--- /dev/null
+From 59da1e3ff3cc66b5dff4936e1209e1b93f647984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 09:02:32 -0400
+Subject: btrfs: fix transaction abort on set received ioctl due to item
+ overflow
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 87f2c46003fce4d739138aab4af1942b1afdadac ]
+
+If the set received ioctl fails due to an item overflow when attempting to
+add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction
+since we did some metadata updates before.
+
+This means that if a user calls this ioctl with the same received UUID
+field for a lot of subvolumes, we will hit the overflow, trigger the
+transaction abort and turn the filesystem into RO mode. A malicious user
+could exploit this, and this ioctl does not even requires that a user
+has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume.
+
+Fix this by doing an early check for item overflow before starting a
+transaction. This is also race safe because we are holding the subvol_sem
+semaphore in exclusive (write) mode.
+
+A test case for fstests will follow soon.
+
+Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree")
+CC: stable@vger.kernel.org # 3.12+
+Reviewed-by: Anand Jain <asj@kernel.org>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 2 ++
+ fs/btrfs/ioctl.c | 21 +++++++++++++++++++--
+ fs/btrfs/uuid-tree.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 63 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index a9926fb10c491..c395035980eef 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2870,6 +2870,8 @@ int btrfs_uuid_tree_add(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ u64 subid);
+ int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info);
++int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
++ u8 *uuid, u8 type);
+
+ /* dir-item.c */
+ int btrfs_check_dir_item_collision(struct btrfs_root *root, u64 dir,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 574a00db258a0..3712396c3f8a0 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4486,6 +4486,25 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ goto out;
+ }
+
++ received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
++ BTRFS_UUID_SIZE);
++
++ /*
++ * Before we attempt to add the new received uuid, check if we have room
++ * for it in case there's already an item. If the size of the existing
++ * item plus this root's ID (u64) exceeds the maximum item size, we can
++ * return here without the need to abort a transaction. If we don't do
++ * this check, the btrfs_uuid_tree_add() call below would fail with
++ * -EOVERFLOW and result in a transaction abort. Malicious users could
++ * exploit this to turn the fs into RO mode.
++ */
++ if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) {
++ ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid,
++ BTRFS_UUID_KEY_RECEIVED_SUBVOL);
++ if (ret < 0)
++ goto out;
++ }
++
+ /*
+ * 1 - root item
+ * 2 - uuid items (received uuid + subvol uuid)
+@@ -4501,8 +4520,6 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ sa->rtime.sec = ct.tv_sec;
+ sa->rtime.nsec = ct.tv_nsec;
+
+- received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
+- BTRFS_UUID_SIZE);
+ if (received_uuid_changed &&
+ !btrfs_is_empty_uuid(root_item->received_uuid)) {
+ ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid,
+diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
+index 28525ad7ff8cb..d40e1731b570e 100644
+--- a/fs/btrfs/uuid-tree.c
++++ b/fs/btrfs/uuid-tree.c
+@@ -226,6 +226,48 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ return ret;
+ }
+
++/*
++ * Check if we can add one root ID to a UUID key.
++ * If the key does not yet exists, we can, otherwise only if extended item does
++ * not exceeds the maximum item size permitted by the leaf size.
++ *
++ * Returns 0 on success, negative value on error.
++ */
++int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
++ u8 *uuid, u8 type)
++{
++ struct btrfs_path *path = NULL;
++ int ret;
++ u32 item_size;
++ struct btrfs_key key;
++
++ if (WARN_ON_ONCE(!fs_info->uuid_root))
++ return -EINVAL;
++
++ path = btrfs_alloc_path();
++ if (!path)
++ return -ENOMEM;
++
++ btrfs_uuid_to_key(uuid, type, &key);
++ ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0);
++ if (ret < 0)
++ goto out;
++ if (ret > 0) {
++ ret = 0;
++ goto out;
++ }
++
++ item_size = btrfs_item_size_nr(path->nodes[0], path->slots[0]);
++
++ if (sizeof(struct btrfs_item) + item_size + sizeof(u64) >
++ BTRFS_LEAF_DATA_SIZE(fs_info))
++ ret = -EOVERFLOW;
++
++out:
++ btrfs_free_path(path);
++ return ret;
++}
++
+ static int btrfs_uuid_iter_rem(struct btrfs_root *uuid_root, u8 *uuid, u8 type,
+ u64 subid)
+ {
+--
+2.53.0
+
--- /dev/null
+From 9d079da810823569a1246aea670560a5648ae356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 14:06:33 -0600
+Subject: drm/vmwgfx: Add seqno waiter for sync_files
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 0039a3b35b10d9c15d3d26320532ab56cc566750 ]
+
+Because sync_files are passive waiters they do not participate in
+the processing of fences like the traditional vmw_fence_wait IOCTL.
