--- /dev/null
+From 3aa385a9c75c09b59dcab2ff76423439d23673ab Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 3 Nov 2025 10:36:18 +0100
+Subject: iio: accel: bmc150: Fix irq assumption regression
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 3aa385a9c75c09b59dcab2ff76423439d23673ab upstream.
+
+The code in bmc150-accel-core.c unconditionally calls
+bmc150_accel_set_interrupt() in the iio_buffer_setup_ops,
+such as on the runtime PM resume path giving a kernel
+splat like this if the device has no interrupts:
+
+Unable to handle kernel NULL pointer dereference at virtual
+ address 00000001 when read
+
+PC is at bmc150_accel_set_interrupt+0x98/0x194
+LR is at __pm_runtime_resume+0x5c/0x64
+(...)
+Call trace:
+bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108
+bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc
+__iio_update_buffers from enable_store+0x84/0xc8
+enable_store from kernfs_fop_write_iter+0x154/0x1b4
+
+This bug seems to have been in the driver since the beginning,
+but it only manifests recently, I do not know why.
+
+Store the IRQ number in the state struct, as this is a common
+pattern in other drivers, then use this to determine if we have
+IRQ support or not.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/bmc150-accel-core.c | 5 +++++
+ drivers/iio/accel/bmc150-accel.h | 1 +
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -529,6 +529,10 @@ static int bmc150_accel_set_interrupt(st
+ const struct bmc150_accel_interrupt_info *info = intr->info;
+ int ret;
+
++ /* We do not always have an IRQ */
++ if (data->irq <= 0)
++ return 0;
++
+ if (state) {
+ if (atomic_inc_return(&intr->users) > 1)
+ return 0;
+@@ -1702,6 +1706,7 @@ int bmc150_accel_core_probe(struct devic
+ }
+
+ if (irq > 0) {
++ data->irq = irq;
+ ret = devm_request_threaded_irq(dev, irq,
+ bmc150_accel_irq_handler,
+ bmc150_accel_irq_thread_handler,
+--- a/drivers/iio/accel/bmc150-accel.h
++++ b/drivers/iio/accel/bmc150-accel.h
+@@ -57,6 +57,7 @@ enum bmc150_accel_trigger_id {
+
+ struct bmc150_accel_data {
+ struct regmap *regmap;
++ int irq;
+ struct regulator_bulk_data regulators[2];
+ struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS];
+ struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS];
--- /dev/null
+From c92c1bc408e9e11ae3c7011b062fdd74c09283a3 Mon Sep 17 00:00:00 2001
+From: Valek Andrej <andrej.v@skyrain.eu>
+Date: Tue, 14 Oct 2025 09:13:44 +0200
+Subject: iio: accel: fix ADXL355 startup race condition
+
+From: Valek Andrej <andrej.v@skyrain.eu>
+
+commit c92c1bc408e9e11ae3c7011b062fdd74c09283a3 upstream.
+
+There is an race-condition where device is not full working after SW reset.
+Therefore it's necessary to wait some time after reset and verify shadow
+registers values by reading and comparing the values before/after reset.
+This mechanism is described in datasheet at least from revision D.
+
+Fixes: 12ed27863ea3 ("iio: accel: Add driver support for ADXL355")
+Signed-off-by: Valek Andrej <andrej.v@skyrain.eu>
+Signed-off-by: Kessler Markus <markus.kessler@hilti.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/adxl355_core.c | 44 ++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 39 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/accel/adxl355_core.c
++++ b/drivers/iio/accel/adxl355_core.c
+@@ -56,6 +56,8 @@
+ #define ADXL355_POWER_CTL_DRDY_MSK BIT(2)
+ #define ADXL355_SELF_TEST_REG 0x2E
+ #define ADXL355_RESET_REG 0x2F
++#define ADXL355_BASE_ADDR_SHADOW_REG 0x50
++#define ADXL355_SHADOW_REG_COUNT 5
+
+ #define ADXL355_DEVID_AD_VAL 0xAD
+ #define ADXL355_DEVID_MST_VAL 0x1D
+@@ -294,7 +296,12 @@ static void adxl355_fill_3db_frequency_t
+ static int adxl355_setup(struct adxl355_data *data)
+ {
+ unsigned int regval;
++ int retries = 5; /* the number is chosen based on empirical reasons */
+ int ret;
++ u8 *shadow_regs __free(kfree) = kzalloc(ADXL355_SHADOW_REG_COUNT, GFP_KERNEL);
++
++ if (!shadow_regs)
++ return -ENOMEM;
+
+ ret = regmap_read(data->regmap, ADXL355_DEVID_AD_REG, ®val);
+ if (ret)
+@@ -321,14 +328,41 @@ static int adxl355_setup(struct adxl355_
+ if (regval != ADXL355_PARTID_VAL)
+ dev_warn(data->dev, "Invalid DEV ID 0x%02x\n", regval);
+
+- /*
+- * Perform a software reset to make sure the device is in a consistent
+- * state after start-up.
+- */
+- ret = regmap_write(data->regmap, ADXL355_RESET_REG, ADXL355_RESET_CODE);
++ /* Read shadow registers to be compared after reset */
++ ret = regmap_bulk_read(data->regmap,
++ ADXL355_BASE_ADDR_SHADOW_REG,
++ shadow_regs, ADXL355_SHADOW_REG_COUNT);
+ if (ret)
+ return ret;
+
++ do {
++ if (--retries == 0) {
++ dev_err(data->dev, "Shadow registers mismatch\n");
++ return -EIO;
++ }
++
++ /*
++ * Perform a software reset to make sure the device is in a consistent
++ * state after start-up.
++ */
++ ret = regmap_write(data->regmap, ADXL355_RESET_REG,
++ ADXL355_RESET_CODE);
++ if (ret)
++ return ret;
++
++ /* Wait at least 5ms after software reset */
++ usleep_range(5000, 10000);
++
++ /* Read shadow registers for comparison */
++ ret = regmap_bulk_read(data->regmap,
++ ADXL355_BASE_ADDR_SHADOW_REG,
++ data->buffer.buf,
++ ADXL355_SHADOW_REG_COUNT);
++ if (ret)
++ return ret;
++ } while (memcmp(shadow_regs, data->buffer.buf,
++ ADXL355_SHADOW_REG_COUNT));
++
+ ret = regmap_update_bits(data->regmap, ADXL355_POWER_CTL_REG,
+ ADXL355_POWER_CTL_DRDY_MSK,
+ FIELD_PREP(ADXL355_POWER_CTL_DRDY_MSK, 1));
--- /dev/null
+From bd886cdcbf9e746f61c74035a3acd42e9108e115 Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Fri, 10 Oct 2025 10:44:45 -0500
+Subject: iio: adc: ad7280a: fix ad7280_store_balance_timer()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit bd886cdcbf9e746f61c74035a3acd42e9108e115 upstream.
