	cond_resched();
+ 	s->last_applied = folio;
+ 	return applied * PAGE_SIZE;
--- a/debian/patches/patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch
+++ b/debian/patches/patchset-pf/steady/0021-mm-damon-move-folio-filtering-from-paddr-to-ops-comm.patch
@@ -0,0 +1,381 @@
+From 98fbe2f62c4263248a325867c439f9d7222a3c64 Mon Sep 17 00:00:00 2001
+From: Bijan Tabatabai <bijantabatab@micron.com>
+Date: Tue, 8 Jul 2025 19:59:42 -0500
+Subject: mm/damon: move folio filtering from paddr to ops-common
+
+This patch moves damos_pa_filter_match and the functions it calls to
+ops-common, renaming it to damos_folio_filter_match.  Doing so allows us
+to share the filtering logic for the vaddr version of the
+migrate_{hot,cold} schemes.
+
+Link: https://lkml.kernel.org/r/20250709005952.17776-13-bijan311@gmail.com
+Co-developed-by: Ravi Shankar Jonnalagadda <ravis.opensrc@micron.com>
+Signed-off-by: Ravi Shankar Jonnalagadda <ravis.opensrc@micron.com>
+Signed-off-by: Bijan Tabatabai <bijantabatab@micron.com>
+Reviewed-by: SeongJae Park <sj@kernel.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/damon/ops-common.c | 150 +++++++++++++++++++++++++++++++++++++++++
+ mm/damon/ops-common.h |   3 +
+ mm/damon/paddr.c      | 153 +-----------------------------------------
+ 3 files changed, 154 insertions(+), 152 deletions(-)
+
+--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
+@@ -141,6 +141,156 @@ int damon_cold_score(struct damon_ctx *c
+ 	return DAMOS_MAX_SCORE - hotness;
+ }
+ 
+static bool damon_folio_mkold_one(struct folio *folio,
+		struct vm_area_struct *vma, unsigned long addr, void *arg)
+{
+	DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0);
+
+	while (page_vma_mapped_walk(&pvmw)) {
+		addr = pvmw.address;
+		if (pvmw.pte)
+			damon_ptep_mkold(pvmw.pte, vma, addr);
+		else
+			damon_pmdp_mkold(pvmw.pmd, vma, addr);
+	}
+	return true;
+}
+
+void damon_folio_mkold(struct folio *folio)
+{
+	struct rmap_walk_control rwc = {
+		.rmap_one = damon_folio_mkold_one,
+		.anon_lock = folio_lock_anon_vma_read,
+	};
+	bool need_lock;
+
+	if (!folio_mapped(folio) || !folio_raw_mapping(folio)) {
+		folio_set_idle(folio);
+		return;
+	}
+
+	need_lock = !folio_test_anon(folio) || folio_test_ksm(folio);
+	if (need_lock && !folio_trylock(folio))
+		return;
+
+	rmap_walk(folio, &rwc);
+
+	if (need_lock)
+		folio_unlock(folio);
+
+}
+
+static bool damon_folio_young_one(struct folio *folio,
+		struct vm_area_struct *vma, unsigned long addr, void *arg)
+{
+	bool *accessed = arg;
+	DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0);
+	pte_t pte;
+
+	*accessed = false;
+	while (page_vma_mapped_walk(&pvmw)) {
+		addr = pvmw.address;
+		if (pvmw.pte) {
+			pte = ptep_get(pvmw.pte);
+
+			/*
+			 * PFN swap PTEs, such as device-exclusive ones, that
+			 * actually map pages are "old" from a CPU perspective.
+			 * The MMU notifier takes care of any device aspects.
+			 */
+			*accessed = (pte_present(pte) && pte_young(pte)) ||
+				!folio_test_idle(folio) ||
+				mmu_notifier_test_young(vma->vm_mm, addr);
+		} else {
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+			*accessed = pmd_young(pmdp_get(pvmw.pmd)) ||
+				!folio_test_idle(folio) ||
+				mmu_notifier_test_young(vma->vm_mm, addr);
+#else
+			WARN_ON_ONCE(1);
+#endif	/* CONFIG_TRANSPARENT_HUGEPAGE */
+		}
+		if (*accessed) {
+			page_vma_mapped_walk_done(&pvmw);
+			break;
+		}
+	}
+
+	/* If accessed, stop walking */
+	return *accessed == false;
+}
+
+bool damon_folio_young(struct folio *folio)
+{
+	bool accessed = false;
+	struct rmap_walk_control rwc = {
+		.arg = &accessed,
+		.rmap_one = damon_folio_young_one,
+		.anon_lock = folio_lock_anon_vma_read,
+	};
+	bool need_lock;
+
+	if (!folio_mapped(folio) || !folio_raw_mapping(folio)) {
+		if (folio_test_idle(folio))
+			return false;
+		else
+			return true;
+	}
+
+	need_lock = !folio_test_anon(folio) || folio_test_ksm(folio);
+	if (need_lock && !folio_trylock(folio))
+		return false;
+
+	rmap_walk(folio, &rwc);
+
+	if (need_lock)
+		folio_unlock(folio);
+
+	return accessed;
+}
+
+bool damos_folio_filter_match(struct damos_filter *filter, struct folio *folio)
+{
+	bool matched = false;
+	struct mem_cgroup *memcg;
+	size_t folio_sz;
+
+	switch (filter->type) {
+	case DAMOS_FILTER_TYPE_ANON:
+		matched = folio_test_anon(folio);
+		break;
+	case DAMOS_FILTER_TYPE_ACTIVE:
+		matched = folio_test_active(folio);
+		break;
+	case DAMOS_FILTER_TYPE_MEMCG:
+		rcu_read_lock();
+		memcg = folio_memcg_check(folio);
+		if (!memcg)
+			matched = false;
+		else
+			matched = filter->memcg_id == mem_cgroup_id(memcg);
+		rcu_read_unlock();
+		break;
+	case DAMOS_FILTER_TYPE_YOUNG:
+		matched = damon_folio_young(folio);
+		if (matched)
+			damon_folio_mkold(folio);
+		break;
+	case DAMOS_FILTER_TYPE_HUGEPAGE_SIZE:
+		folio_sz = folio_size(folio);
+		matched = filter->sz_range.min <= folio_sz &&
+			  folio_sz <= filter->sz_range.max;
+		break;
+	case DAMOS_FILTER_TYPE_UNMAPPED:
+		matched = !folio_mapped(folio) || !folio_raw_mapping(folio);
+		break;
+	default:
+		break;
+	}
+
+	return matched == filter->matching;
+}
+
+ static unsigned int __damon_migrate_folio_list(
+ 		struct list_head *migrate_folios, struct pglist_data *pgdat,
+ 		int target_nid)
+--- a/mm/damon/ops-common.h
+++ b/mm/damon/ops-common.h
+@@ -11,10 +11,13 @@ struct folio *damon_get_folio(unsigned l
+ 
+ void damon_ptep_mkold(pte_t *pte, struct vm_area_struct *vma, unsigned long addr);
+ void damon_pmdp_mkold(pmd_t *pmd, struct vm_area_struct *vma, unsigned long addr);
+void damon_folio_mkold(struct folio *folio);
+bool damon_folio_young(struct folio *folio);
+ 
+ int damon_cold_score(struct damon_ctx *c, struct damon_region *r,
+ 			struct damos *s);
+ int damon_hot_score(struct damon_ctx *c, struct damon_region *r,
+ 			struct damos *s);
+ 
+bool damos_folio_filter_match(struct damos_filter *filter, struct folio *folio);
+ unsigned long damon_migrate_pages(struct list_head *folio_list, int target_nid);
+--- a/mm/damon/paddr.c
+++ b/mm/damon/paddr.c
+@@ -18,45 +18,6 @@
+ #include "../internal.h"
+ #include "ops-common.h"
+ 
+-static bool damon_folio_mkold_one(struct folio *folio,
+-		struct vm_area_struct *vma, unsigned long addr, void *arg)
+-{
+-	DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0);
+-
+-	while (page_vma_mapped_walk(&pvmw)) {
+-		addr = pvmw.address;
+-		if (pvmw.pte)
+-			damon_ptep_mkold(pvmw.pte, vma, addr);
+-		else
+-			damon_pmdp_mkold(pvmw.pmd, vma, addr);
+-	}
+-	return true;
+-}
+-
+-static void damon_folio_mkold(struct folio *folio)
+-{
+-	struct rmap_walk_control rwc = {
+-		.rmap_one = damon_folio_mkold_one,
+-		.anon_lock = folio_lock_anon_vma_read,
+-	};
+-	bool need_lock;
+-
+-	if (!folio_mapped(folio) || !folio_raw_mapping(folio)) {
+-		folio_set_idle(folio);
+-		return;
+-	}
+-
+-	need_lock = !folio_test_anon(folio) || folio_test_ksm(folio);
+-	if (need_lock && !folio_trylock(folio))
+-		return;
+-
+-	rmap_walk(folio, &rwc);
+-
+-	if (need_lock)
+-		folio_unlock(folio);
+-
+-}
+-
+ static void damon_pa_mkold(unsigned long paddr)
+ {
+ 	struct folio *folio = damon_get_folio(PHYS_PFN(paddr));
+@@ -86,75 +47,6 @@ static void damon_pa_prepare_access_chec
+ 	}
+ }
+ 
+-static bool damon_folio_young_one(struct folio *folio,
+-		struct vm_area_struct *vma, unsigned long addr, void *arg)
+-{
+-	bool *accessed = arg;
+-	DEFINE_FOLIO_VMA_WALK(pvmw, folio, vma, addr, 0);
+-	pte_t pte;
+-
+-	*accessed = false;
+-	while (page_vma_mapped_walk(&pvmw)) {
+-		addr = pvmw.address;
+-		if (pvmw.pte) {
+-			pte = ptep_get(pvmw.pte);
+-
+-			/*
+-			 * PFN swap PTEs, such as device-exclusive ones, that
+-			 * actually map pages are "old" from a CPU perspective.
+-			 * The MMU notifier takes care of any device aspects.