+If userspace exclusively uses sync_files for synchronization then
+nothing in the kernel actually processes fence updates as interrupts
+for fences are masked and ignored if the kernel does not indicate to the
+SVGA device that there are active waiters.
+
+This oversight results in a bug where the entire GUI can freeze waiting
+on a sync_file that will never be signalled as we've masked the interrupts
+to signal its completion. This bug is incredibly racy as any process which
+interacts with the fencing code via the 3D stack can process the stuck
+fences on behalf of the stuck process causing it to run again. Even a
+simple app like eglinfo is enough to resume the stuck process. Usually
+this bug is seen at a login screen like GDM because there are no other
+3D apps running.
+
+By adding a seqno waiter we re-enable interrupt based processing of the
+dma_fences associated with the sync_file which is signalled as part of a
+dma_fence_callback.
+
+This has likely been broken since it was initially added to the kernel in
+2017 but has gone unnoticed until mutter recently started using sync_files
+heavily over the course of 2024 as part of their explicit sync support.
+
+Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250228200633.642417-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 +++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index daea547704ddc..9bec26fda14cb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -4039,6 +4039,23 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
+ return 0;
+ }
+
++/*
++ * DMA fence callback to remove a seqno_waiter
++ */
++struct seqno_waiter_rm_context {
++ struct dma_fence_cb base;
++ struct vmw_private *dev_priv;
++};
++
++static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
++{
++ struct seqno_waiter_rm_context *ctx =
++ container_of(cb, struct seqno_waiter_rm_context, base);
++
++ vmw_seqno_waiter_remove(ctx->dev_priv);
++ kfree(ctx);
++}
++
+ int vmw_execbuf_process(struct drm_file *file_priv,
+ struct vmw_private *dev_priv,
+ void __user *user_commands, void *kernel_commands,
+@@ -4230,8 +4247,17 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ fput(sync_file->file);
+ put_unused_fd(out_fence_fd);
+ } else {
++ struct seqno_waiter_rm_context *ctx;
+ /* Link the fence with the FD created earlier */
+ fd_install(out_fence_fd, sync_file->file);
++ ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
++ ctx->dev_priv = dev_priv;
++ vmw_seqno_waiter_add(dev_priv);
++ if (dma_fence_add_callback(&fence->base, &ctx->base,
++ seqno_waiter_rm_cb) < 0) {
++ vmw_seqno_waiter_remove(dev_priv);
++ kfree(ctx);
++ }
+ }
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 762795dc246a2cd1f66587e6a3fd74d3d5548c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 14:30:22 +0100
+Subject: efi/mokvar-table: Avoid repeated map/unmap of the same page
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e3cf2d91d0583cae70aeb512da87e3ade25ea912 ]
+
+Tweak the logic that traverses the MOKVAR UEFI configuration table to
+only unmap the entry header and map the next one if they don't live in
+the same physical page.
+
+Link: https://lore.kernel.org/all/8f085931-3e9d-4386-9209-1d6c95616327@uncooperative.org/
+Tested-By: Peter Jones <pjones@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/mokvar-table.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c
+index 39a49adf007a5..69ac876ca809d 100644
+--- a/drivers/firmware/efi/mokvar-table.c
++++ b/drivers/firmware/efi/mokvar-table.c
+@@ -99,13 +99,13 @@ static struct kobject *mokvar_kobj;
+ */
+ void __init efi_mokvar_table_init(void)
+ {
++ struct efi_mokvar_table_entry __aligned(1) *mokvar_entry, *next_entry;
+ efi_memory_desc_t md;
+ void *va = NULL;
+ unsigned long cur_offset = 0;
+ unsigned long offset_limit;
+ unsigned long map_size_needed = 0;
+ unsigned long size;
+- struct efi_mokvar_table_entry *mokvar_entry;
+ int err;
+
+ if (!efi_enabled(EFI_MEMMAP))
+@@ -142,7 +142,7 @@ void __init efi_mokvar_table_init(void)
+ return;
+ }
+ mokvar_entry = va;
+-
++next:
+ /* Check for last sentinel entry */
+ if (mokvar_entry->name[0] == '\0') {
+ if (mokvar_entry->data_size != 0)
+@@ -156,7 +156,19 @@ void __init efi_mokvar_table_init(void)
+ mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0';
+
+ /* Advance to the next entry */
+- cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size;
++ size = sizeof(*mokvar_entry) + mokvar_entry->data_size;
++ cur_offset += size;
++
++ /*
++ * Don't bother remapping if the current entry header and the
++ * next one end on the same page.