+
+Use correct argument to iio_str_to_fixpoint() to parse 3 decimal places.
+
+iio_str_to_fixpoint() has a bit of an unintuitive API where the
+fract_mult parameter is the multiplier of the first decimal place as if
+it was already an integer. So to get 3 decimal places, fract_mult must
+be 100 rather than 1000.
+
+Fixes: 96ccdbc07a74 ("staging:iio:adc:ad7280a: Standardize extended ABI naming")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7280a.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ad7280a.c
++++ b/drivers/iio/adc/ad7280a.c
+@@ -541,7 +541,7 @@ static ssize_t ad7280_store_balance_time
+ int val, val2;
+ int ret;
+
+- ret = iio_str_to_fixpoint(buf, 1000, &val, &val2);
++ ret = iio_str_to_fixpoint(buf, 100, &val, &val2);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 9b45744bf09fc2a3287e05287141d6e123c125a7 Mon Sep 17 00:00:00 2001
+From: ChiYuan Huang <cy_huang@richtek.com>
+Date: Thu, 18 Sep 2025 11:10:59 +0800
+Subject: iio: adc: rtq6056: Correct the sign bit index
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+commit 9b45744bf09fc2a3287e05287141d6e123c125a7 upstream.
+
+The vshunt/current reported register is a signed 16bit integer. The
+sign bit index should be '15', not '16'.
+
+Fixes: 4396f45d211b ("iio: adc: Add rtq6056 support")
+Reported-by: Andy Hsu <andy_ya_hsu@wiwynn.com>
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/rtq6056.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/rtq6056.c
++++ b/drivers/iio/adc/rtq6056.c
+@@ -300,7 +300,7 @@ static int rtq6056_adc_read_channel(stru
+ return IIO_VAL_INT;
+ case RTQ6056_REG_SHUNTVOLT:
+ case RTQ6056_REG_CURRENT:
+- *val = sign_extend32(regval, 16);
++ *val = sign_extend32(regval, 15);
+ return IIO_VAL_INT;
+ default:
+ return -EINVAL;
--- /dev/null
+From 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+Date: Thu, 2 Oct 2025 13:22:49 +0200
+Subject: iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Olivier Moysan <olivier.moysan@foss.st.com>
+
+commit 8a6b7989ff0cd0a95c93be1927f2af7ad10f28de upstream.
+
+Initially st,adc-alt-channel property was defined as an enum in the DFSDM
+binding. The DFSDM binding has been changed to use the new IIO backend
+framework, along with the adoption of IIO generic channels.
+In this new binding st,adc-alt-channel is defined as a boolean property,
+but it is still handled has an enum in DFSDM driver.
+Fix st,adc-alt-channel property handling in DFSDM driver.
+
+Fixes: 3208fa0cd919 ("iio: adc: stm32-dfsdm: adopt generic channels bindings")
+Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -721,9 +721,8 @@ static int stm32_dfsdm_generic_channel_p
+ }
+ df_ch->src = val;
+
+- ret = fwnode_property_read_u32(node, "st,adc-alt-channel", &df_ch->alt_si);
+- if (ret != -EINVAL)
+- df_ch->alt_si = 0;
++ if (fwnode_property_present(node, "st,adc-alt-channel"))
++ df_ch->alt_si = 1;
+
+ if (adc->dev_data->type == DFSDM_IIO) {
+ backend = devm_iio_backend_fwnode_get(&indio_dev->dev, NULL, node);
--- /dev/null
+From f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Tue, 7 Oct 2025 10:15:22 +0100
+Subject: iio: buffer-dma: support getting the DMA channel
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit f9c198c3ccaf90a1a265fb2ffa8d4b093c3b0784 upstream.
+
+Implement the .get_dma_dev() callback for DMA buffers by returning the
+device that owns the DMA channel. This allows the core DMABUF
+infrastructure to properly map DMA buffers using the correct device,
+avoiding the need for bounce buffers on systems where memory is mapped
+above the 32-bit range.
+
+The function returns the DMA queue's device, which is the actual device
+responsible for DMA operations in buffer-dma implementations.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/buffer/industrialio-buffer-dma.c | 6 ++++++
+ include/linux/iio/buffer-dma.h | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/iio/buffer/industrialio-buffer-dma.c
++++ b/drivers/iio/buffer/industrialio-buffer-dma.c
+@@ -786,6 +786,12 @@ out_end_signalling:
+ }
+ EXPORT_SYMBOL_NS_GPL(iio_dma_buffer_enqueue_dmabuf, IIO_DMA_BUFFER);
+
++struct device *iio_dma_buffer_get_dma_dev(struct iio_buffer *buffer)
++{
++ return iio_buffer_to_queue(buffer)->dev;
++}
++EXPORT_SYMBOL_NS_GPL(iio_dma_buffer_get_dma_dev, IIO_DMA_BUFFER);
++
+ void iio_dma_buffer_lock_queue(struct iio_buffer *buffer)
+ {
+ struct iio_dma_buffer_queue *queue = iio_buffer_to_queue(buffer);
+--- a/include/linux/iio/buffer-dma.h
++++ b/include/linux/iio/buffer-dma.h
+@@ -174,5 +174,6 @@ int iio_dma_buffer_enqueue_dmabuf(struct
+ size_t size, bool cyclic);
+ void iio_dma_buffer_lock_queue(struct iio_buffer *buffer);
+ void iio_dma_buffer_unlock_queue(struct iio_buffer *buffer);
++struct device *iio_dma_buffer_get_dma_dev(struct iio_buffer *buffer);
+
+ #endif
--- /dev/null
+From 3db847df994d475db7812dde90376f2848bcd30a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Tue, 7 Oct 2025 10:15:23 +0100
+Subject: iio: buffer-dmaengine: enable .get_dma_dev()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit 3db847df994d475db7812dde90376f2848bcd30a upstream.
+
+Wire up the .get_dma_dev() callback to use the DMA buffer infrastructure's
+implementation. This ensures that DMABUF operations use the correct DMA
+device for mapping, which is essential for proper operation on systems
+where memory is mapped above the 32-bit range.
+
+Without this callback, the core would fall back to using the IIO device's
+parent, which may not have the appropriate DMA mask configuration for
+high memory access.