+-			 */
+-			*accessed = (pte_present(pte) && pte_young(pte)) ||
+-				!folio_test_idle(folio) ||
+-				mmu_notifier_test_young(vma->vm_mm, addr);
+-		} else {
+-#ifdef CONFIG_TRANSPARENT_HUGEPAGE
+-			*accessed = pmd_young(pmdp_get(pvmw.pmd)) ||
+-				!folio_test_idle(folio) ||
+-				mmu_notifier_test_young(vma->vm_mm, addr);
+-#else
+-			WARN_ON_ONCE(1);
+-#endif	/* CONFIG_TRANSPARENT_HUGEPAGE */
+-		}
+-		if (*accessed) {
+-			page_vma_mapped_walk_done(&pvmw);
+-			break;
+-		}
+-	}
+-
+-	/* If accessed, stop walking */
+-	return *accessed == false;
+-}
+-
+-static bool damon_folio_young(struct folio *folio)
+-{
+-	bool accessed = false;
+-	struct rmap_walk_control rwc = {
+-		.arg = &accessed,
+-		.rmap_one = damon_folio_young_one,
+-		.anon_lock = folio_lock_anon_vma_read,
+-	};
+-	bool need_lock;
+-
+-	if (!folio_mapped(folio) || !folio_raw_mapping(folio)) {
+-		if (folio_test_idle(folio))
+-			return false;
+-		else
+-			return true;
+-	}
+-
+-	need_lock = !folio_test_anon(folio) || folio_test_ksm(folio);
+-	if (need_lock && !folio_trylock(folio))
+-		return false;
+-
+-	rmap_walk(folio, &rwc);
+-
+-	if (need_lock)
+-		folio_unlock(folio);
+-
+-	return accessed;
+-}
+-
+ static bool damon_pa_young(unsigned long paddr, unsigned long *folio_sz)
+ {
+ 	struct folio *folio = damon_get_folio(PHYS_PFN(paddr));
+@@ -205,49 +97,6 @@ static unsigned int damon_pa_check_acces
+ 	return max_nr_accesses;
+ }
+ 
+-static bool damos_pa_filter_match(struct damos_filter *filter,
+-		struct folio *folio)
+-{
+-	bool matched = false;
+-	struct mem_cgroup *memcg;
+-	size_t folio_sz;
+-
+-	switch (filter->type) {
+-	case DAMOS_FILTER_TYPE_ANON:
+-		matched = folio_test_anon(folio);
+-		break;
+-	case DAMOS_FILTER_TYPE_ACTIVE:
+-		matched = folio_test_active(folio);
+-		break;
+-	case DAMOS_FILTER_TYPE_MEMCG:
+-		rcu_read_lock();
+-		memcg = folio_memcg_check(folio);
+-		if (!memcg)
+-			matched = false;
+-		else
+-			matched = filter->memcg_id == mem_cgroup_id(memcg);
+-		rcu_read_unlock();
+-		break;
+-	case DAMOS_FILTER_TYPE_YOUNG:
+-		matched = damon_folio_young(folio);
+-		if (matched)
+-			damon_folio_mkold(folio);
+-		break;
+-	case DAMOS_FILTER_TYPE_HUGEPAGE_SIZE:
+-		folio_sz = folio_size(folio);
+-		matched = filter->sz_range.min <= folio_sz &&
+-			  folio_sz <= filter->sz_range.max;
+-		break;
+-	case DAMOS_FILTER_TYPE_UNMAPPED:
+-		matched = !folio_mapped(folio) || !folio_raw_mapping(folio);
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	return matched == filter->matching;
+-}
+-
+ /*
+  * damos_pa_filter_out - Return true if the page should be filtered out.
+  */
+@@ -259,7 +108,7 @@ static bool damos_pa_filter_out(struct d
+ 		return false;
+ 
+ 	damos_for_each_ops_filter(filter, scheme) {
+-		if (damos_pa_filter_match(filter, folio))
+		if (damos_folio_filter_match(filter, folio))
+ 			return !filter->allow;
+ 	}
+ 	return scheme->ops_filters_default_reject;
--- a/debian/patches/patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch
+++ b/debian/patches/patchset-pf/steady/0022-mm-damon-ops-common-ignore-migration-request-to-inva.patch
@@ -0,0 +1,58 @@
+From 28ceaa34f71077b305a2fae3abf9e8af606fbae7 Mon Sep 17 00:00:00 2001
+From: SeongJae Park <sj@kernel.org>
+Date: Sun, 20 Jul 2025 11:58:22 -0700
+Subject: mm/damon/ops-common: ignore migration request to invalid nodes
+
+damon_migrate_pages() tries migration even if the target node is invalid.
+If users mistakenly make such invalid requests via
+DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen.
+
+    [ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48
+    [ 7831.884160] #PF: supervisor read access in kernel mode
+    [ 7831.884681] #PF: error_code(0x0000) - not-present page
+    [ 7831.885203] PGD 0 P4D 0
+    [ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI
+    [ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary)
+    [ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014
+    [ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137)
+    [...]
+    [ 7831.895953] Call Trace:
+    [ 7831.896195]  <TASK>
+    [ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192)
+    [ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851)
+    [ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137)
+    [ 7831.897735] migrate_pages (mm/migrate.c:2078)
+    [ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137)
+    [ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354)
+    [ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405)
+    [...]
+
+Add a target node validity check in damon_migrate_pages().  The validity
+check is stolen from that of do_pages_move(), which is being used for the
+move_pages() system call.
+
+Link: https://lkml.kernel.org/r/20250720185822.1451-1-sj@kernel.org
+Fixes: b51820ebea65 ("mm/damon/paddr: introduce DAMOS_MIGRATE_COLD action for demotion")	[6.11.x]
+Signed-off-by: SeongJae Park <sj@kernel.org>
+Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
+Cc: Honggyu Kim <honggyu.kim@sk.com>
+Cc: Hyeongtak Ji <hyeongtak.ji@sk.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/damon/ops-common.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/mm/damon/ops-common.c
+++ b/mm/damon/ops-common.c
+@@ -383,6 +383,10 @@ unsigned long damon_migrate_pages(struct
+ 	if (list_empty(folio_list))
+ 		return nr_migrated;
+ 
+	if (target_nid < 0 || target_nid >= MAX_NUMNODES ||
+			!node_state(target_nid, N_MEMORY))
+		return nr_migrated;
+
+ 	noreclaim_flag = memalloc_noreclaim_save();
+ 
+ 	nid = folio_nid(lru_to_folio(folio_list));
--- a/debian/patches/patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch
+++ b/debian/patches/patchset-pf/steady/0023-usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbin.patch
@@ -0,0 +1,28 @@
+From 20235e70d4e5f0f66e0b037e9e02ca7ec0cf97a5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 24 Jul 2025 11:19:08 +0200
+Subject: usb: gadget: udc: renesas_usb3: fix device leak at unbind
+
+Make sure to drop the reference to the companion device taken during
+probe when the driver is unbound.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Cc: stable@vger.kernel.org	# 4.19
+Cc: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2657,6 +2657,7 @@ static void renesas_usb3_remove(struct p
+ 	struct renesas_usb3 *usb3 = platform_get_drvdata(pdev);
+ 
+ 	debugfs_remove_recursive(usb3->dentry);
+	put_device(usb3->host_dev);
+ 	device_remove_file(&pdev->dev, &dev_attr_role);
+ 
+ 	cancel_work_sync(&usb3->role_work);
--- a/debian/patches/patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch
+++ b/debian/patches/patchset-pf/steady/0024-PCI-portdrv-Use-is_pciehp-instead-of-is_hotplug_brid.patch
@@ -0,0 +1,36 @@
+From b958aba8ee0d90742627dd46324cd29fd3e3abce Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sun, 13 Jul 2025 16:31:02 +0200
+Subject: PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge
+
+The PCIe port driver erroneously creates a subdevice for hotplug on ACPI
+slots which are handled by the ACPI hotplug driver.
+
+Avoid by checking the is_pciehp flag instead of is_hotplug_bridge when
+deciding whether to create a subdevice.  The latter encompasses ACPI slots
+whereas the former doesn't.
+
+The superfluous subdevice has no real negative impact, it occupies memory
+and interrupt resources but otherwise just sits there waiting for
+interrupts from the slot that are never signaled.
+
+Fixes: f8415222837b ("PCI: Use cached copy of PCI_EXP_SLTCAP_HPC bit")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v4.7+
+Link: https://patch.msgid.link/40d5a5fe8d40595d505949c620a067fa110ee85e.1752390102.git.lukas@wunner.de
+---
+ drivers/pci/pcie/portdrv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/portdrv.c
+++ b/drivers/pci/pcie/portdrv.c
+@@ -220,7 +220,7 @@ static int get_port_device_capability(st
+ 	struct pci_host_bridge *host = pci_find_host_bridge(dev->bus);
+ 	int services = 0;
+ 
+-	if (dev->is_hotplug_bridge &&
+	if (dev->is_pciehp &&
+ 	    (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT ||
+ 	     pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM) &&
+ 	    (pcie_ports_native || host->native_pcie_hotplug)) {
--- a/debian/patches/patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch
+++ b/debian/patches/patchset-pf/steady/0025-ata-libata-scsi-Fix-ata_to_sense_error-status-handli.patch
@@ -0,0 +1,85 @@
+From eb5df6a83646eb2ecd7eda995b5632031acf94b3 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 29 Jul 2025 18:28:07 +0900
+Subject: ata: libata-scsi: Fix ata_to_sense_error() status handling
+
+Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()")
+inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in
+the function ata_to_sense_error(). This entry ties a failed qc which has
+a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with
+the additional sense code UNALIGNED WRITE COMMAND. This entry will be
+used to generate a failed qc sense key and sense code when the qc is
+missing sense data and there is no match for the qc error field in the
+sense_table array of ata_to_sense_error().
+
+As a result, for a failed qc for which we failed to get sense data (e.g.
+read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT
+command failed for the non-ncq case, the user very often end up seeing
+the completely misleading "unaligned write command" error, even if qc
+was not a write command. E.g.:
+
+sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
+sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current]
+sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command
+sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
+I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
+
+Fix this by removing the ATA_DRDY entry from the stat_table array so
+that we default to always returning ABORTED COMMAND without any
+additional sense code, since we do not know any better. The entry 0x08
+(ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity
+error is also misleading (as a parity error would likely be signaled
+through a bus error). So for this case, also default to returning
+ABORTED COMMAND without any additional sense code. With this, the
+previous example error case becomes:
+
+sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
+sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current]
+sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information
+sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
+I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
+
+Together with these fixes, refactor stat_table to make it more readable
+by putting the entries comments in front of the entries and using the
+defined status bits macros instead of hardcoded values.