++ */
++ next_entry = (void *)((unsigned long)mokvar_entry + size);
++ if (((((unsigned long)(mokvar_entry + 1) - 1) ^
++ ((unsigned long)(next_entry + 1) - 1)) & PAGE_MASK) == 0) {
++ mokvar_entry = next_entry;
++ goto next;
++ }
+ }
+
+ if (va)
+--
+2.53.0
+
--- /dev/null
+From bfccb09fdb85e91114583e1ea9e7d6a2315485ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 1a6c8ebc32e16..2b088418259b0 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -727,7 +727,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%02x%02x%02x%02x\n",
+--
+2.53.0
+
--- /dev/null
+From 07496096fbb353f30eaac1595383c8592732a58b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 212433eb6cc31..7794e5cf550fc 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 62e679f2c3cbd2fdede11c97fbab3d439930aff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jun 2025 21:33:53 -0400
+Subject: media: dvb-frontends: w7090p: fix null-ptr-deref in
+ w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
+
+From: Alex Guo <alexguo1023@gmail.com>
+
+[ Upstream commit ed0234c8458b3149f15e496b48a1c9874dd24a1b ]
+
+In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
+check on msg[0].len to prevent crash.
+
+Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
+
+Signed-off-by: Alex Guo <alexguo1023@gmail.com>
+Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index a4d060fb1babd..18b48a3984291 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2198,7 +2198,11 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1;
+ u16 i = 1000;
+- u16 serpar_num = msg[0].buf[0];
++ u16 serpar_num;
++
++ if (msg[0].len < 3)
++ return -EOPNOTSUPP;
++ serpar_num = msg[0].buf[0];
+
+ while (n_overflow == 1 && i) {
+ n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+@@ -2217,9 +2221,13 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1, n_empty = 1;
+ u16 i = 1000;
+- u16 serpar_num = msg[0].buf[0];
++ u16 serpar_num;
+ u16 read_word;
+
++ if (msg[0].len < 1 || msg[1].len < 2)
++ return -EOPNOTSUPP;
++ serpar_num = msg[0].buf[0];
++
+ while (n_overflow == 1 && i) {
+ n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+ i--;
+--
+2.53.0
+
--- /dev/null
+From bfe3c6804c83ddaade6f882277e363dadd75ac0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 08:55:23 -0400
+Subject: Revert "btrfs: fix transaction abort on set received ioctl due to
+ item overflow"
+
+This reverts commit 20b9a8d6f7ff4dc7dff3fdcba51730caa536a2de.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 2 --
+ fs/btrfs/ioctl.c | 21 ++------------------
+ fs/btrfs/uuid-tree.c | 46 --------------------------------------------
+ 3 files changed, 2 insertions(+), 67 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 15affee7c6d11..a9926fb10c491 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2869,8 +2869,6 @@ int btrfs_uuid_tree_add(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ u64 subid);
+ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ u64 subid);
+-int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
+- u8 *uuid, u8 type);
+ int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info);
+
+ /* dir-item.c */
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3712396c3f8a0..574a00db258a0 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4486,25 +4486,6 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ goto out;
+ }
+
+- received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
+- BTRFS_UUID_SIZE);
+-
+- /*
+- * Before we attempt to add the new received uuid, check if we have room
+- * for it in case there's already an item. If the size of the existing
+- * item plus this root's ID (u64) exceeds the maximum item size, we can
+- * return here without the need to abort a transaction. If we don't do
+- * this check, the btrfs_uuid_tree_add() call below would fail with
+- * -EOVERFLOW and result in a transaction abort. Malicious users could
+- * exploit this to turn the fs into RO mode.
+- */
+- if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) {
+- ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid,
+- BTRFS_UUID_KEY_RECEIVED_SUBVOL);
+- if (ret < 0)
+- goto out;
+- }
+-
+ /*
+ * 1 - root item
+ * 2 - uuid items (received uuid + subvol uuid)
+@@ -4520,6 +4501,8 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ sa->rtime.sec = ct.tv_sec;
+ sa->rtime.nsec = ct.tv_nsec;
+
++ received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
++ BTRFS_UUID_SIZE);
+ if (received_uuid_changed &&
+ !btrfs_is_empty_uuid(root_item->received_uuid)) {
+ ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid,
+diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
+index aee89c7293f65..28525ad7ff8cb 100644
+--- a/fs/btrfs/uuid-tree.c
++++ b/fs/btrfs/uuid-tree.c
+@@ -226,52 +226,6 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ return ret;
+ }
+
+-/*
+- * Check if we can add one root ID to a UUID key.
+- * If the key does not yet exists, we can, otherwise only if extended item does
+- * not exceeds the maximum item size permitted by the leaf size.
+- *
+- * Returns 0 on success, negative value on error.