+
+Fixes: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API")
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/buffer/industrialio-buffer-dmaengine.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/buffer/industrialio-buffer-dmaengine.c
++++ b/drivers/iio/buffer/industrialio-buffer-dmaengine.c
+@@ -177,6 +177,8 @@ static const struct iio_buffer_access_fu
+ .lock_queue = iio_dma_buffer_lock_queue,
+ .unlock_queue = iio_dma_buffer_unlock_queue,
+
++ .get_dma_dev = iio_dma_buffer_get_dma_dev,
++
+ .modes = INDIO_BUFFER_HARDWARE,
+ .flags = INDIO_BUFFER_FLAG_FIXED_WATERMARK,
+ };
--- /dev/null
+From a514bb109eada64f798f1c86c17182229cc20fe7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Tue, 7 Oct 2025 10:15:21 +0100
+Subject: iio: buffer: support getting dma channel from the buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit a514bb109eada64f798f1c86c17182229cc20fe7 upstream.
+
+Add a new buffer accessor .get_dma_dev() in order to get the
+struct device responsible for actually providing the dma channel. We
+cannot assume that we can use the parent of the IIO device for mapping
+the DMA buffer. This becomes important on systems (like the Xilinx/AMD
+zynqMP Ultrascale) where memory (or part of it) is mapped above the
+32 bit range. On such systems and given that a device by default has
+a dma mask of 32 bits we would then need to rely on bounce buffers (to
+swiotlb) for mapping memory above the dma mask limit.
+
+In the process, add an iio_buffer_get_dma_dev() helper function to get
+the proper DMA device.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/industrialio-buffer.c | 21 ++++++++++++++++-----
+ include/linux/iio/buffer_impl.h | 2 ++
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -1623,19 +1623,28 @@ static int iio_dma_resv_lock(struct dma_
+ return 0;
+ }
+
++static struct device *iio_buffer_get_dma_dev(const struct iio_dev *indio_dev,
++ struct iio_buffer *buffer)
++{
++ if (buffer->access->get_dma_dev)
++ return buffer->access->get_dma_dev(buffer);
++
++ return indio_dev->dev.parent;
++}
++
+ static struct dma_buf_attachment *
+ iio_buffer_find_attachment(struct iio_dev_buffer_pair *ib,
+ struct dma_buf *dmabuf, bool nonblock)
+ {
+- struct device *dev = ib->indio_dev->dev.parent;
+ struct iio_buffer *buffer = ib->buffer;
++ struct device *dma_dev = iio_buffer_get_dma_dev(ib->indio_dev, buffer);
+ struct dma_buf_attachment *attach = NULL;
+ struct iio_dmabuf_priv *priv;
+
+ guard(mutex)(&buffer->dmabufs_mutex);
+
+ list_for_each_entry(priv, &buffer->dmabufs, entry) {
+- if (priv->attach->dev == dev
++ if (priv->attach->dev == dma_dev
+ && priv->attach->dmabuf == dmabuf) {
+ attach = priv->attach;
+ break;
+@@ -1653,6 +1662,7 @@ static int iio_buffer_attach_dmabuf(stru
+ {
+ struct iio_dev *indio_dev = ib->indio_dev;
+ struct iio_buffer *buffer = ib->buffer;
++ struct device *dma_dev = iio_buffer_get_dma_dev(indio_dev, buffer);
+ struct dma_buf_attachment *attach;
+ struct iio_dmabuf_priv *priv, *each;
+ struct dma_buf *dmabuf;
+@@ -1679,7 +1689,7 @@ static int iio_buffer_attach_dmabuf(stru
+ goto err_free_priv;
+ }
+
+- attach = dma_buf_attach(dmabuf, indio_dev->dev.parent);
++ attach = dma_buf_attach(dmabuf, dma_dev);
+ if (IS_ERR(attach)) {
+ err = PTR_ERR(attach);
+ goto err_dmabuf_put;
+@@ -1719,7 +1729,7 @@ static int iio_buffer_attach_dmabuf(stru
+ * combo. If we do, refuse to attach.
+ */
+ list_for_each_entry(each, &buffer->dmabufs, entry) {
+- if (each->attach->dev == indio_dev->dev.parent
++ if (each->attach->dev == dma_dev
+ && each->attach->dmabuf == dmabuf) {
+ /*
+ * We unlocked the reservation object, so going through
+@@ -1758,6 +1768,7 @@ static int iio_buffer_detach_dmabuf(stru
+ {
+ struct iio_buffer *buffer = ib->buffer;
+ struct iio_dev *indio_dev = ib->indio_dev;
++ struct device *dma_dev = iio_buffer_get_dma_dev(indio_dev, buffer);
+ struct iio_dmabuf_priv *priv;
+ struct dma_buf *dmabuf;
+ int dmabuf_fd, ret = -EPERM;
+@@ -1772,7 +1783,7 @@ static int iio_buffer_detach_dmabuf(stru
+ guard(mutex)(&buffer->dmabufs_mutex);
+
+ list_for_each_entry(priv, &buffer->dmabufs, entry) {
+- if (priv->attach->dev == indio_dev->dev.parent
++ if (priv->attach->dev == dma_dev
+ && priv->attach->dmabuf == dmabuf) {
+ list_del(&priv->entry);
+
+--- a/include/linux/iio/buffer_impl.h
++++ b/include/linux/iio/buffer_impl.h
+@@ -50,6 +50,7 @@ struct sg_table;
+ * @enqueue_dmabuf: called from userspace via ioctl to queue this DMABUF
+ * object to this buffer. Requires a valid DMABUF fd, that
+ * was previouly attached to this buffer.
++ * @get_dma_dev: called to get the DMA channel associated with this buffer.
+ * @lock_queue: called when the core needs to lock the buffer queue;
+ * it is used when enqueueing DMABUF objects.
+ * @unlock_queue: used to unlock a previously locked buffer queue
+@@ -90,6 +91,7 @@ struct iio_buffer_access_funcs {
+ struct iio_dma_buffer_block *block,
+ struct dma_fence *fence, struct sg_table *sgt,
+ size_t size, bool cyclic);
++ struct device * (*get_dma_dev)(struct iio_buffer *buffer);
+ void (*lock_queue)(struct iio_buffer *buffer);
+ void (*unlock_queue)(struct iio_buffer *buffer);
+
--- /dev/null
+From 21553258b94861a73d7f2cf15469d69240e1170d Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 10 Oct 2025 20:58:48 +0200
+Subject: iio:common:ssp_sensors: Fix an error handling path ssp_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 21553258b94861a73d7f2cf15469d69240e1170d upstream.
+
+If an error occurs after a successful mfd_add_devices() call, it should be
+undone by a corresponding mfd_remove_devices() call, as already done in the
+remove function.