+
+Reported-by: Lorenz Brun <lorenz@brun.one>
+Reported-by: Brandon Schwartz <Brandon.Schwartz@wdc.com>
+Fixes: 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/ata/libata-scsi.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
+@@ -859,18 +859,14 @@ static void ata_to_sense_error(u8 drv_st
+ 		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
+ 	};
+ 	static const unsigned char stat_table[][4] = {
+-		/* Must be first because BUSY means no other bits valid */
+-		{0x80,		ABORTED_COMMAND, 0x47, 0x00},
+-		// Busy, fake parity for now
+-		{0x40,		ILLEGAL_REQUEST, 0x21, 0x04},
+-		// Device ready, unaligned write command
+-		{0x20,		HARDWARE_ERROR,  0x44, 0x00},
+-		// Device fault, internal target failure
+-		{0x08,		ABORTED_COMMAND, 0x47, 0x00},
+-		// Timed out in xfer, fake parity for now
+-		{0x04,		RECOVERED_ERROR, 0x11, 0x00},
+-		// Recovered ECC error	  Medium error, recovered
+-		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
+		/* Busy: must be first because BUSY means no other bits valid */
+		{ ATA_BUSY,	ABORTED_COMMAND, 0x00, 0x00 },
+		/* Device fault: INTERNAL TARGET FAILURE */
+		{ ATA_DF,	HARDWARE_ERROR,  0x44, 0x00 },
+		/* Corrected data error */
+		{ ATA_CORR,	RECOVERED_ERROR, 0x00, 0x00 },
+
+		{ 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */
+ 	};
+ 
+ 	/*
--- a/debian/patches/patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch
+++ b/debian/patches/patchset-pf/steady/0026-ata-libata-scsi-Return-aborted-command-when-missing-.patch
@@ -0,0 +1,69 @@
+From 222f2d776f617895a876ccd7047cbebc82175f38 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 29 Jul 2025 19:37:12 +0900
+Subject: ata: libata-scsi: Return aborted command when missing sense and
+ result TF
+
+ata_gen_ata_sense() is always called for a failed qc missing sense data
+so that a sense key, code and code qualifier can be generated using
+ata_to_sense_error() from the qc status and error fields of its result
+task file. However, if the qc does not have its result task file filled,
+ata_gen_ata_sense() returns early without setting a sense key.
+
+Improve this by defaulting to returning ABORTED COMMAND without any
+additional sense code, since we do not know the reason for the failure.
+The same fix is also applied in ata_gen_passthru_sense() with the
+additional check that the qc failed (qc->err_mask is set).
+
+Fixes: 816be86c7993 ("ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/ata/libata-scsi.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
+@@ -938,6 +938,8 @@ static void ata_gen_passthru_sense(struc
+ 	if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) {
+ 		ata_dev_dbg(dev,
+ 			    "missing result TF: can't generate ATA PT sense data\n");
+		if (qc->err_mask)
+			ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0);
+ 		return;
+ 	}
+ 
+@@ -992,8 +994,8 @@ static void ata_gen_ata_sense(struct ata
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_RTF_FILLED)) {
+ 		ata_dev_dbg(dev,
+-			    "missing result TF: can't generate sense data\n");
+-		return;
+			    "Missing result TF: reporting aborted command\n");
+		goto aborted;
+ 	}
+ 
+ 	/* Use ata_to_sense_error() to map status register bits
+@@ -1004,13 +1006,15 @@ static void ata_gen_ata_sense(struct ata
+ 		ata_to_sense_error(tf->status, tf->error,
+ 				   &sense_key, &asc, &ascq);
+ 		ata_scsi_set_sense(dev, cmd, sense_key, asc, ascq);
+-	} else {
+-		/* Could not decode error */
+-		ata_dev_warn(dev, "could not decode error status 0x%x err_mask 0x%x\n",
+-			     tf->status, qc->err_mask);
+-		ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0);
+ 		return;
+ 	}
+
+	/* Could not decode error */
+	ata_dev_warn(dev,
+		"Could not decode error 0x%x, status 0x%x (err_mask=0x%x)\n",
+		tf->error, tf->status, qc->err_mask);
+aborted:
+	ata_scsi_set_sense(dev, cmd, ABORTED_COMMAND, 0, 0);
+ }
+ 
+ void ata_scsi_sdev_config(struct scsi_device *sdev)
--- a/debian/patches/patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch
+++ b/debian/patches/patchset-pf/steady/0027-vhost-vsock-Avoid-allocating-arbitrarily-sized-SKBs.patch
@@ -0,0 +1,48 @@
+From 1696616a3e6e9d5eef2c39723ddaafb78a9a6eeb Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 17 Jul 2025 10:01:08 +0100
+Subject: vhost/vsock: Avoid allocating arbitrarily-sized SKBs
+
+vhost_vsock_alloc_skb() returns NULL for packets advertising a length
+larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However,
+this is only checked once the SKB has been allocated and, if the length
+in the packet header is zero, the SKB may not be freed immediately.
+
+Hoist the size check before the SKB allocation so that an iovec larger
+than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected
+outright. The subsequent check on the length field in the header can
+then simply check that the allocated SKB is indeed large enough to hold
+the packet.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Message-Id: <20250717090116.11987-2-will@kernel.org>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+---
+ drivers/vhost/vsock.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
+@@ -344,6 +344,9 @@ vhost_vsock_alloc_skb(struct vhost_virtq
+ 
+ 	len = iov_length(vq->iov, out);
+ 
+	if (len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM)
+		return NULL;
+
+ 	/* len contains both payload and hdr */
+ 	skb = virtio_vsock_alloc_skb(len, GFP_KERNEL);
+ 	if (!skb)
+@@ -367,8 +370,7 @@ vhost_vsock_alloc_skb(struct vhost_virtq
+ 		return skb;
+ 
+ 	/* The pkt is too big or the length in the header is invalid */
+-	if (payload_len > VIRTIO_VSOCK_MAX_PKT_BUF_SIZE ||
+-	    payload_len + sizeof(*hdr) > len) {
+	if (payload_len + sizeof(*hdr) > len) {
+ 		kfree_skb(skb);
+ 		return NULL;
+ 	}
--- a/debian/patches/patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch
+++ b/debian/patches/patchset-pf/steady/0028-vsock-virtio-Validate-length-in-packet-header-before.patch
@@ -0,0 +1,57 @@
+From cfb5ffceff501d3ffe6529706d65a35e6068b638 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will@kernel.org>
+Date: Thu, 17 Jul 2025 10:01:09 +0100
+Subject: vsock/virtio: Validate length in packet header before skb_put()
+
+When receiving a vsock packet in the guest, only the virtqueue buffer
+size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately,
+virtio_vsock_skb_rx_put() uses the length from the packet header as the
+length argument to skb_put(), potentially resulting in SKB overflow if
+the host has gone wonky.
+
+Validate the length as advertised by the packet header before calling
+virtio_vsock_skb_rx_put().
+
+Cc: <stable@vger.kernel.org>
+Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
+Signed-off-by: Will Deacon <will@kernel.org>
+Message-Id: <20250717090116.11987-3-will@kernel.org>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+---
+ net/vmw_vsock/virtio_transport.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
+@@ -624,8 +624,9 @@ static void virtio_transport_rx_work(str
+ 	do {
+ 		virtqueue_disable_cb(vq);
+ 		for (;;) {
+			unsigned int len, payload_len;
+			struct virtio_vsock_hdr *hdr;
+ 			struct sk_buff *skb;
+-			unsigned int len;
+ 
+ 			if (!virtio_transport_more_replies(vsock)) {
+ 				/* Stop rx until the device processes already
+@@ -642,11 +643,18 @@ static void virtio_transport_rx_work(str
+ 			vsock->rx_buf_nr--;
+ 
+ 			/* Drop short/long packets */
+-			if (unlikely(len < sizeof(struct virtio_vsock_hdr) ||
+			if (unlikely(len < sizeof(*hdr) ||
+ 				     len > virtio_vsock_skb_len(skb))) {
+ 				kfree_skb(skb);
+ 				continue;
+ 			}
+
+			hdr = virtio_vsock_hdr(skb);
+			payload_len = le32_to_cpu(hdr->len);
+			if (unlikely(payload_len > len - sizeof(*hdr))) {
+				kfree_skb(skb);
+				continue;
+			}
+ 
+ 			virtio_vsock_skb_rx_put(skb);
+ 			virtio_transport_deliver_tap_pkt(skb);
--- a/debian/patches/patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch
+++ b/debian/patches/patchset-pf/steady/0029-fs-proc-task_mmu-remove-conversion-of-seq_file-posit.patch
@@ -0,0 +1,105 @@
+From b7e9e555a80801d33d94287307e7b7606501cffb Mon Sep 17 00:00:00 2001
+From: Suren Baghdasaryan <surenb@google.com>
+Date: Sat, 19 Jul 2025 11:28:53 -0700
+Subject: fs/proc/task_mmu: remove conversion of seq_file position to unsigned
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Back in 2.6 era, last_addr used to be stored in seq_file->version
+variable, which was unsigned long.  As a result, sentinels to represent
+gate vma and end of all vmas used unsigned values.  In more recent kernels
+we don't used seq_file->version anymore and therefore conversion from
+loff_t into unsigned type is not needed.  Similarly, sentinel values don't
+need to be unsigned.  Remove type conversion for set_file position and
+change sentinel values to signed.  While at it, change the hardcoded
+sentinel values with named definitions for better documentation.