+- */
+-int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
+- u8 *uuid, u8 type)
+-{
+- struct btrfs_path *path = NULL;
+- int ret;
+- u32 item_size;
+- struct btrfs_key key;
+-
+- if (WARN_ON_ONCE(!fs_info->uuid_root)) {
+- ret = -EINVAL;
+- goto out;
+- }
+-
+- path = btrfs_alloc_path();
+- if (!path) {
+- ret = -ENOMEM;
+- goto out;
+- }
+-
+- btrfs_uuid_to_key(uuid, type, &key);
+- ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0);
+- if (ret < 0)
+- goto out;
+- if (ret > 0) {
+- ret = 0;
+- goto out;
+- }
+-
+- item_size = btrfs_item_size(path->nodes[0], path->slots[0]);
+-
+- if (sizeof(struct btrfs_item) + item_size + sizeof(u64) >
+- BTRFS_LEAF_DATA_SIZE(fs_info))
+- ret = -EOVERFLOW;
+-
+-out:
+- btrfs_free_path(path);
+- return ret;
+-}
+-
+ static int btrfs_uuid_iter_rem(struct btrfs_root *uuid_root, u8 *uuid, u8 type,
+ u64 subid)
+ {
+--
+2.53.0
+
--- /dev/null
+From e10d488d35b51e42677b371088bdd8901edc34e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 09:44:24 -0400
+Subject: Revert "drm/vmwgfx: Add seqno waiter for sync_files"
+
+This reverts commit 7db6c88bb52f3b7525a06110cfd208990c49f8b4.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 -------------------------
+ 1 file changed, 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 361f96d09374d..daea547704ddc 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -4039,23 +4039,6 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
+ return 0;
+ }
+
+-/*
+- * DMA fence callback to remove a seqno_waiter
+- */
+-struct seqno_waiter_rm_context {
+- struct dma_fence_cb base;
+- struct vmw_private *dev_priv;
+-};
+-
+-static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
+-{
+- struct seqno_waiter_rm_context *ctx =
+- container_of(cb, struct seqno_waiter_rm_context, base);
+-
+- vmw_seqno_waiter_remove(ctx->dev_priv);
+- kfree(ctx);
+-}
+-
+ int vmw_execbuf_process(struct drm_file *file_priv,
+ struct vmw_private *dev_priv,
+ void __user *user_commands, void *kernel_commands,
+@@ -4249,15 +4232,6 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ } else {
+ /* Link the fence with the FD created earlier */
+ fd_install(out_fence_fd, sync_file->file);
+- struct seqno_waiter_rm_context *ctx =
+- kmalloc(sizeof(*ctx), GFP_KERNEL);
+- ctx->dev_priv = dev_priv;
+- vmw_seqno_waiter_add(dev_priv);
+- if (dma_fence_add_callback(&fence->base, &ctx->base,
+- seqno_waiter_rm_cb) < 0) {
+- vmw_seqno_waiter_remove(dev_priv);
+- kfree(ctx);
+- }
+ }
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 1486ed19c7f53899f7b16bec0e3e857377113bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 10:40:26 -0400
+Subject: Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in
+ w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
+
+This reverts commit b3d77a3fc71c084575d3df4ec6544b3fb6ce587d.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index 08b3ac8ff1083..a4d060fb1babd 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2198,8 +2198,6 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1;
+ u16 i = 1000;
+- if (msg[0].len < 3)
+- return -EOPNOTSUPP;
+ u16 serpar_num = msg[0].buf[0];
+
+ while (n_overflow == 1 && i) {
+@@ -2219,8 +2217,6 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
+ struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ u8 n_overflow = 1, n_empty = 1;
+ u16 i = 1000;
+- if (msg[0].len < 1 || msg[1].len < 2)
+- return -EOPNOTSUPP;
+ u16 serpar_num = msg[0].buf[0];
+ u16 read_word;
+
+--
+2.53.0
+
--- /dev/null
+From 9632149df503f37834581279a5bada1c4cc3f5ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 10:26:40 -0400
+Subject: Revert "scsi: core: Wake up the error handler when final completions
+ race against each other"
+
+This reverts commit cc872e35c0df80062abc71268d690a2f749e542e.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_error.c | 11 +----------
+ drivers/scsi/scsi_lib.c | 8 --------
+ 2 files changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 4e9114f069832..ffc6f3031e82b 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -241,20 +241,11 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
+ {
+ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+ struct Scsi_Host *shost = scmd->device->host;
+- unsigned int busy;
++ unsigned int busy = scsi_host_busy(shost);
+ unsigned long flags;
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ shost->host_failed++;
+- spin_unlock_irqrestore(shost->host_lock, flags);
+- /*
+- * The counting of busy requests needs to occur after adding to
+- * host_failed or after the lock acquire for adding to host_failed
+- * to prevent a race with host unbusy and missing an eh wakeup.
+- */
+- busy = scsi_host_busy(shost);
+-
+- spin_lock_irqsave(shost->host_lock, flags);
+ scsi_eh_wakeup(shost, busy);
+ spin_unlock_irqrestore(shost->host_lock, flags);
+ }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 8d570632982f3..fb48d47e9183e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -310,14 +310,6 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+ rcu_read_lock();
+ __clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
+ if (unlikely(scsi_host_in_recovery(shost))) {
+- /*
+- * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
+- * other CPUs before counting busy requests. Otherwise,
+- * reordering can cause CPUs to race and miss an eh wakeup
+- * when no CPU sees all busy requests as done or timed out.