+
+Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
++++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
+@@ -503,7 +503,7 @@ static int ssp_probe(struct spi_device *
+ ret = spi_setup(spi);
+ if (ret < 0) {
+ dev_err(&spi->dev, "Failed to setup spi\n");
+- return ret;
++ goto err_setup_spi;
+ }
+
+ data->fw_dl_state = SSP_FW_DL_STATE_NONE;
+@@ -568,6 +568,8 @@ err_read_reg:
+ err_setup_irq:
+ mutex_destroy(&data->pending_lock);
+ mutex_destroy(&data->comm_lock);
++err_setup_spi:
++ mfd_remove_devices(&spi->dev);
+
+ dev_err(&spi->dev, "Probe failed!\n");
+
--- /dev/null
+From 7b8dc11c0a830caa0d890c603d597161c6c26095 Mon Sep 17 00:00:00 2001
+From: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+Date: Thu, 16 Oct 2025 07:20:38 +0200
+Subject: iio: humditiy: hdc3020: fix units for temperature and humidity measurement
+
+From: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+
+commit 7b8dc11c0a830caa0d890c603d597161c6c26095 upstream.
+
+According to the ABI the units after application of scale and offset are
+milli degrees for temperature measurements and milli percent for relative
+humidity measurements. Currently the resulting units are degree celsius for
+temperature measurements and percent for relative humidity measurements.
+Change scale factor to fix this issue.
+
+Fixes: c9180b8e39be ("iio: humidity: Add driver for ti HDC302x humidity sensors")
+Reported-by: Chris Lesiak <chris.lesiak@licorbio.com>
+Suggested-by: Chris Lesiak <chris.lesiak@licorbio.com>
+Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Signed-off-by: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/humidity/hdc3020.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/humidity/hdc3020.c b/drivers/iio/humidity/hdc3020.c
+index ffb25596d3a8..8aa567d9aded 100644
+--- a/drivers/iio/humidity/hdc3020.c
++++ b/drivers/iio/humidity/hdc3020.c
+@@ -301,9 +301,9 @@ static int hdc3020_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_SCALE:
+ *val2 = 65536;
+ if (chan->type == IIO_TEMP)
+- *val = 175;
++ *val = 175 * MILLI;
+ else
+- *val = 100;
++ *val = 100 * MILLI;
+ return IIO_VAL_FRACTIONAL;
+
+ case IIO_CHAN_INFO_OFFSET:
+--
+2.52.0
+
--- /dev/null
+From cb372b4f46d4285e5d2c07ba734374151b8e34e7 Mon Sep 17 00:00:00 2001
+From: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+Date: Thu, 16 Oct 2025 07:20:39 +0200
+Subject: iio: humditiy: hdc3020: fix units for thresholds and hysteresis
+
+From: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+
+commit cb372b4f46d4285e5d2c07ba734374151b8e34e7 upstream.
+
+According to the ABI the units after application of scale and offset are
+milli degree celsius for temperature thresholds and milli percent for
+relative humidity thresholds. Currently the resulting units are degree
+celsius for temperature thresholds and hysteresis and percent for relative
+humidity thresholds and hysteresis. Change scale factor to fix this issue.
+
+Fixes: 3ad0e7e5f0cb ("iio: humidity: hdc3020: add threshold events support")
+Reported-by: Chris Lesiak <chris.lesiak@licorbio.com>
+Reviewed-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Signed-off-by: Dimitri Fedrau <dimitri.fedrau@liebherr.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/humidity/hdc3020.c | 69 ++++++++++++++++++++--------------
+ 1 file changed, 41 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/iio/humidity/hdc3020.c b/drivers/iio/humidity/hdc3020.c
+index 8aa567d9aded..78b2c171c8da 100644
+--- a/drivers/iio/humidity/hdc3020.c
++++ b/drivers/iio/humidity/hdc3020.c
+@@ -72,6 +72,9 @@
+ #define HDC3020_MAX_TEMP_HYST_MICRO 164748607
+ #define HDC3020_MAX_HUM_MICRO 99220264
+
++/* Divide 65535 from the datasheet by 5 to avoid overflows */
++#define HDC3020_THRESH_FRACTION (65535 / 5)
++
+ struct hdc3020_data {
+ struct i2c_client *client;
+ struct gpio_desc *reset_gpio;
+@@ -376,15 +379,18 @@ static int hdc3020_thresh_get_temp(u16 thresh)
+ int temp;
+
+ /*
+- * Get the temperature threshold from 9 LSBs, shift them to get
+- * the truncated temperature threshold representation and
+- * calculate the threshold according to the formula in the
+- * datasheet. Result is degree celsius scaled by 65535.
++ * Get the temperature threshold from 9 LSBs, shift them to get the
++ * truncated temperature threshold representation and calculate the
++ * threshold according to the explicit formula in the datasheet:
++ * T(C) = -45 + (175 * temp) / 65535.
++ * Additionally scale by HDC3020_THRESH_FRACTION to avoid precision loss
++ * when calculating threshold and hysteresis values. Result is degree
++ * celsius scaled by HDC3020_THRESH_FRACTION.
+ */
+ temp = FIELD_GET(HDC3020_THRESH_TEMP_MASK, thresh) <<
+ HDC3020_THRESH_TEMP_TRUNC_SHIFT;
+
+- return -2949075 + (175 * temp);
++ return -2949075 / 5 + (175 / 5 * temp);
+ }
+
+ static int hdc3020_thresh_get_hum(u16 thresh)
+@@ -394,13 +400,16 @@ static int hdc3020_thresh_get_hum(u16 thresh)
+ /*
+ * Get the humidity threshold from 7 MSBs, shift them to get the
+ * truncated humidity threshold representation and calculate the
+- * threshold according to the formula in the datasheet. Result is
+- * percent scaled by 65535.
++ * threshold according to the explicit formula in the datasheet:
++ * RH(%) = 100 * hum / 65535.
++ * Additionally scale by HDC3020_THRESH_FRACTION to avoid precision loss
++ * when calculating threshold and hysteresis values. Result is percent
++ * scaled by HDC3020_THRESH_FRACTION.