+
+Link: https://lkml.kernel.org/r/20250719182854.3166724-6-surenb@google.com
+Signed-off-by: Suren Baghdasaryan <surenb@google.com>
+Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
+Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: David Hildenbrand <david@redhat.com>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Andrii Nakryiko <andrii@kernel.org>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Jann Horn <jannh@google.com>
+Cc: Jeongjun Park <aha310510@gmail.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Josef Bacik <josef@toxicpanda.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
+Cc: Michal Hocko <mhocko@kernel.org>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: "Paul E . McKenney" <paulmck@kernel.org>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Thomas Weißschuh <linux@weissschuh.net>
+Cc: T.J. Mercier <tjmercier@google.com>
+Cc: Ye Bin <yebin10@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/proc/task_mmu.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
+@@ -29,6 +29,9 @@
+ #include <asm/tlbflush.h>
+ #include "internal.h"
+ 
+#define SENTINEL_VMA_END	-1
+#define SENTINEL_VMA_GATE	-2
+
+ #define SEQ_PUT_DEC(str, val) \
+ 		seq_put_decimal_ull_width(m, str, (val) << (PAGE_SHIFT-10), 8)
+ void task_mem(struct seq_file *m, struct mm_struct *mm)
+@@ -135,7 +138,7 @@ static struct vm_area_struct *proc_get_v
+ 	if (vma) {
+ 		*ppos = vma->vm_start;
+ 	} else {
+-		*ppos = -2UL;
+		*ppos = SENTINEL_VMA_GATE;
+ 		vma = get_gate_vma(priv->mm);
+ 	}
+ 
+@@ -145,11 +148,11 @@ static struct vm_area_struct *proc_get_v
+ static void *m_start(struct seq_file *m, loff_t *ppos)
+ {
+ 	struct proc_maps_private *priv = m->private;
+-	unsigned long last_addr = *ppos;
+	loff_t last_addr = *ppos;
+ 	struct mm_struct *mm;
+ 
+ 	/* See m_next(). Zero at the start or after lseek. */
+-	if (last_addr == -1UL)
+	if (last_addr == SENTINEL_VMA_END)
+ 		return NULL;
+ 
+ 	priv->task = get_proc_task(priv->inode);
+@@ -170,9 +173,9 @@ static void *m_start(struct seq_file *m,
+ 		return ERR_PTR(-EINTR);
+ 	}
+ 
+-	vma_iter_init(&priv->iter, mm, last_addr);
+	vma_iter_init(&priv->iter, mm, (unsigned long)last_addr);
+ 	hold_task_mempolicy(priv);
+-	if (last_addr == -2UL)
+	if (last_addr == SENTINEL_VMA_GATE)
+ 		return get_gate_vma(mm);
+ 
+ 	return proc_get_vma(priv, ppos);
+@@ -180,8 +183,8 @@ static void *m_start(struct seq_file *m,
+ 
+ static void *m_next(struct seq_file *m, void *v, loff_t *ppos)
+ {
+-	if (*ppos == -2UL) {
+-		*ppos = -1UL;
+	if (*ppos == SENTINEL_VMA_GATE) {
+		*ppos = SENTINEL_VMA_END;
+ 		return NULL;
+ 	}
+ 	return proc_get_vma(m->private, ppos);
--- a/debian/patches/patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch
+++ b/debian/patches/patchset-pf/steady/0030-kbuild-userprogs-use-correct-linker-when-mixing-clan.patch
@@ -0,0 +1,36 @@
+From 49442fb626f151f886cb5a860c972c300307fdff Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas.weissschuh@linutronix.de>
+Date: Mon, 28 Jul 2025 15:47:37 +0200
+Subject: kbuild: userprogs: use correct linker when mixing clang and GNU ld
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The userprogs infrastructure does not expect clang being used with GNU ld
+and in that case uses /usr/bin/ld for linking, not the configured $(LD).
+This fallback is problematic as it will break when cross-compiling.
+Mixing clang and GNU ld is used for example when building for SPARC64,
+as ld.lld is not sufficient; see Documentation/kbuild/llvm.rst.
+
+Relax the check around --ld-path so it gets used for all linkers.
+
+Fixes: dfc1b168a8c4 ("kbuild: userprogs: use correct lld when linking through clang")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
+++ b/Makefile
+@@ -1154,7 +1154,7 @@ KBUILD_USERCFLAGS  += $(filter -m32 -m64
+ KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS))
+ 
+ # userspace programs are linked via the compiler, use the correct linker
+-ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_LD_IS_LLD),yy)
+ifdef CONFIG_CC_IS_CLANG
+ KBUILD_USERLDFLAGS += --ld-path=$(LD)
+ endif
+ 
--- a/debian/patches/patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch
+++ b/debian/patches/patchset-pf/steady/0031-Revert-vgacon-Add-check-for-vc_origin-address-range-.patch
@@ -0,0 +1,36 @@
+From 31a1e00a65d88e2f051fb6e9551340cc815d54d4 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 2 Aug 2025 21:34:37 +0200
+Subject: Revert "vgacon: Add check for vc_origin address range in
+ vgacon_scroll()"
+
+This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003.
+
+The patch is wrong as it checks vc_origin against vc_screenbuf,
+while in text mode it should compare against vga_vram_base.
+
+As such it broke VGA text scrolling, which can be reproduced like this:
+(1) boot a kernel that is configured to use text mode VGA-console
+(2) type commands:  ls -l /usr/bin | less -S
+(3) scroll up/down with cursor-down/up keys
+
+Reported-by: Jari Ruusu <jariruusu@protonmail.com>
+Cc: stable@vger.kernel.org
+Cc: Yi Yang <yiyang13@huawei.com>
+Cc: GONG Ruiqi <gongruiqi1@huawei.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+---
+ drivers/video/console/vgacon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
+@@ -1168,7 +1168,7 @@ static bool vgacon_scroll(struct vc_data
+ 				     c->vc_screenbuf_size - delta);
+ 			c->vc_origin = vga_vram_end - c->vc_screenbuf_size;
+ 			vga_rolled_over = 0;
+-		} else if (oldo - delta >= (unsigned long)c->vc_screenbuf)
+		} else
+ 			c->vc_origin -= delta;
+ 		c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;
+ 		scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
--- a/debian/patches/patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch
+++ b/debian/patches/patchset-pf/steady/0032-crypto-hash-Increase-HASH_MAX_DESCSIZE-for-hmac-sha3.patch
@@ -0,0 +1,28 @@
+From 5c50d7a4d6580d6cc83d1231aa358defe43bc46d Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Thu, 31 Jul 2025 09:41:47 +0800
+Subject: crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390)
+
+The value of HASH_MAX_DESCSIZE is off by one for hmac(sha3-224-s390).
+Fix this so that hmac(sha3-224-s390) can be registered.
+
+Reported-by: Ingo Franzki <ifranzki@linux.ibm.com>
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Fixes: 6f90ba706551 ("crypto: s390/sha3 - Use API partial block handling")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ include/crypto/hash.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
+@@ -184,7 +184,7 @@ struct shash_desc {
+  * Worst case is hmac(sha3-224-s390).  Its context is a nested 'shash_desc'
+  * containing a 'struct s390_sha_ctx'.
+  */
+-#define HASH_MAX_DESCSIZE	(sizeof(struct shash_desc) + 360)
+#define HASH_MAX_DESCSIZE	(sizeof(struct shash_desc) + 361)
+ #define MAX_SYNC_HASH_REQSIZE	(sizeof(struct ahash_request) + \
+ 				 HASH_MAX_DESCSIZE)
+ 
--- a/debian/patches/patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch
+++ b/debian/patches/patchset-pf/steady/0033-cifs-Add-support-for-creating-reparse-points-over-SM.patch
@@ -0,0 +1,478 @@
+From 1b49e1eaff6d1d665cacad667a1fc03c38fc8533 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 26 Dec 2024 00:43:22 +0100
+Subject: cifs: Add support for creating reparse points over SMB1
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SMB1 already supports querying reparse points and detecting types of
+symlink, fifo, socket, block and char.
+
+This change implements the missing part - ability to create a new reparse
+points over SMB1. This includes everything which SMB2+ already supports:
+- native SMB symlinks and sockets
+- NFS style of special files (symlinks, fifos, sockets, char/block devs)
+- WSL style of special files (symlinks, fifos, sockets, char/block devs)
+
+Attaching a reparse point to an existing file or directory is done via
+SMB1 SMB_COM_NT_TRANSACT/NT_TRANSACT_IOCTL/FSCTL_SET_REPARSE_POINT command
+and implemented in a new cifs_create_reparse_inode() function.
+
+This change introduce a new callback ->create_reparse_inode() which creates
+a new reperse point file or directory and returns inode. For SMB1 it is
+provided via that new cifs_create_reparse_inode() function.
+
+Existing reparse.c code was only slightly updated to call new protocol
+callback ->create_reparse_inode() instead of hardcoded SMB2+ function.
+This make the whole reparse.c code to work with every SMB dialect.
+
+The original callback ->create_reparse_symlink() is not needed anymore as
+the implementation of new create_reparse_symlink() function is dialect
+agnostic too. So the link.c code was updated to call that function directly
+(and not via callback).
+
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+---
+ fs/smb/client/cifsglob.h  |  14 +++--
+ fs/smb/client/cifsproto.h |   8 +++
+ fs/smb/client/cifssmb.c   | 128 ++++++++++++++++++++++++++++++++++++++
+ fs/smb/client/link.c      |  13 ++--
+ fs/smb/client/reparse.c   |  16 +++--
+ fs/smb/client/reparse.h   |   4 +-
+ fs/smb/client/smb1ops.c   |  31 ++++++---
+ fs/smb/client/smb2inode.c |   2 +-
+ fs/smb/client/smb2ops.c   |  10 +--
+ fs/smb/client/smb2proto.h |   5 +-
+ 10 files changed, 188 insertions(+), 43 deletions(-)
+
+--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
+@@ -627,12 +627,14 @@ struct smb_version_operations {
+ 	bool (*is_network_name_deleted)(char *buf, struct TCP_Server_Info *srv);
+ 	struct reparse_data_buffer * (*get_reparse_point_buffer)(const struct kvec *rsp_iov,
+ 								 u32 *plen);
+-	int (*create_reparse_symlink)(const unsigned int xid,
+-				      struct inode *inode,
+-				      struct dentry *dentry,
+-				      struct cifs_tcon *tcon,
+-				      const char *full_path,
+-				      const char *symname);
+	struct inode * (*create_reparse_inode)(struct cifs_open_info_data *data,
+					       struct super_block *sb,
+					       const unsigned int xid,
+					       struct cifs_tcon *tcon,
+					       const char *full_path,
+					       bool directory,
+					       struct kvec *reparse_iov,
+					       struct kvec *xattr_iov);
+ };
+ 
+ struct smb_version_values {
+--- a/fs/smb/client/cifsproto.h
+++ b/fs/smb/client/cifsproto.h
+@@ -483,6 +483,14 @@ extern int cifs_query_reparse_point(cons
+ 				    const char *full_path,
+ 				    u32 *tag, struct kvec *rsp,
+ 				    int *rsp_buftype);
+extern struct inode *cifs_create_reparse_inode(struct cifs_open_info_data *data,
+					       struct super_block *sb,
+					       const unsigned int xid,
+					       struct cifs_tcon *tcon,
+					       const char *full_path,
+					       bool directory,
+					       struct kvec *reparse_iov,
+					       struct kvec *xattr_iov);
+ extern int CIFSSMB_set_compression(const unsigned int xid,
+ 				   struct cifs_tcon *tcon, __u16 fid);
+ extern int CIFS_open(const unsigned int xid, struct cifs_open_parms *oparms,
+--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
+@@ -2851,6 +2851,134 @@ error:
+ 	return rc;
+ }
+ 
+struct inode *cifs_create_reparse_inode(struct cifs_open_info_data *data,
+					struct super_block *sb,
+					const unsigned int xid,
+					struct cifs_tcon *tcon,
+					const char *full_path,
+					bool directory,
+					struct kvec *reparse_iov,
+					struct kvec *xattr_iov)
+{
+	struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
+	struct cifs_open_parms oparms;
+	TRANSACT_IOCTL_REQ *io_req;
+	struct inode *new = NULL;
+	struct kvec in_iov[2];
+	struct kvec out_iov;
+	struct cifs_fid fid;
+	int io_req_len;
+	int oplock = 0;
+	int buf_type = 0;
+	int rc;
+
+	cifs_tcon_dbg(FYI, "%s: path=%s\n", __func__, full_path);
+
+	/*
+	 * If server filesystem does not support reparse points then do not
+	 * attempt to create reparse point. This will prevent creating unusable
+	 * empty object on the server.