+- */
+- smp_mb();
+-
+ unsigned int busy = scsi_host_busy(shost);
+
+ spin_lock_irqsave(shost->host_lock, flags);
+--
+2.53.0
+
--- /dev/null
+From e5721662a492a05259c70b35ea6884ecac92f1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From ab5cf50f7aa60abae478128bb0ec72bd4349b375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 11:08:13 -0500
+Subject: scsi: core: Wake up the error handler when final completions race
+ against each other
+
+From: David Jeffery <djeffery@redhat.com>
+
+[ Upstream commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 ]
+
+The fragile ordering between marking commands completed or failed so
+that the error handler only wakes when the last running command
+completes or times out has race conditions. These race conditions can
+cause the SCSI layer to fail to wake the error handler, leaving I/O
+through the SCSI host stuck as the error state cannot advance.
+
+First, there is an memory ordering issue within scsi_dec_host_busy().
+The write which clears SCMD_STATE_INFLIGHT may be reordered with reads
+counting in scsi_host_busy(). While the local CPU will see its own
+write, reordering can allow other CPUs in scsi_dec_host_busy() or
+scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to
+see a host busy equal to the host_failed count.
+
+This race condition can be prevented with a memory barrier on the error
+path to force the write to be visible before counting host busy
+commands.
+
+Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By
+counting busy commands before incrementing host_failed, it can race with a
+final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does
+not see host_failed incremented but scsi_eh_inc_host_failed() counts busy
+commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),
+resulting in neither waking the error handler task.
+
+This needs the call to scsi_host_busy() to be moved after host_failed is
+incremented to close the race condition.
+
+Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq")
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20260113161036.6730-1-djeffery@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_error.c | 11 ++++++++++-
+ drivers/scsi/scsi_lib.c | 11 ++++++++++-
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index ffc6f3031e82b..4e9114f069832 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -241,11 +241,20 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
+ {
+ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+ struct Scsi_Host *shost = scmd->device->host;
+- unsigned int busy = scsi_host_busy(shost);
++ unsigned int busy;
+ unsigned long flags;
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ shost->host_failed++;
++ spin_unlock_irqrestore(shost->host_lock, flags);
++ /*
++ * The counting of busy requests needs to occur after adding to
++ * host_failed or after the lock acquire for adding to host_failed
++ * to prevent a race with host unbusy and missing an eh wakeup.
++ */
++ busy = scsi_host_busy(shost);
++
++ spin_lock_irqsave(shost->host_lock, flags);
+ scsi_eh_wakeup(shost, busy);
+ spin_unlock_irqrestore(shost->host_lock, flags);
+ }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index fb48d47e9183e..e69d1c0ea4507 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -310,7 +310,16 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+ rcu_read_lock();
+ __clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
+ if (unlikely(scsi_host_in_recovery(shost))) {
+- unsigned int busy = scsi_host_busy(shost);
++ unsigned int busy;
++ /*
++ * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
++ * other CPUs before counting busy requests. Otherwise,
++ * reordering can cause CPUs to race and miss an eh wakeup
++ * when no CPU sees all busy requests as done or timed out.
++ */
++ smp_mb();
++
++ busy = scsi_host_busy(shost);
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ if (shost->host_failed || shost->host_eh_scheduled)
+--
+2.53.0
+
net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch
net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch
ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
+efi-mokvar-table-avoid-repeated-map-unmap-of-the-sam.patch
+revert-btrfs-fix-transaction-abort-on-set-received-i.patch
+btrfs-fix-transaction-abort-on-set-received-ioctl-du.patch
+revert-drm-vmwgfx-add-seqno-waiter-for-sync_files.patch
+drm-vmwgfx-add-seqno-waiter-for-sync_files.patch-18451
+revert-scsi-core-wake-up-the-error-handler-when-fina.patch
+scsi-core-wake-up-the-error-handler-when-final-compl.patch
+revert-media-dvb-frontends-w7090p-fix-null-ptr-deref.patch
+media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
--- /dev/null
+From a79c14b58ea2736af2a1d455de64dd237f4dcf35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 44007858c23fc..f178cb16b28cb 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -724,7 +724,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%02x%02x%02x%02x\n",
+--
+2.53.0
+
--- /dev/null
+From 31161ebaad51a826731789ab4cedb64adf80a05f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 52bee5de29883..12d5d7297b5c9 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From be4170d4ca365e32a765cca143c4c55c454bc10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 81b9d813655ad..de91996886dbb 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From bdc17f5b7295c20f60d51794ad0bc756d4b21e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
--- /dev/null
+From da559aea5d96b8b46fde45c74687671323c3a112 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d481e78958a74..2c7355e9547a1 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -33,7 +33,7 @@ properties:
+ const: 2
+
+ "#interrupt-cells":
+- const: 1
++ const: 2
+
+ ngpios:
+ description:
+@@ -84,7 +84,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupts = <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+--
+2.53.0
+
--- /dev/null
+From 4430acd035dab1b63979a9f5a23a0ae460653784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 755926fa0bf7d..c6a78436e9bba 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%4phN\n", extn->name);
+--