+ */
+ hum = FIELD_GET(HDC3020_THRESH_HUM_MASK, thresh) <<
+ HDC3020_THRESH_HUM_TRUNC_SHIFT;
+
+- return hum * 100;
++ return hum * 100 / 5;
+ }
+
+ static u16 hdc3020_thresh_set_temp(int s_temp, u16 curr_thresh)
+@@ -455,8 +464,8 @@ int hdc3020_thresh_clr(s64 s_thresh, s64 s_hyst, enum iio_event_direction dir)
+ else
+ s_clr = s_thresh + s_hyst;
+
+- /* Divide by 65535 to get units of micro */
+- return div_s64(s_clr, 65535);
++ /* Divide by HDC3020_THRESH_FRACTION to get units of micro */
++ return div_s64(s_clr, HDC3020_THRESH_FRACTION);
+ }
+
+ static int _hdc3020_write_thresh(struct hdc3020_data *data, u16 reg, u16 val)
+@@ -507,7 +516,7 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev,
+
+ clr = ret;
+ /* Scale value to include decimal part into calculations */
+- s_val = (val < 0) ? (val * 1000000 - val2) : (val * 1000000 + val2);
++ s_val = (val < 0) ? (val * 1000 - val2) : (val * 1000 + val2);
+ switch (chan->type) {
+ case IIO_TEMP:
+ switch (info) {
+@@ -523,7 +532,8 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev,
+ /* Calculate old hysteresis */
+ s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000;
+ s_clr = (s64)hdc3020_thresh_get_temp(clr) * 1000000;
+- s_hyst = div_s64(abs(s_thresh - s_clr), 65535);
++ s_hyst = div_s64(abs(s_thresh - s_clr),
++ HDC3020_THRESH_FRACTION);
+ /* Set new threshold */
+ thresh = reg_val;
+ /* Set old hysteresis */
+@@ -532,16 +542,17 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev,
+ case IIO_EV_INFO_HYSTERESIS:
+ /*
+ * Function hdc3020_thresh_get_temp returns temperature
+- * in degree celsius scaled by 65535. Scale by 1000000
+- * to be able to subtract scaled hysteresis value.
++ * in degree celsius scaled by HDC3020_THRESH_FRACTION.
++ * Scale by 1000000 to be able to subtract scaled
++ * hysteresis value.
+ */
+ s_thresh = (s64)hdc3020_thresh_get_temp(thresh) * 1000000;
+ /*
+ * Units of s_val are in micro degree celsius, scale by
+- * 65535 to get same units as s_thresh.
++ * HDC3020_THRESH_FRACTION to get same units as s_thresh.
+ */
+ s_val = min(abs(s_val), HDC3020_MAX_TEMP_HYST_MICRO);
+- s_hyst = (s64)s_val * 65535;
++ s_hyst = (s64)s_val * HDC3020_THRESH_FRACTION;
+ s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir);
+ s_clr = max(s_clr, HDC3020_MIN_TEMP_MICRO);
+ s_clr = min(s_clr, HDC3020_MAX_TEMP_MICRO);
+@@ -565,7 +576,8 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev,
+ /* Calculate old hysteresis */
+ s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000;
+ s_clr = (s64)hdc3020_thresh_get_hum(clr) * 1000000;
+- s_hyst = div_s64(abs(s_thresh - s_clr), 65535);
++ s_hyst = div_s64(abs(s_thresh - s_clr),
++ HDC3020_THRESH_FRACTION);
+ /* Set new threshold */
+ thresh = reg_val;
+ /* Try to set old hysteresis */
+@@ -574,15 +586,16 @@ static int hdc3020_write_thresh(struct iio_dev *indio_dev,
+ case IIO_EV_INFO_HYSTERESIS:
+ /*
+ * Function hdc3020_thresh_get_hum returns relative
+- * humidity in percent scaled by 65535. Scale by 1000000
+- * to be able to subtract scaled hysteresis value.
++ * humidity in percent scaled by HDC3020_THRESH_FRACTION.
++ * Scale by 1000000 to be able to subtract scaled
++ * hysteresis value.
+ */
+ s_thresh = (s64)hdc3020_thresh_get_hum(thresh) * 1000000;
+ /*
+- * Units of s_val are in micro percent, scale by 65535
+- * to get same units as s_thresh.
++ * Units of s_val are in micro percent, scale by
++ * HDC3020_THRESH_FRACTION to get same units as s_thresh.
+ */
+- s_hyst = (s64)s_val * 65535;
++ s_hyst = (s64)s_val * HDC3020_THRESH_FRACTION;
+ s_clr = hdc3020_thresh_clr(s_thresh, s_hyst, dir);
+ s_clr = max(s_clr, 0);
+ s_clr = min(s_clr, HDC3020_MAX_HUM_MICRO);
+@@ -630,7 +643,7 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev,
+ thresh = hdc3020_thresh_get_temp(ret);
+ switch (info) {
+ case IIO_EV_INFO_VALUE:
+- *val = thresh;
++ *val = thresh * MILLI;
+ break;
+ case IIO_EV_INFO_HYSTERESIS:
+ ret = hdc3020_read_be16(data, reg_clr);
+@@ -638,18 +651,18 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev,
+ return ret;
+
+ clr = hdc3020_thresh_get_temp(ret);
+- *val = abs(thresh - clr);
++ *val = abs(thresh - clr) * MILLI;
+ break;
+ default:
+ return -EOPNOTSUPP;
+ }
+- *val2 = 65535;
++ *val2 = HDC3020_THRESH_FRACTION;
+ return IIO_VAL_FRACTIONAL;
+ case IIO_HUMIDITYRELATIVE:
+ thresh = hdc3020_thresh_get_hum(ret);
+ switch (info) {
+ case IIO_EV_INFO_VALUE:
+- *val = thresh;
++ *val = thresh * MILLI;
+ break;
+ case IIO_EV_INFO_HYSTERESIS:
+ ret = hdc3020_read_be16(data, reg_clr);
+@@ -657,12 +670,12 @@ static int hdc3020_read_thresh(struct iio_dev *indio_dev,
+ return ret;
+
+ clr = hdc3020_thresh_get_hum(ret);
+- *val = abs(thresh - clr);
++ *val = abs(thresh - clr) * MILLI;
+ break;
+ default:
+ return -EOPNOTSUPP;
+ }
+- *val2 = 65535;
++ *val2 = HDC3020_THRESH_FRACTION;
+ return IIO_VAL_FRACTIONAL;
+ default:
+ return -EOPNOTSUPP;
+--
+2.52.0
+
--- /dev/null
+From 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a Mon Sep 17 00:00:00 2001
+From: Francesco Lavra <flavra@baylibre.com>
+Date: Fri, 17 Oct 2025 19:32:08 +0200
+Subject: iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
+
+From: Francesco Lavra <flavra@baylibre.com>
+
+commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream.
+
+The `decimator` and `batch` fields of struct st_lsm6dsx_settings
+are arrays indexed by sensor type, not by sensor hardware
+identifier; moreover, the `batch` field is only used for the
+accelerometer and gyroscope.
+Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to
+ST_LSM6DSX_ID_MAX, and change the array size for `batch` from
+ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id
+definition so that the ST_LSM6DSX_ID_MAX value is usable within
+the struct st_lsm6dsx_settings definition.
+
+Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO")
+Signed-off-by: Francesco Lavra <flavra@baylibre.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+@@ -270,6 +270,15 @@ struct st_lsm6dsx_event_settings {
+ u8 wakeup_src_x_mask;
+ };
+
++enum st_lsm6dsx_sensor_id {
++ ST_LSM6DSX_ID_GYRO,
++ ST_LSM6DSX_ID_ACC,
++ ST_LSM6DSX_ID_EXT0,
++ ST_LSM6DSX_ID_EXT1,
++ ST_LSM6DSX_ID_EXT2,
++ ST_LSM6DSX_ID_MAX
++};
++
+ enum st_lsm6dsx_ext_sensor_id {
+ ST_LSM6DSX_ID_MAGN,
+ };
+@@ -355,23 +364,14 @@ struct st_lsm6dsx_settings {
+ struct st_lsm6dsx_odr_table_entry odr_table[2];
+ struct st_lsm6dsx_samples_to_discard samples_to_discard[2];
+ struct st_lsm6dsx_fs_table_entry fs_table[2];
+- struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID];
+- struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID];
++ struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX];
++ struct st_lsm6dsx_reg batch[2];
+ struct st_lsm6dsx_fifo_ops fifo_ops;
+ struct st_lsm6dsx_hw_ts_settings ts_settings;
+ struct st_lsm6dsx_shub_settings shub_settings;
+ struct st_lsm6dsx_event_settings event_settings;
+ };
+
+-enum st_lsm6dsx_sensor_id {
+- ST_LSM6DSX_ID_GYRO,
+- ST_LSM6DSX_ID_ACC,
+- ST_LSM6DSX_ID_EXT0,
+- ST_LSM6DSX_ID_EXT1,
+- ST_LSM6DSX_ID_EXT2,
+- ST_LSM6DSX_ID_MAX,
+-};
+-
+ enum st_lsm6dsx_fifo_mode {
+ ST_LSM6DSX_FIFO_BYPASS = 0x0,
+ ST_LSM6DSX_FIFO_CONT = 0x6,
--- /dev/null
+From 841ecc979b18d3227fad5e2d6a1e6f92688776b5 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Date: Fri, 28 Nov 2025 16:53:46 +0000
+Subject: MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
+
+From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+
+commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.
+
+Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+
+cores can have more than 64 TLB entries. Therefore allocate an array
+for uniquification instead of placing too an small array on the stack.
+
+Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
+Co-developed-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification
+Cc: stable@vger.kernel.org # v6.17+
+Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Tested-by: Klara Modin <klarasmodin@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/mm/tlb-r4k.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 3facf7cc6c7d..44a662536148 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -12,6 +12,7 @@
+ #include <linux/init.h>
+ #include <linux/sched.h>
+ #include <linux/smp.h>
++#include <linux/memblock.h>
+ #include <linux/mm.h>
+ #include <linux/hugetlb.h>
+ #include <linux/export.h>
+@@ -522,17 +523,26 @@ static int r4k_vpn_cmp(const void *a, const void *b)
+ * Initialise all TLB entries with unique values that do not clash with
+ * what we have been handed over and what we'll be using ourselves.
+ */
+-static void r4k_tlb_uniquify(void)
++static void __ref r4k_tlb_uniquify(void)
+ {
+- unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
+ int tlbsize = current_cpu_data.tlbsize;
++ bool use_slab = slab_is_available();
+ int start = num_wired_entries();
++ phys_addr_t tlb_vpn_size;
++ unsigned long *tlb_vpns;
+ unsigned long vpn_mask;
+ int cnt, ent, idx, i;
+
+ vpn_mask = GENMASK(cpu_vmbits - 1, 13);
+ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
+
++ tlb_vpn_size = tlbsize * sizeof(*tlb_vpns);
++ tlb_vpns = (use_slab ?
++ kmalloc(tlb_vpn_size, GFP_KERNEL) :
++ memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns)));
++ if (WARN_ON(!tlb_vpns))
++ return; /* Pray local_flush_tlb_all() is good enough. */
++
+ htw_stop();
+
+ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
+@@ -585,6 +595,10 @@ static void r4k_tlb_uniquify(void)
+ tlbw_use_hazard();
+ htw_start();
+ flush_micro_tlb();
++ if (use_slab)
++ kfree(tlb_vpns);
++ else
++ memblock_free(tlb_vpns, tlb_vpn_size);
+ }
+
+ /*
+--
+2.52.0
+
--- /dev/null
+From 9f048fa487409e364cf866c957cf0b0d782ca5a3 Mon Sep 17 00:00:00 2001
+From: "Maciej W. Rozycki" <macro@orcam.me.uk>
+Date: Thu, 13 Nov 2025 05:21:10 +0000
+Subject: MIPS: mm: Prevent a TLB shutdown on initial uniquification
+
+From: Maciej W. Rozycki <macro@orcam.me.uk>
+
+commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.
+
+Depending on the particular CPU implementation a TLB shutdown may occur
+if multiple matching entries are detected upon the execution of a TLBP
+or the TLBWI/TLBWR instructions. Given that we don't know what entries
+we have been handed we need to be very careful with the initial TLB
+setup and avoid all these instructions.
+
+Therefore read all the TLB entries one by one with the TLBR instruction,
+bypassing the content addressing logic, and truncate any large pages in
+place so as to avoid a case in the second step where an incoming entry
+for a large page at a lower address overlaps with a replacement entry
+chosen at another index. Then preinitialize the TLB using addresses
+outside our usual unique range and avoiding clashes with any entries
+received, before making the usual call to local_flush_tlb_all().
+
+This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB
+entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual
+address).
+
+Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> # Boston I6400, M5150 sim
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 64 insertions(+), 38 deletions(-)
+
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -15,6 +15,7 @@
+ #include <linux/mm.h>
+ #include <linux/hugetlb.h>
+ #include <linux/export.h>
++#include <linux/sort.h>
+
+ #include <asm/cpu.h>
+ #include <asm/cpu-type.h>
+@@ -508,55 +509,79 @@ static int __init set_ntlb(char *str)
+
+ __setup("ntlb=", set_ntlb);
+
+-/* Initialise all TLB entries with unique values */
++
++/* Comparison function for EntryHi VPN fields. */
++static int r4k_vpn_cmp(const void *a, const void *b)
++{
++ long v = *(unsigned long *)a - *(unsigned long *)b;
++ int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0;
++ return s ? (v != 0) | v >> s : v;
++}
++
++/*
++ * Initialise all TLB entries with unique values that do not clash with
++ * what we have been handed over and what we'll be using ourselves.