+	 */
+	if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS))
+		return ERR_PTR(-EOPNOTSUPP);
+
+#ifndef CONFIG_CIFS_XATTR
+	if (xattr_iov)
+		return ERR_PTR(-EOPNOTSUPP);
+#endif
+
+	oparms = CIFS_OPARMS(cifs_sb, tcon, full_path,
+			     FILE_READ_ATTRIBUTES | FILE_WRITE_DATA | FILE_WRITE_EA,
+			     FILE_CREATE,
+			     (directory ? CREATE_NOT_FILE : CREATE_NOT_DIR) | OPEN_REPARSE_POINT,
+			     ACL_NO_MODE);
+	oparms.fid = &fid;
+
+	rc = CIFS_open(xid, &oparms, &oplock, NULL);
+	if (rc)
+		return ERR_PTR(rc);
+
+#ifdef CONFIG_CIFS_XATTR
+	if (xattr_iov) {
+		struct smb2_file_full_ea_info *ea;
+
+		ea = &((struct smb2_create_ea_ctx *)xattr_iov->iov_base)->ea;
+		while (1) {
+			rc = CIFSSMBSetEA(xid,
+					  tcon,
+					  full_path,
+					  &ea->ea_data[0],
+					  &ea->ea_data[ea->ea_name_length+1],
+					  le16_to_cpu(ea->ea_value_length),
+					  cifs_sb->local_nls,
+					  cifs_sb);
+			if (rc)
+				goto out_close;
+			if (le32_to_cpu(ea->next_entry_offset) == 0)
+				break;
+			ea = (struct smb2_file_full_ea_info *)((u8 *)ea +
+				le32_to_cpu(ea->next_entry_offset));
+		}
+	}
+#endif
+
+	rc = smb_init(SMB_COM_NT_TRANSACT, 23, tcon, (void **)&io_req, NULL);
+	if (rc)
+		goto out_close;
+
+	inc_rfc1001_len(io_req, sizeof(io_req->Pad));
+
+	io_req_len = be32_to_cpu(io_req->hdr.smb_buf_length) + sizeof(io_req->hdr.smb_buf_length);
+
+	/* NT IOCTL response contains one-word long output setup buffer with size of output data. */
+	io_req->MaxSetupCount = 1;
+	/* NT IOCTL response does not contain output parameters. */
+	io_req->MaxParameterCount = cpu_to_le32(0);
+	/* FSCTL_SET_REPARSE_POINT response contains empty output data. */
+	io_req->MaxDataCount = cpu_to_le32(0);
+
+	io_req->TotalParameterCount = cpu_to_le32(0);
+	io_req->TotalDataCount = cpu_to_le32(reparse_iov->iov_len);
+	io_req->ParameterCount = io_req->TotalParameterCount;
+	io_req->ParameterOffset = cpu_to_le32(0);
+	io_req->DataCount = io_req->TotalDataCount;
+	io_req->DataOffset = cpu_to_le32(offsetof(typeof(*io_req), Data) -
+					 sizeof(io_req->hdr.smb_buf_length));
+	io_req->SetupCount = 4;
+	io_req->SubCommand = cpu_to_le16(NT_TRANSACT_IOCTL);
+	io_req->FunctionCode = cpu_to_le32(FSCTL_SET_REPARSE_POINT);
+	io_req->Fid = fid.netfid;
+	io_req->IsFsctl = 1;
+	io_req->IsRootFlag = 0;
+	io_req->ByteCount = cpu_to_le16(le32_to_cpu(io_req->DataCount) + sizeof(io_req->Pad));
+
+	inc_rfc1001_len(io_req, reparse_iov->iov_len);
+
+	in_iov[0].iov_base = (char *)io_req;
+	in_iov[0].iov_len = io_req_len;
+	in_iov[1] = *reparse_iov;
+	rc = SendReceive2(xid, tcon->ses, in_iov, ARRAY_SIZE(in_iov), &buf_type,
+			  CIFS_NO_RSP_BUF, &out_iov);
+
+	cifs_buf_release(io_req);
+
+	if (!rc)
+		rc = cifs_get_inode_info(&new, full_path, data, sb, xid, NULL);
+
+out_close:
+	CIFSSMBClose(xid, tcon, fid.netfid);
+
+	/*
+	 * If CREATE was successful but FSCTL_SET_REPARSE_POINT failed then
+	 * remove the intermediate object created by CREATE. Otherwise
+	 * empty object stay on the server when reparse call failed.
+	 */
+	if (rc)
+		CIFSSMBDelFile(xid, tcon, full_path, cifs_sb, NULL);
+
+	return rc ? ERR_PTR(rc) : new;
+}
+
+ int
+ CIFSSMB_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
+ 		    __u16 fid)
+--- a/fs/smb/client/link.c
+++ b/fs/smb/client/link.c
+@@ -19,6 +19,7 @@
+ #include "smb2proto.h"
+ #include "cifs_ioctl.h"
+ #include "fs_context.h"
+#include "reparse.h"
+ 
+ /*
+  * M-F Symlink Functions - Begin
+@@ -570,7 +571,6 @@ cifs_symlink(struct mnt_idmap *idmap, st
+ 	int rc = -EOPNOTSUPP;
+ 	unsigned int xid;
+ 	struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+-	struct TCP_Server_Info *server;
+ 	struct tcon_link *tlink;
+ 	struct cifs_tcon *pTcon;
+ 	const char *full_path;
+@@ -593,7 +593,6 @@ cifs_symlink(struct mnt_idmap *idmap, st
+ 		goto symlink_exit;
+ 	}
+ 	pTcon = tlink_tcon(tlink);
+-	server = cifs_pick_channel(pTcon->ses);
+ 
+ 	full_path = build_path_from_dentry(direntry, page);
+ 	if (IS_ERR(full_path)) {
+@@ -636,13 +635,9 @@ cifs_symlink(struct mnt_idmap *idmap, st
+ 	case CIFS_SYMLINK_TYPE_NATIVE:
+ 	case CIFS_SYMLINK_TYPE_NFS:
+ 	case CIFS_SYMLINK_TYPE_WSL:
+-		if (server->ops->create_reparse_symlink &&
+-		    (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)) {
+-			rc = server->ops->create_reparse_symlink(xid, inode,
+-								 direntry,
+-								 pTcon,
+-								 full_path,
+-								 symname);
+		if (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) {
+			rc = create_reparse_symlink(xid, inode, direntry, pTcon,
+						    full_path, symname);
+ 			goto symlink_exit;
+ 		}
+ 		break;
+--- a/fs/smb/client/reparse.c
+++ b/fs/smb/client/reparse.c
+@@ -34,7 +34,7 @@ static int detect_directory_symlink_targ
+ 					   const char *symname,
+ 					   bool *directory);
+ 
+-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+int create_reparse_symlink(const unsigned int xid, struct inode *inode,
+ 				struct dentry *dentry, struct cifs_tcon *tcon,
+ 				const char *full_path, const char *symname)
+ {
+@@ -227,7 +227,8 @@ static int create_native_symlink(const u
+ 
+ 	iov.iov_base = buf;
+ 	iov.iov_len = len;
+-	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
+	new = tcon->ses->server->ops->create_reparse_inode(
+				     &data, inode->i_sb, xid,
+ 				     tcon, full_path, directory,
+ 				     &iov, NULL);
+ 	if (!IS_ERR(new))
+@@ -399,7 +400,8 @@ static int create_native_socket(const un
+ 	struct inode *new;
+ 	int rc = 0;
+ 
+-	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
+	new = tcon->ses->server->ops->create_reparse_inode(
+				     &data, inode->i_sb, xid,
+ 				     tcon, full_path, false, &iov, NULL);
+ 	if (!IS_ERR(new))
+ 		d_instantiate(dentry, new);
+@@ -492,7 +494,8 @@ static int mknod_nfs(unsigned int xid, s
+ 		.symlink_target = kstrdup(symname, GFP_KERNEL),
+ 	};
+ 
+-	new = smb2_get_reparse_inode(&data, inode->i_sb, xid,
+	new = tcon->ses->server->ops->create_reparse_inode(
+				     &data, inode->i_sb, xid,
+ 				     tcon, full_path, false, &iov, NULL);
+ 	if (!IS_ERR(new))
+ 		d_instantiate(dentry, new);
+@@ -685,7 +688,8 @@ static int mknod_wsl(unsigned int xid, s
+ 	memcpy(data.wsl.eas, &cc->ea, len);
+ 	data.wsl.eas_len = len;
+ 
+-	new = smb2_get_reparse_inode(&data, inode->i_sb,
+	new = tcon->ses->server->ops->create_reparse_inode(
+				     &data, inode->i_sb,
+ 				     xid, tcon, full_path, false,
+ 				     &reparse_iov, &xattr_iov);
+ 	if (!IS_ERR(new))
+@@ -698,7 +702,7 @@ static int mknod_wsl(unsigned int xid, s
+ 	return rc;
+ }
+ 
+-int smb2_mknod_reparse(unsigned int xid, struct inode *inode,
+int mknod_reparse(unsigned int xid, struct inode *inode,
+ 		       struct dentry *dentry, struct cifs_tcon *tcon,
+ 		       const char *full_path, umode_t mode, dev_t dev)
+ {
+--- a/fs/smb/client/reparse.h
+++ b/fs/smb/client/reparse.h
+@@ -129,10 +129,10 @@ static inline bool cifs_open_data_repars
+ bool cifs_reparse_point_to_fattr(struct cifs_sb_info *cifs_sb,
+ 				 struct cifs_fattr *fattr,
+ 				 struct cifs_open_info_data *data);
+-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+int create_reparse_symlink(const unsigned int xid, struct inode *inode,
+ 				struct dentry *dentry, struct cifs_tcon *tcon,
+ 				const char *full_path, const char *symname);
+-int smb2_mknod_reparse(unsigned int xid, struct inode *inode,
+int mknod_reparse(unsigned int xid, struct inode *inode,
+ 		       struct dentry *dentry, struct cifs_tcon *tcon,
+ 		       const char *full_path, umode_t mode, dev_t dev);
+ struct reparse_data_buffer *smb2_get_reparse_point_buffer(const struct kvec *rsp_iov, u32 *len);
+--- a/fs/smb/client/smb1ops.c
+++ b/fs/smb/client/smb1ops.c
+@@ -16,6 +16,7 @@
+ #include "fs_context.h"
+ #include "nterr.h"
+ #include "smberr.h"
+#include "reparse.h"
+ 
+ /*
+  * An NT cancel request header looks just like the original request except:
+@@ -1263,17 +1264,26 @@ cifs_make_node(unsigned int xid, struct
+ 		if (rc == 0)
+ 			d_instantiate(dentry, newinode);
+ 		return rc;
+	} else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
+		/*
+		 * Check if mounted with mount parm 'sfu' mount parm.