+2.53.0
+
--- /dev/null
+From 8597163006b29dc493b8347a81ce9c114c73cfa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 52bee5de29883..12d5d7297b5c9 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 04c6e51b5b691c6510f6b9bd25d5d82320161696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 81b9d813655ad..de91996886dbb 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 94fd11083f647d1450e58d9c1fa90077f85c7869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 98f17c29da69b..7b58b418b8a8b 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG 0x34
+ #define BNO055_CALIB_STAT_REG 0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+--
+2.53.0
+
--- /dev/null
+From 4b03c93ef1a41391e46322af5f7bdd41e5aaaf88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
--- /dev/null
+From 77a9f24f2e2627e8afd04af19bd8419b92678b1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index b86a8e48e731b..8eae30fe14f98 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ */
+ return -ENODEV;
+
+- if (status) {
++ if (usr && status) {
+ /*
+ * Releasing resources failed on the device side, which puts
+ * us in a bind since they may still be in use, so enable the
+@@ -1105,6 +1105,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ mutex_lock(&qdev->cntl_mutex);
+ if (!list_empty(&elem.list))
+ list_del(&elem.list);
++ /* resp_worker() processed the response but the wait was interrupted */
++ else if (ret == -ERESTARTSYS)
++ ret = 0;
+ if (!ret && !elem.buf)
+ ret = -ETIMEDOUT;
+ else if (ret > 0 && !elem.buf)
+@@ -1415,9 +1418,49 @@ static void resp_worker(struct work_struct *work)
+ }
+ mutex_unlock(&qdev->cntl_mutex);
+
+- if (!found)
++ if (!found) {
++ /*
++ * The user might have gone away at this point without waiting
++ * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++ * the device. If this is not handled correctly, the host will
++ * not know that the DBC[n] has been freed on the device.
++ * Due to this failure in synchronization between the device and
++ * the host, if another user requests to activate a network, and
++ * the device assigns DBC[n] again, save_dbc_buf() will hang,
++ * waiting for dbc[n]->in_use to be set to false, which will not
++ * happen unless the qaic_dev_reset_clean_local_state() gets
++ * called by resetting the device (or re-inserting the module).
++ *
++ * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++ * transactions in the message before disposing of it, then
++ * handle releasing the DBC resources.
++ *
++ * Since the user has gone away, if the device could not
++ * deactivate the network (status != 0), there is no way to
++ * enable and reassign the DBC to the user. We can put trust in
++ * the device that it will release all the active DBCs in
++ * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++ * otherwise, the user can issue an soc_reset to the device.
++ */
++ u32 msg_count = le32_to_cpu(msg->hdr.count);
++ u32 msg_len = le32_to_cpu(msg->hdr.len);
++ u32 len = 0;
++ int j;
++
++ for (j = 0; j < msg_count && len < msg_len; ++j) {
++ struct wire_trans_hdr *trans_hdr;
++
++ trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++ if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++ if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++ len += le32_to_cpu(trans_hdr->len);
++ } else {
++ len += le32_to_cpu(trans_hdr->len);
++ }
++ }
+ /* request must have timed out, drop packet */
+ kfree(msg);
++ }
+
+ kfree(resp);
+ }
+--
+2.53.0
+
--- /dev/null
+From 93b23055139428192e95f78d236a875cafee6e74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d78da7dd2a566..dafd80bdd23aa 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -34,7 +34,7 @@ properties:
+ const: 2
+
+ "#interrupt-cells":
+- const: 1
++ const: 2
+
+ ngpios:
+ description:
+@@ -83,7 +83,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupts = <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+--
+2.53.0
+
--- /dev/null
+From a730f9477a4942dcd752149b9452d2be986605d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+--
+2.53.0
+
--- /dev/null
+From 0055f19461abea51f48ec8f3a8fe75214087da4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%4phN\n", extn->name);
+--
+2.53.0
+
--- /dev/null
+From 8d0072cdbeae86c939494a4664a5f3d4e7f436dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 5ac476d3cdd2a..4cf98ffae841c 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 8c0eb4be14f5e5d59d2c7a4b8e44fc69a11e49d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 5c9466244d70d..ecc1be33b3b1b 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From d3e78dd6236955258ee81d58ab1124e1a06915eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 0b2d6ad699f30..932821254bf89 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG 0x34
+ #define BNO055_CALIB_STAT_REG 0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+--
+2.53.0
+
--- /dev/null
+From 74940713c49e293fce31ad1eac6cde60f506fe26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ switch (ralink_soc) {
+ case RT2880_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt2880-sysc";
+ case RT3883_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3883-sysc";
+ case RT305X_SOC_RT3050:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3050-sysc";
+ case RT305X_SOC_RT3052:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3052-sysc";
+ case RT305X_SOC_RT3350:
+ *idx = 1;
+--
+2.53.0
+
--- /dev/null
+From ce6733647d60ccaba762b60ddcd0c9c7a09ff4d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 9f3db3503dabd..edaab2aa16a3e 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From b74fe4717c0c335e3c0efe9446f946842b3cd4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index fff27f3378cbf..a0a47e50b71ca 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -669,7 +669,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+ * Called in:
+ * - place_entity() -- before enqueue
+ * - update_entity_lag() -- before dequeue
+- * - entity_tick()
++ * - update_deadline() -- slice expiration
+ *
+ * This means it is one entry 'behind' but that puts it close enough to where
+ * the bound on entity_key() is at most two lag bounds.