++ */
+ static void r4k_tlb_uniquify(void)
+ {
+- int entry = num_wired_entries();
++ unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
++ int tlbsize = current_cpu_data.tlbsize;
++ int start = num_wired_entries();
++ unsigned long vpn_mask;
++ int cnt, ent, idx, i;
++
++ vpn_mask = GENMASK(cpu_vmbits - 1, 13);
++ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
+
+ htw_stop();
+- write_c0_entrylo0(0);
+- write_c0_entrylo1(0);
+
+- while (entry < current_cpu_data.tlbsize) {
+- unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data);
+- unsigned long asid = 0;
+- int idx;
++ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
++ unsigned long vpn;
+
+- /* Skip wired MMID to make ginvt_mmid work */
+- if (cpu_has_mmid)
+- asid = MMID_KERNEL_WIRED + 1;
++ write_c0_index(i);
++ mtc0_tlbr_hazard();
++ tlb_read();
++ tlb_read_hazard();
++ vpn = read_c0_entryhi();
++ vpn &= vpn_mask & PAGE_MASK;
++ tlb_vpns[cnt] = vpn;
+
+- /* Check for match before using UNIQUE_ENTRYHI */
+- do {
+- if (cpu_has_mmid) {
+- write_c0_memorymapid(asid);
+- write_c0_entryhi(UNIQUE_ENTRYHI(entry));
+- } else {
+- write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
+- }
+- mtc0_tlbw_hazard();
+- tlb_probe();
+- tlb_probe_hazard();
+- idx = read_c0_index();
+- /* No match or match is on current entry */
+- if (idx < 0 || idx == entry)
+- break;
+- /*
+- * If we hit a match, we need to try again with
+- * a different ASID.
+- */
+- asid++;
+- } while (asid < asid_mask);
+-
+- if (idx >= 0 && idx != entry)
+- panic("Unable to uniquify TLB entry %d", idx);
+-
+- write_c0_index(entry);
++ /* Prevent any large pages from overlapping regular ones. */
++ write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK);
+ mtc0_tlbw_hazard();
+ tlb_write_indexed();
+- entry++;
++ tlbw_use_hazard();
+ }
+
++ sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL);
++
++ write_c0_pagemask(PM_DEFAULT_MASK);
++ write_c0_entrylo0(0);
++ write_c0_entrylo1(0);
++
++ idx = 0;
++ ent = tlbsize;
++ for (i = start; i < tlbsize; i++)
++ while (1) {
++ unsigned long entryhi, vpn;
++
++ entryhi = UNIQUE_ENTRYHI(ent);
++ vpn = entryhi & vpn_mask & PAGE_MASK;
++
++ if (idx >= cnt || vpn < tlb_vpns[idx]) {
++ write_c0_entryhi(entryhi);
++ write_c0_index(i);
++ mtc0_tlbw_hazard();
++ tlb_write_indexed();
++ ent++;
++ break;
++ } else if (vpn == tlb_vpns[idx]) {
++ ent++;
++ } else {
++ idx++;
++ }
++ }
++
+ tlbw_use_hazard();
+ htw_start();
+ flush_micro_tlb();
+@@ -602,6 +627,7 @@ static void r4k_tlb_configure(void)
+
+ /* From this point on the ARC firmware is dead. */
+ r4k_tlb_uniquify();
++ local_flush_tlb_all();
+
+ /* Did I tell you that ARC SUCKS? */
+ }
--- /dev/null
+From 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 25 Nov 2025 09:08:45 -0500
+Subject: Revert "drm/amd/display: Move setup_stream_attribute"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 3126c9ccb4373d8758733c6699ba5ab93dbe5c9d upstream.
+
+This reverts commit 2681bf4ae8d24df950138b8c9ea9c271cd62e414.
+
+This results in a blank screen on the HDMI port on some systems.
+Revert for now so as not to regress 6.18, can be addressed
+in 6.19 once the issue is root caused.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4652
+Cc: Sunpeng.Li@amd.com
+Cc: ivan.lipski@amd.com
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d0e9de7a81503cdde37fb2d37f1d102f9e0f38fb)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c | 1 -
+ drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 2 --
+ drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 2 --
+ drivers/gpu/drm/amd/display/dc/link/link_dpms.c | 3 +++
+ drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c | 7 -------
+ 5 files changed, 3 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+@@ -670,7 +670,6 @@ void dce110_enable_stream(struct pipe_ct
+ uint32_t early_control = 0;
+ struct timing_generator *tg = pipe_ctx->stream_res.tg;
+
+- link_hwss->setup_stream_attribute(pipe_ctx);
+ link_hwss->setup_stream_encoder(pipe_ctx);
+
+ dc->hwss.update_info_frame(pipe_ctx);
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+@@ -3017,8 +3017,6 @@ void dcn20_enable_stream(struct pipe_ctx
+ link_enc->transmitter - TRANSMITTER_UNIPHY_A);
+ }
+
+- link_hwss->setup_stream_attribute(pipe_ctx);
+-
+ if (dc->res_pool->dccg->funcs->set_pixel_rate_div)
+ dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ dc->res_pool->dccg,
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+@@ -1019,8 +1019,6 @@ void dcn401_enable_stream(struct pipe_ct
+ }
+ }
+
+- link_hwss->setup_stream_attribute(pipe_ctx);
+-
+ if (dc->res_pool->dccg->funcs->set_pixel_rate_div) {
+ dc->res_pool->dccg->funcs->set_pixel_rate_div(
+ dc->res_pool->dccg,
+--- a/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
++++ b/drivers/gpu/drm/amd/display/dc/link/link_dpms.c
+@@ -2447,6 +2447,7 @@ void link_set_dpms_on(
+ struct link_encoder *link_enc;
+ enum otg_out_mux_dest otg_out_dest = OUT_MUX_DIO;
+ struct vpg *vpg = pipe_ctx->stream_res.stream_enc->vpg;
++ const struct link_hwss *link_hwss = get_link_hwss(link, &pipe_ctx->link_res);
+ bool apply_edp_fast_boot_optimization =
+ pipe_ctx->stream->apply_edp_fast_boot_optimization;
+
+@@ -2489,6 +2490,8 @@ void link_set_dpms_on(
+ pipe_ctx->stream_res.tg->funcs->set_out_mux(pipe_ctx->stream_res.tg, otg_out_dest);
+ }
+
++ link_hwss->setup_stream_attribute(pipe_ctx);
++
+ pipe_ctx->stream->apply_edp_fast_boot_optimization = false;
+
+ // Enable VPG before building infoframe
+--- a/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
++++ b/drivers/gpu/drm/amd/display/dc/virtual/virtual_stream_encoder.c
+@@ -44,11 +44,6 @@ static void virtual_stream_encoder_dvi_s
+ struct dc_crtc_timing *crtc_timing,
+ bool is_dual_link) {}
+
+-static void virtual_stream_encoder_lvds_set_stream_attribute(
+- struct stream_encoder *enc,
+- struct dc_crtc_timing *crtc_timing)
+-{}
+-
+ static void virtual_stream_encoder_set_throttled_vcp_size(
+ struct stream_encoder *enc,
+ struct fixed31_32 avg_time_slots_per_mtp)
+@@ -120,8 +115,6 @@ static const struct stream_encoder_funcs
+ virtual_stream_encoder_hdmi_set_stream_attribute,
+ .dvi_set_stream_attribute =
+ virtual_stream_encoder_dvi_set_stream_attribute,
+- .lvds_set_stream_attribute =
+- virtual_stream_encoder_lvds_set_stream_attribute,
+ .set_throttled_vcp_size =
+ virtual_stream_encoder_set_throttled_vcp_size,
+ .update_hdmi_info_packets =
--- /dev/null
+From 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Tue, 4 Nov 2025 22:54:02 +0100
+Subject: Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream.