+		 * SFU emulation should work with all servers
+		 * and was used by default in earlier versions of Windows.
+		 */
+		return cifs_sfu_make_node(xid, inode, dentry, tcon,
+					  full_path, mode, dev);
+	} else if (le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) {
+		/*
+		 * mknod via reparse points requires server support for
+		 * storing reparse points, which is available since
+		 * Windows 2000, but was not widely used until release
+		 * of Windows Server 2012 by the Windows NFS server.
+		 */
+		return mknod_reparse(xid, inode, dentry, tcon,
+				     full_path, mode, dev);
+	} else {
+		return -EOPNOTSUPP;
+ 	}
+-	/*
+-	 * Check if mounted with mount parm 'sfu' mount parm.
+-	 * SFU emulation should work with all servers, but only
+-	 * supports block and char device, socket & fifo,
+-	 * and was used by default in earlier versions of Windows
+-	 */
+-	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
+-		return -EPERM;
+-	return cifs_sfu_make_node(xid, inode, dentry, tcon,
+-				  full_path, mode, dev);
+ }
+ 
+ static bool
+@@ -1370,6 +1380,7 @@ struct smb_version_operations smb1_opera
+ 	.create_hardlink = CIFSCreateHardLink,
+ 	.query_symlink = cifs_query_symlink,
+ 	.get_reparse_point_buffer = cifs_get_reparse_point_buffer,
+	.create_reparse_inode = cifs_create_reparse_inode,
+ 	.open = cifs_open_file,
+ 	.set_fid = cifs_set_fid,
+ 	.close = cifs_close_file,
+--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
+@@ -1320,7 +1320,7 @@ smb2_set_file_info(struct inode *inode,
+ 	return rc;
+ }
+ 
+-struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,
+struct inode *smb2_create_reparse_inode(struct cifs_open_info_data *data,
+ 				     struct super_block *sb,
+ 				     const unsigned int xid,
+ 				     struct cifs_tcon *tcon,
+--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
+@@ -5271,7 +5271,7 @@ static int smb2_make_node(unsigned int x
+ 					full_path, mode, dev);
+ 	} else if ((le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)
+ 		|| (tcon->posix_extensions)) {
+-		rc = smb2_mknod_reparse(xid, inode, dentry, tcon,
+		rc = mknod_reparse(xid, inode, dentry, tcon,
+ 					full_path, mode, dev);
+ 	}
+ 	return rc;
+@@ -5330,7 +5330,7 @@ struct smb_version_operations smb20_oper
+ 	.get_reparse_point_buffer = smb2_get_reparse_point_buffer,
+ 	.query_mf_symlink = smb3_query_mf_symlink,
+ 	.create_mf_symlink = smb3_create_mf_symlink,
+-	.create_reparse_symlink = smb2_create_reparse_symlink,
+	.create_reparse_inode = smb2_create_reparse_inode,
+ 	.open = smb2_open_file,
+ 	.set_fid = smb2_set_fid,
+ 	.close = smb2_close_file,
+@@ -5433,7 +5433,7 @@ struct smb_version_operations smb21_oper
+ 	.get_reparse_point_buffer = smb2_get_reparse_point_buffer,
+ 	.query_mf_symlink = smb3_query_mf_symlink,
+ 	.create_mf_symlink = smb3_create_mf_symlink,
+-	.create_reparse_symlink = smb2_create_reparse_symlink,
+	.create_reparse_inode = smb2_create_reparse_inode,
+ 	.open = smb2_open_file,
+ 	.set_fid = smb2_set_fid,
+ 	.close = smb2_close_file,
+@@ -5540,7 +5540,7 @@ struct smb_version_operations smb30_oper
+ 	.get_reparse_point_buffer = smb2_get_reparse_point_buffer,
+ 	.query_mf_symlink = smb3_query_mf_symlink,
+ 	.create_mf_symlink = smb3_create_mf_symlink,
+-	.create_reparse_symlink = smb2_create_reparse_symlink,
+	.create_reparse_inode = smb2_create_reparse_inode,
+ 	.open = smb2_open_file,
+ 	.set_fid = smb2_set_fid,
+ 	.close = smb2_close_file,
+@@ -5656,7 +5656,7 @@ struct smb_version_operations smb311_ope
+ 	.get_reparse_point_buffer = smb2_get_reparse_point_buffer,
+ 	.query_mf_symlink = smb3_query_mf_symlink,
+ 	.create_mf_symlink = smb3_create_mf_symlink,
+-	.create_reparse_symlink = smb2_create_reparse_symlink,
+	.create_reparse_inode = smb2_create_reparse_inode,
+ 	.open = smb2_open_file,
+ 	.set_fid = smb2_set_fid,
+ 	.close = smb2_close_file,
+--- a/fs/smb/client/smb2proto.h
+++ b/fs/smb/client/smb2proto.h
+@@ -54,7 +54,7 @@ extern int smb3_handle_read_data(struct
+ extern int smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon,
+ 				struct cifs_sb_info *cifs_sb, const char *path,
+ 				__u32 *reparse_tag);
+-struct inode *smb2_get_reparse_inode(struct cifs_open_info_data *data,
+struct inode *smb2_create_reparse_inode(struct cifs_open_info_data *data,
+ 				     struct super_block *sb,
+ 				     const unsigned int xid,
+ 				     struct cifs_tcon *tcon,
+@@ -314,9 +314,6 @@ int smb311_posix_query_path_info(const u
+ int posix_info_parse(const void *beg, const void *end,
+ 		     struct smb2_posix_info_parsed *out);
+ int posix_info_sid_size(const void *beg, const void *end);
+-int smb2_create_reparse_symlink(const unsigned int xid, struct inode *inode,
+-				struct dentry *dentry, struct cifs_tcon *tcon,
+-				const char *full_path, const char *symname);
+ int smb2_make_nfs_node(unsigned int xid, struct inode *inode,
+ 		       struct dentry *dentry, struct cifs_tcon *tcon,
+ 		       const char *full_path, umode_t mode, dev_t dev);
--- a/debian/patches/patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch
+++ b/debian/patches/patchset-pf/steady/0034-smb-client-fix-creating-symlinks-under-POSIX-mounts.patch
@@ -0,0 +1,109 @@
+From c027b463e9389e4421b21f170128f35c0f2941b9 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@manguebit.org>
+Date: Thu, 31 Jul 2025 20:46:43 -0300
+Subject: smb: client: fix creating symlinks under POSIX mounts
+
+SMB3.1.1 POSIX mounts support native symlinks that are created with
+IO_REPARSE_TAG_SYMLINK reparse points, so skip the checking of
+FILE_SUPPORTS_REPARSE_POINTS as some servers might not have it set.
+
+Cc: linux-cifs@vger.kernel.org
+Cc: Ralph Boehme <slow@samba.org>
+Cc: David Howells <dhowells@redhat.com>
+Cc: <stable@vger.kernel.org>
+Reported-by: Matthew Richardson <m.richardson@ed.ac.uk>
+Closes: https://marc.info/?i=1124e7cd-6a46-40a6-9f44-b7664a66654b@ed.ac.uk
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+---
+ fs/smb/client/cifsglob.h  | 5 +++++
+ fs/smb/client/cifssmb.c   | 4 ++--
+ fs/smb/client/link.c      | 2 +-
+ fs/smb/client/smb1ops.c   | 2 +-
+ fs/smb/client/smb2inode.c | 5 ++---
+ fs/smb/client/smb2ops.c   | 5 ++---
+ 6 files changed, 13 insertions(+), 10 deletions(-)
+
+--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
+@@ -2377,4 +2377,9 @@ static inline bool cifs_netbios_name(con
+ 	return ret;
+ }
+ 
+#define CIFS_REPARSE_SUPPORT(tcon) \
+	((tcon)->posix_extensions || \
+	 (le32_to_cpu((tcon)->fsAttrInfo.Attributes) & \
+	  FILE_SUPPORTS_REPARSE_POINTS))
+
+ #endif	/* _CIFS_GLOB_H */
+--- a/fs/smb/client/cifssmb.c
+++ b/fs/smb/client/cifssmb.c
+@@ -2751,7 +2751,7 @@ int cifs_query_reparse_point(const unsig
+ 	if (cap_unix(tcon->ses))
+ 		return -EOPNOTSUPP;
+ 
+-	if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS))
+	if (!CIFS_REPARSE_SUPPORT(tcon))
+ 		return -EOPNOTSUPP;
+ 
+ 	oparms = (struct cifs_open_parms) {
+@@ -2879,7 +2879,7 @@ struct inode *cifs_create_reparse_inode(
+ 	 * attempt to create reparse point. This will prevent creating unusable
+ 	 * empty object on the server.