+@@ -1036,6 +1036,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ * EEVDF: vd_i = ve_i + r_i / w_i
+ */
+ se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++ avg_vruntime(cfs_rq);
+
+ /*
+ * The task has consumed its request, reschedule.
+@@ -5725,11 +5726,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ update_load_avg(cfs_rq, curr, UPDATE_TG);
+ update_cfs_group(curr);
+
+- /*
+- * Pulls along cfs_rq::zero_vruntime.
+- */
+- avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ /*
+ * queued ticks are scheduled to match the slice, so don't bother
+@@ -9143,7 +9139,7 @@ static void yield_task_fair(struct rq *rq)
+ */
+ if (entity_eligible(cfs_rq, se)) {
+ se->vruntime = se->deadline;
+- se->deadline += calc_delta_fair(se->slice, se);
++ update_deadline(cfs_rq, se);
+ }
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 53aaf3f310af379ed4c9f06452007c748c185cd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 18:56:25 +0200
+Subject: sched/fair: Use protect_slice() instead of direct comparison
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 9cdb4fe20cd239c848b5c3f5753d83a9443ba329 ]
+
+Replace the test by the relevant protect_slice() function.
+
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dhaval Giani (AMD) <dhaval@gianis.ca>
+Link: https://lkml.kernel.org/r/20250708165630.1948751-2-vincent.guittot@linaro.org
+Stable-dep-of: 1319ea57529e ("sched/fair: Fix zero_vruntime tracking fix")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index efd3cbefb5a22..fff27f3378cbf 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1181,7 +1181,7 @@ static inline bool did_preempt_short(struct cfs_rq *cfs_rq, struct sched_entity
+ if (!sched_feat(PREEMPT_SHORT))
+ return false;
+
+- if (curr->vlag == curr->deadline)
++ if (protect_slice(curr))
+ return false;
+
+ return !entity_eligible(cfs_rq, curr);
+--
+2.53.0
+
ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-use-protect_slice-instead-of-direct-compa.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
--- /dev/null
+From f5319f8ccd21f394655901ae5f76b6135f790a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index b86a8e48e731b..8eae30fe14f98 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ */
+ return -ENODEV;
+
+- if (status) {
++ if (usr && status) {
+ /*
+ * Releasing resources failed on the device side, which puts
+ * us in a bind since they may still be in use, so enable the
+@@ -1105,6 +1105,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ mutex_lock(&qdev->cntl_mutex);
+ if (!list_empty(&elem.list))
+ list_del(&elem.list);
++ /* resp_worker() processed the response but the wait was interrupted */
++ else if (ret == -ERESTARTSYS)
++ ret = 0;
+ if (!ret && !elem.buf)
+ ret = -ETIMEDOUT;
+ else if (ret > 0 && !elem.buf)
+@@ -1415,9 +1418,49 @@ static void resp_worker(struct work_struct *work)
+ }
+ mutex_unlock(&qdev->cntl_mutex);
+
+- if (!found)
++ if (!found) {
++ /*
++ * The user might have gone away at this point without waiting
++ * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++ * the device. If this is not handled correctly, the host will
++ * not know that the DBC[n] has been freed on the device.
++ * Due to this failure in synchronization between the device and
++ * the host, if another user requests to activate a network, and
++ * the device assigns DBC[n] again, save_dbc_buf() will hang,
++ * waiting for dbc[n]->in_use to be set to false, which will not
++ * happen unless the qaic_dev_reset_clean_local_state() gets
++ * called by resetting the device (or re-inserting the module).
++ *
++ * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++ * transactions in the message before disposing of it, then
++ * handle releasing the DBC resources.
++ *
++ * Since the user has gone away, if the device could not
++ * deactivate the network (status != 0), there is no way to
++ * enable and reassign the DBC to the user. We can put trust in
++ * the device that it will release all the active DBCs in
++ * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++ * otherwise, the user can issue an soc_reset to the device.