+
+This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3.
+
+Currently we store initial stacktrace entry twice for non-HW ot_regs, which
+means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel.
+
+It's easy to reproduce this bpftrace:
+
+ # bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }'
+ Attaching 1 probe...
+
+ bprm_execve+1767
+ bprm_execve+1767
+ do_execveat_common.isra.0+425
+ __x64_sys_execve+56
+ do_syscall_64+133
+ entry_SYSCALL_64_after_hwframe+118
+
+When perf_callchain_kernel calls unwind_start with first_frame, AFAICS
+we do not skip regs->ip, but it's added as part of the unwind process.
+Hence reverting the extra perf_callchain_store for non-hw regs leg.
+
+I was not able to bisect this, so I'm not really sure why this was needed
+in v5.2 and why it's not working anymore, but I could see double entries
+as far as v5.10.
+
+I did the test for both ORC and framepointer unwind with and without the
+this fix and except for the initial entry the stacktraces are the same.
+
+Acked-by: Song Liu <song@kernel.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/events/core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -2769,13 +2769,13 @@ perf_callchain_kernel(struct perf_callch
+ return;
+ }
+
+- if (perf_callchain_store(entry, regs->ip))
+- return;
+-
+- if (perf_hw_regs(regs))
++ if (perf_hw_regs(regs)) {
++ if (perf_callchain_store(entry, regs->ip))
++ return;
+ unwind_start(&state, current, regs, NULL);
+- else
++ } else {
+ unwind_start(&state, current, NULL, (void *)regs->sp);
++ }
+
+ for (; !unwind_done(&state); unwind_next_frame(&state)) {
+ addr = unwind_get_return_address(&state);
spi-spi-nxp-fspi-add-oct-dtr-mode-support.patch
spi-nxp-fspi-propagate-fwnode-in-acpi-case-as-well.patch
spi-bcm63xx-fix-premature-cs-deassertion-on-rx-only-.patch
+revert-drm-amd-display-move-setup_stream_attribute.patch
+revert-perf-x86-always-store-regs-ip-in-perf_callchain_kernel.patch
+iio-buffer-dma-support-getting-the-dma-channel.patch
+iio-buffer-dmaengine-enable-.get_dma_dev.patch
+iio-buffer-support-getting-dma-channel-from-the-buffer.patch
+iio-humditiy-hdc3020-fix-units-for-temperature-and-humidity-measurement.patch
+iio-humditiy-hdc3020-fix-units-for-thresholds-and-hysteresis.patch
+iio-imu-st_lsm6dsx-fix-array-size-for-st_lsm6dsx_settings-fields.patch
+iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch
+iio-adc-stm32-dfsdm-fix-st-adc-alt-channel-property-handling.patch
+iio-accel-bmc150-fix-irq-assumption-regression.patch
+iio-accel-fix-adxl355-startup-race-condition.patch
+iio-adc-ad7280a-fix-ad7280_store_balance_timer.patch
+iio-adc-rtq6056-correct-the-sign-bit-index.patch
+mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch
+mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch
+tracing-fix-warn_on-in-tracing_buffers_mmap_close-for-split-vmas.patch
--- /dev/null
+From b042fdf18e89a347177a49e795d8e5184778b5b6 Mon Sep 17 00:00:00 2001
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+Date: Wed, 19 Nov 2025 12:10:19 +0530
+Subject: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs
+
+From: Deepanshu Kartikey <kartikey406@gmail.com>
+
+commit b042fdf18e89a347177a49e795d8e5184778b5b6 upstream.
+
+When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel
+calls vm_ops->close on each portion. For trace buffer mappings, this
+results in ring_buffer_unmap() being called multiple times while
+ring_buffer_map() was only called once.
+
+This causes ring_buffer_unmap() to return -ENODEV on subsequent calls
+because user_mapped is already 0, triggering a WARN_ON.
+
+Trace buffer mappings cannot support partial mappings because the ring
+buffer structure requires the complete buffer including the meta page.
+
+Fix this by adding a may_split callback that returns -EINVAL to prevent
+VMA splits entirely.
+
+Cc: stable@vger.kernel.org
+Fixes: cf9f0f7c4c5bb ("tracing: Allow user-space mapping of the ring-buffer")
+Link: https://patch.msgid.link/20251119064019.25904-1-kartikey406@gmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a72c325b042aae6403c7
+Tested-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com
+Reported-by: syzbot+a72c325b042aae6403c7@syzkaller.appspotmail.com
+Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -8283,8 +8283,18 @@ static void tracing_buffers_mmap_close(s
+ put_snapshot_map(iter->tr);
+ }
+
++static int tracing_buffers_may_split(struct vm_area_struct *vma, unsigned long addr)
++{
++ /*
++ * Trace buffer mappings require the complete buffer including
++ * the meta page. Partial mappings are not supported.
++ */
++ return -EINVAL;
++}
++
+ static const struct vm_operations_struct tracing_buffers_vmops = {
+ .close = tracing_buffers_mmap_close,
++ .may_split = tracing_buffers_may_split,
+ };
+
+ static int tracing_buffers_mmap(struct file *filp, struct vm_area_struct *vma)
projects / thirdparty / kernel / stable-queue.git / commitdiff