+ 	 */
+-	if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS))
+	if (!CIFS_REPARSE_SUPPORT(tcon))
+ 		return ERR_PTR(-EOPNOTSUPP);
+ 
+ #ifndef CONFIG_CIFS_XATTR
+--- a/fs/smb/client/link.c
+++ b/fs/smb/client/link.c
+@@ -635,7 +635,7 @@ cifs_symlink(struct mnt_idmap *idmap, st
+ 	case CIFS_SYMLINK_TYPE_NATIVE:
+ 	case CIFS_SYMLINK_TYPE_NFS:
+ 	case CIFS_SYMLINK_TYPE_WSL:
+-		if (le32_to_cpu(pTcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) {
+		if (CIFS_REPARSE_SUPPORT(pTcon)) {
+ 			rc = create_reparse_symlink(xid, inode, direntry, pTcon,
+ 						    full_path, symname);
+ 			goto symlink_exit;
+--- a/fs/smb/client/smb1ops.c
+++ b/fs/smb/client/smb1ops.c
+@@ -1272,7 +1272,7 @@ cifs_make_node(unsigned int xid, struct
+ 		 */
+ 		return cifs_sfu_make_node(xid, inode, dentry, tcon,
+ 					  full_path, mode, dev);
+-	} else if (le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS) {
+	} else if (CIFS_REPARSE_SUPPORT(tcon)) {
+ 		/*
+ 		 * mknod via reparse points requires server support for
+ 		 * storing reparse points, which is available since
+--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
+@@ -1345,9 +1345,8 @@ struct inode *smb2_create_reparse_inode(
+ 	 * attempt to create reparse point. This will prevent creating unusable
+ 	 * empty object on the server.
+ 	 */
+-	if (!(le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS))
+-		if (!tcon->posix_extensions)
+-			return ERR_PTR(-EOPNOTSUPP);
+	if (!CIFS_REPARSE_SUPPORT(tcon))
+		return ERR_PTR(-EOPNOTSUPP);
+ 
+ 	oparms = CIFS_OPARMS(cifs_sb, tcon, full_path,
+ 			     SYNCHRONIZE | DELETE |
+--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
+@@ -5269,10 +5269,9 @@ static int smb2_make_node(unsigned int x
+ 	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
+ 		rc = cifs_sfu_make_node(xid, inode, dentry, tcon,
+ 					full_path, mode, dev);
+-	} else if ((le32_to_cpu(tcon->fsAttrInfo.Attributes) & FILE_SUPPORTS_REPARSE_POINTS)
+-		|| (tcon->posix_extensions)) {
+	} else if (CIFS_REPARSE_SUPPORT(tcon)) {
+ 		rc = mknod_reparse(xid, inode, dentry, tcon,
+-					full_path, mode, dev);
+				   full_path, mode, dev);
+ 	}
+ 	return rc;
+ }
--- a/debian/patches/patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch
+++ b/debian/patches/patchset-pf/steady/0035-kasan-test-fix-protection-against-compiler-elision.patch
@@ -0,0 +1,45 @@
+From 8c47c2c4bebf98d0624c15cecef00536d50d79a6 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Mon, 28 Jul 2025 22:11:54 +0200
+Subject: kasan/test: fix protection against compiler elision
+
+The kunit test is using assignments to
+"static volatile void *kasan_ptr_result" to prevent elision of memory
+loads, but that's not working:
+In this variable definition, the "volatile" applies to the "void", not to
+the pointer.
+To make "volatile" apply to the pointer as intended, it must follow
+after the "*".
+
+This makes the kasan_memchr test pass again on my system.  The
+kasan_strings test is still failing because all the definitions of
+load_unaligned_zeropad() are lacking explicit instrumentation hooks and
+ASAN does not instrument asm() memory operands.
+
+Link: https://lkml.kernel.org/r/20250728-kasan-kunit-fix-volatile-v1-1-e7157c9af82d@google.com
+Fixes: 5f1c8108e7ad ("mm:kasan: fix sparse warnings: Should it be static?")
+Signed-off-by: Jann Horn <jannh@google.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
+Cc: Dmitriy Vyukov <dvyukov@google.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Nihar Chaithanya <niharchaithanya@gmail.com>
+Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ mm/kasan/kasan_test_c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/kasan/kasan_test_c.c
+++ b/mm/kasan/kasan_test_c.c
+@@ -47,7 +47,7 @@ static struct {
+  * Some tests use these global variables to store return values from function
+  * calls that could otherwise be eliminated by the compiler as dead code.
+  */
+-static volatile void *kasan_ptr_result;
+static void *volatile kasan_ptr_result;
+ static volatile int kasan_int_result;
+ 
+ /* Probe for console output: obtains test_status lines of interest. */
--- a/debian/patches/patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch
+++ b/debian/patches/patchset-pf/steady/0036-proc-proc_maps_open-allow-proc_mem_open-to-return-NU.patch
@@ -0,0 +1,42 @@
+From d22a1695f7b89c228e60a9310d597597a6710666 Mon Sep 17 00:00:00 2001
+From: Jialin Wang <wjl.linux@gmail.com>
+Date: Fri, 8 Aug 2025 00:54:55 +0800
+Subject: proc: proc_maps_open allow proc_mem_open to return NULL
+
+The commit 65c66047259f ("proc: fix the issue of proc_mem_open returning
+NULL") caused proc_maps_open() to return -ESRCH when proc_mem_open()
+returns NULL.  This breaks legitimate /proc/<pid>/maps access for kernel
+threads since kernel threads have NULL mm_struct.
+
+The regression causes perf to fail and exit when profiling a kernel
+thread:
+
+  # perf record -v -g -p $(pgrep kswapd0)
+  ...
+  couldn't open /proc/65/task/65/maps
+
+This patch partially reverts the commit to fix it.
+
+Link: https://lkml.kernel.org/r/20250807165455.73656-1-wjl.linux@gmail.com
+Fixes: 65c66047259f ("proc: fix the issue of proc_mem_open returning NULL")
+Signed-off-by: Jialin Wang <wjl.linux@gmail.com>
+Cc: Penglei Jiang <superman.xpt@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+---
+ fs/proc/task_mmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
+@@ -215,8 +215,8 @@ static int proc_maps_open(struct inode *
+ 
+ 	priv->inode = inode;
+ 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
+-	if (IS_ERR_OR_NULL(priv->mm)) {
+-		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
+	if (IS_ERR(priv->mm)) {
+		int err = PTR_ERR(priv->mm);
+ 
+ 		seq_release_private(inode, file);
+ 		return err;
--- a/debian/patches/patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch
+++ b/debian/patches/patchset-pf/steady/0037-block-restore-default-wbt-enablement.patch
@@ -0,0 +1,56 @@
+From ca0b04683be7bba50703eaec260167ec494d80b8 Mon Sep 17 00:00:00 2001
+From: Julian Sun <sunjunchao2870@gmail.com>
+Date: Tue, 12 Aug 2025 23:42:57 +0800
+Subject: block: restore default wbt enablement
+
+The commit 245618f8e45f ("block: protect wbt_lat_usec using
+q->elevator_lock") protected wbt_enable_default() with
+q->elevator_lock; however, it also placed wbt_enable_default()
+before blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);, resulting
+in wbt failing to be enabled.
+
+Moreover, the protection of wbt_enable_default() by q->elevator_lock
+was removed in commit 78c271344b6f ("block: move wbt_enable_default()
+out of queue freezing from sched ->exit()"), so we can directly fix
+this issue by placing wbt_enable_default() after
+blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);.
+
+Additionally, this issue also causes the inability to read the
+wbt_lat_usec file, and the scenario is as follows:
+
+root@q:/sys/block/sda/queue# cat wbt_lat_usec
+cat: wbt_lat_usec: Invalid argument
+
+root@q:/data00/sjc/linux# ls /sys/kernel/debug/block/sda/rqos
+cannot access '/sys/kernel/debug/block/sda/rqos': No such file or directory
+
+root@q:/data00/sjc/linux# find /sys -name wbt
+/sys/kernel/debug/tracing/events/wbt
+
+After testing with this patch, wbt can be enabled normally.
+
+Signed-off-by: Julian Sun <sunjunchao@bytedance.com>
+Cc: stable@vger.kernel.org
+Fixes: 245618f8e45f ("block: protect wbt_lat_usec using q->elevator_lock")
+Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20250812154257.57540-1-sunjunchao@bytedance.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+---
+ block/blk-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
+@@ -876,9 +876,9 @@ int blk_register_queue(struct gendisk *d
+ 
+ 	if (queue_is_mq(q))
+ 		elevator_set_default(q);
+-	wbt_enable_default(disk);
+ 
+ 	blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);
+	wbt_enable_default(disk);
+ 
+ 	/* Now everything is ready and send out KOBJ_ADD uevent */
+ 	kobject_uevent(&disk->queue_kobj, KOBJ_ADD);
--- a/debian/patches/patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch
+++ b/debian/patches/patchset-pf/steady/0038-xfs-fully-decouple-XFS_IBULK-flags-from-XFS_IWALK-fl.patch
@@ -0,0 +1,50 @@
+From 599815c47256ca7901fc5b0de5cbc6f08e803e48 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 23 Jul 2025 14:19:44 +0200
+Subject: xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
+
+Fix up xfs_inumbers to now pass in the XFS_IBULK* flags into the flags
+argument to xfs_inobt_walk, which expects the XFS_IWALK* flags.
+
+Currently passing the wrong flags works for non-debug builds because
+the only XFS_IWALK* flag has the same encoding as the corresponding
+XFS_IBULK* flag, but in debug builds it can trigger an assert that no
+incorrect flag is passed.  Instead just extra the relevant flag.
+
+Fixes: 5b35d922c52798 ("xfs: Decouple XFS_IBULK flags from XFS_IWALK flags")
+Cc: <stable@vger.kernel.org> # v5.19
+Reported-by: cen zhang <zzzccc427@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+---
+ fs/xfs/xfs_itable.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
+@@ -455,11 +455,15 @@ xfs_inumbers(
+ 		.breq		= breq,
+ 	};
+ 	struct xfs_trans	*tp;
+	unsigned int		iwalk_flags = 0;
+ 	int			error = 0;
+ 
+ 	if (xfs_bulkstat_already_done(breq->mp, breq->startino))
+ 		return 0;
+ 
+	if (breq->flags & XFS_IBULK_SAME_AG)
+		iwalk_flags |= XFS_IWALK_SAME_AG;
+
+ 	/*
+ 	 * Grab an empty transaction so that we can use its recursive buffer
+ 	 * locking abilities to detect cycles in the inobt without deadlocking.
+@@ -468,7 +472,7 @@ xfs_inumbers(
+ 	if (error)
+ 		goto out;
+ 
+-	error = xfs_inobt_walk(breq->mp, tp, breq->startino, breq->flags,
+	error = xfs_inobt_walk(breq->mp, tp, breq->startino, iwalk_flags,
+ 			xfs_inumbers_walk, breq->icount, &ic);
+ 	xfs_trans_cancel(tp);
+ out:
--- a/debian/patches/patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch
+++ b/debian/patches/patchset-pf/steady/0039-watchdog-intel_oc_wdt-Do-not-try-to-write-into-const.patch
@@ -0,0 +1,66 @@
+From d2a99ecf2d0479f78a21568eee08f4ca27652629 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 17 Aug 2025 07:48:17 -0700
+Subject: watchdog: intel_oc_wdt: Do not try to write into const memory
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The code tries to update the intel_oc_wdt_info data structure if the
+watchdog is locked. That data structure is marked as const and can not
+be written into. Copy it into struct intel_oc_wdt and modify it there
+to fix the problem.
+
+Reported-by: Petar Kulić <cooleech@gmail.com>
+Cc: Diogo Ivo <diogo.ivo@siemens.com>
+Fixes: 535d1784d8a9 ("watchdog: Add driver for Intel OC WDT")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+---
+ drivers/watchdog/intel_oc_wdt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/watchdog/intel_oc_wdt.c
+++ b/drivers/watchdog/intel_oc_wdt.c
+@@ -41,6 +41,7 @@
+ struct intel_oc_wdt {
+ 	struct watchdog_device wdd;
+ 	struct resource *ctrl_res;
+	struct watchdog_info info;
+ 	bool locked;
+ };
+ 
+@@ -115,7 +116,6 @@ static const struct watchdog_ops intel_o
+ 
+ static int intel_oc_wdt_setup(struct intel_oc_wdt *oc_wdt)
+ {
+-	struct watchdog_info *info;
+ 	unsigned long val;
+ 
+ 	val = inl(INTEL_OC_WDT_CTRL_REG(oc_wdt));
+@@ -134,7 +134,6 @@ static int intel_oc_wdt_setup(struct int
+ 		set_bit(WDOG_HW_RUNNING, &oc_wdt->wdd.status);
+ 
+ 		if (oc_wdt->locked) {
+-			info = (struct watchdog_info *)&intel_oc_wdt_info;
+ 			/*
+ 			 * Set nowayout unconditionally as we cannot stop
+ 			 * the watchdog.
+@@ -145,7 +144,7 @@ static int intel_oc_wdt_setup(struct int
+ 			 * and inform the core we can't change it.
+ 			 */
+ 			oc_wdt->wdd.timeout = (val & INTEL_OC_WDT_TOV) + 1;
+-			info->options &= ~WDIOF_SETTIMEOUT;
+			oc_wdt->info.options &= ~WDIOF_SETTIMEOUT;
+ 
+ 			dev_info(oc_wdt->wdd.parent,
+ 				 "Register access locked, heartbeat fixed at: %u s\n",
+@@ -193,7 +192,8 @@ static int intel_oc_wdt_probe(struct pla
+ 	wdd->min_timeout = INTEL_OC_WDT_MIN_TOV;
+ 	wdd->max_timeout = INTEL_OC_WDT_MAX_TOV;
+ 	wdd->timeout = INTEL_OC_WDT_DEF_TOV;
+-	wdd->info = &intel_oc_wdt_info;
+	oc_wdt->info = intel_oc_wdt_info;
+	wdd->info = &oc_wdt->info;
+ 	wdd->ops = &intel_oc_wdt_ops;
+ 	wdd->parent = dev;
+ 
--- a/debian/patches/patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch
+++ b/debian/patches/patchset-pf/steady/0040-cgroup-avoid-null-de-ref-in-css_rstat_exit.patch
@@ -0,0 +1,62 @@
+From 76511b0ae1da7f401fe06c8b4dd18a40c3a2b52b Mon Sep 17 00:00:00 2001
+From: JP Kobryn <inwardvessel@gmail.com>
+Date: Wed, 6 Aug 2025 17:33:50 -0700
+Subject: cgroup: avoid null de-ref in css_rstat_exit()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+css_rstat_exit() may be called asynchronously in scenarios where preceding
+calls to css_rstat_init() have not completed. One such example is this
+sequence below:
+
+css_create(...)
+{
+	...
+	init_and_link_css(css, ...);
+
+	err = percpu_ref_init(...);
+	if (err)
+		goto err_free_css;
+	err = cgroup_idr_alloc(...);
+	if (err)
+		goto err_free_css;
+	err = css_rstat_init(css, ...);
+	if (err)
+		goto err_free_css;
+	...
+err_free_css:
+	INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
+	queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
+	return ERR_PTR(err);
+}
+
+If any of the three goto jumps are taken, async cleanup will begin and
+css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
+
+Avoid accessing the unitialized field by returning early in
+css_rstat_exit() if this is the case.
+
+Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
+Suggested-by: Michal Koutný <mkoutny@suse.com>
+Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem")
+Cc: stable@vger.kernel.org # v6.16
+Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com
+Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+---
+ kernel/cgroup/rstat.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
+@@ -488,6 +488,9 @@ void css_rstat_exit(struct cgroup_subsys
+ 	if (!css_uses_rstat(css))
+ 		return;
+ 
+	if (!css->rstat_cpu)
+		return;
+
+ 	css_rstat_flush(css);
+ 
+ 	/* sanity check */
--- a/debian/patches/patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch
+++ b/debian/patches/patchset-pf/steady/0041-open_tree_attr-do-not-allow-id-mapping-changes-witho.patch
@@ -0,0 +1,43 @@
+From 1b24003064570fdf29c55bac14d4728977195133 Mon Sep 17 00:00:00 2001
+From: Aleksa Sarai <cyphar@cyphar.com>
+Date: Fri, 8 Aug 2025 03:55:05 +1000
+Subject: open_tree_attr: do not allow id-mapping changes without
+ OPEN_TREE_CLONE
+
+As described in commit 7a54947e727b ('Merge patch series "fs: allow
+changing idmappings"'), open_tree_attr(2) was necessary in order to
+allow for a detached mount to be created and have its idmappings changed
+without the risk of any racing threads operating on it. For this reason,
+mount_setattr(2) still does not allow for id-mappings to be changed.
+
+However, there was a bug in commit 2462651ffa76 ("fs: allow changing
+idmappings") which allowed users to bypass this restriction by calling
+open_tree_attr(2) *without* OPEN_TREE_CLONE.
+
+can_idmap_mount() prevented this bug from allowing an attached
+mountpoint's id-mapping from being modified (thanks to an is_anon_ns()
+check), but this still allows for detached (but visible) mounts to have
+their be id-mapping changed. This risks the same UAF and locking issues
+as described in the merge commit, and was likely unintentional.
+
+Fixes: 2462651ffa76 ("fs: allow changing idmappings")
+Cc: stable@vger.kernel.org # v6.15+
+Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
+Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-1-0ec7bc05646c@cyphar.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+---
+ fs/namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/namespace.c
+++ b/fs/namespace.c
+@@ -5302,7 +5302,8 @@ SYSCALL_DEFINE5(open_tree_attr, int, dfd
+ 		int ret;
+ 		struct mount_kattr kattr = {};
+ 
+-		kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
+		if (flags & OPEN_TREE_CLONE)
+			kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
+ 		if (flags & AT_RECURSIVE)
+ 			kattr.kflags |= MOUNT_KATTR_RECURSE;
+ 
--- a/debian/patches/patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch
+++ b/debian/patches/patchset-pf/steady/0042-iomap-Fix-broken-data-integrity-guarantees-for-O_SYN.patch
@@ -0,0 +1,53 @@
+From 2435722a492f57a060202726a820b0da64f42105 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 30 Jul 2025 12:28:41 +0200
+Subject: iomap: Fix broken data integrity guarantees for O_SYNC writes
+
+Commit d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") has broken
+the logic in iomap_dio_bio_iter() in a way that when the device does
+support FUA (or has no writeback cache) and the direct IO happens to
+freshly allocated or unwritten extents, we will *not* issue fsync after
+completing direct IO O_SYNC / O_DSYNC write because the
+IOMAP_DIO_WRITE_THROUGH flag stays mistakenly set. Fix the problem by
+clearing IOMAP_DIO_WRITE_THROUGH whenever we do not perform FUA write as
+it was originally intended.
+
+CC: John Garry <john.g.garry@oracle.com>
+CC: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Fixes: d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()")
+CC: stable@vger.kernel.org
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/20250730102840.20470-2-jack@suse.cz
+Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
+Reviewed-by: John Garry <john.g.garry@oracle.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+---
+ fs/iomap/direct-io.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/fs/iomap/direct-io.c
+++ b/fs/iomap/direct-io.c
+@@ -368,14 +368,14 @@ static int iomap_dio_bio_iter(struct iom
+ 		if (iomap->flags & IOMAP_F_SHARED)
+ 			dio->flags |= IOMAP_DIO_COW;
+ 
+-		if (iomap->flags & IOMAP_F_NEW) {
+		if (iomap->flags & IOMAP_F_NEW)
+ 			need_zeroout = true;
+-		} else if (iomap->type == IOMAP_MAPPED) {
+-			if (iomap_dio_can_use_fua(iomap, dio))
+-				bio_opf |= REQ_FUA;
+-			else
+-				dio->flags &= ~IOMAP_DIO_WRITE_THROUGH;
+-		}
+		else if (iomap->type == IOMAP_MAPPED &&
+			 iomap_dio_can_use_fua(iomap, dio))
+			bio_opf |= REQ_FUA;
+
+		if (!(bio_opf & REQ_FUA))
+			dio->flags &= ~IOMAP_DIO_WRITE_THROUGH;
+ 
+ 		/*
+ 		 * We can only do deferred completion for pure overwrites that
--- a/Show More
+++ b/Show More