++ */
++ u32 msg_count = le32_to_cpu(msg->hdr.count);
++ u32 msg_len = le32_to_cpu(msg->hdr.len);
++ u32 len = 0;
++ int j;
++
++ for (j = 0; j < msg_count && len < msg_len; ++j) {
++ struct wire_trans_hdr *trans_hdr;
++
++ trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++ if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++ if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++ len += le32_to_cpu(trans_hdr->len);
++ } else {
++ len += le32_to_cpu(trans_hdr->len);
++ }
++ }
+ /* request must have timed out, drop packet */
+ kfree(msg);
++ }
+
+ kfree(resp);
+ }
+--
+2.53.0
+
--- /dev/null
+From ebb6341ca64853ce0c6093f4d98d19a8b0e795c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 11:46:05 +0530
+Subject: ACPI: RIMT: Add dependency between iommu and devices
+
+From: Sunil V L <sunilvl@oss.qualcomm.com>
+
+[ Upstream commit 9156585280f161fc1c3552cf1860559edb2bb7e3 ]
+
+EPROBE_DEFER ensures IOMMU devices are probed before the devices that
+depend on them. During shutdown, however, the IOMMU may be removed
+first, leading to issues. To avoid this, a device link is added
+which enforces the correct removal order.
+
+Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT")
+Signed-off-by: Sunil V L <sunilvl@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/riscv/rimt.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/riscv/rimt.c b/drivers/acpi/riscv/rimt.c
+index 7f423405e5ef0..8eaa8731bddd6 100644
+--- a/drivers/acpi/riscv/rimt.c
++++ b/drivers/acpi/riscv/rimt.c
+@@ -263,6 +263,13 @@ static int rimt_iommu_xlate(struct device *dev, struct acpi_rimt_node *node, u32
+ if (!rimt_fwnode)
+ return -EPROBE_DEFER;
+
++ /*
++ * EPROBE_DEFER ensures IOMMU is probed before the devices that
++ * depend on them. During shutdown, however, the IOMMU may be removed
++ * first, leading to issues. To avoid this, a device link is added
++ * which enforces the correct removal order.
++ */
++ device_link_add(dev, rimt_fwnode->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+ return acpi_iommu_fwspec_init(dev, deviceid, rimt_fwnode);
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 7587f6c0f8ee45faa1f6905c798b1fded99b87d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2026 14:46:52 +0800
+Subject: drm/sysfb: Fix efidrm error handling and memory type mismatch
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af ]
+
+Fix incorrect error checking and memory type confusion in
+efidrm_device_create(). devm_memremap() returns error pointers, not
+NULL, and returns system memory while devm_ioremap() returns I/O memory.
+The code incorrectly passes system memory to iosys_map_set_vaddr_iomem().
+
+Restructure to handle each memory type separately. Use devm_ioremap*()
+with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for
+WT/WB.
+
+Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260311064652.2903449-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sysfb/efidrm.c | 46 +++++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
+index 1883c4a8604c2..97a3711e79337 100644
+--- a/drivers/gpu/drm/sysfb/efidrm.c
++++ b/drivers/gpu/drm/sysfb/efidrm.c
+@@ -150,7 +150,6 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ struct drm_sysfb_device *sysfb;
+ struct drm_device *dev;
+ struct resource *mem = NULL;
+- void __iomem *screen_base = NULL;
+ struct drm_plane *primary_plane;
+ struct drm_crtc *crtc;
+ struct drm_encoder *encoder;
+@@ -235,21 +234,38 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+
+ mem_flags = efidrm_get_mem_flags(dev, res->start, vsize);
+
+- if (mem_flags & EFI_MEMORY_WC)
+- screen_base = devm_ioremap_wc(&pdev->dev, mem->start, resource_size(mem));
+- else if (mem_flags & EFI_MEMORY_UC)
+- screen_base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
+- else if (mem_flags & EFI_MEMORY_WT)
+- screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+- MEMREMAP_WT);
+- else if (mem_flags & EFI_MEMORY_WB)
+- screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+- MEMREMAP_WB);
+- else
++ if (mem_flags & EFI_MEMORY_WC) {
++ void __iomem *screen_base = devm_ioremap_wc(&pdev->dev, mem->start,
++ resource_size(mem));
++
++ if (!screen_base)
++ return ERR_PTR(-ENXIO);
++ iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_UC) {
++ void __iomem *screen_base = devm_ioremap(&pdev->dev, mem->start,
++ resource_size(mem));
++
++ if (!screen_base)
++ return ERR_PTR(-ENXIO);
++ iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_WT) {
++ void *screen_base = devm_memremap(&pdev->dev, mem->start,
++ resource_size(mem), MEMREMAP_WT);
++
++ if (IS_ERR(screen_base))
++ return ERR_CAST(screen_base);
++ iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_WB) {
++ void *screen_base = devm_memremap(&pdev->dev, mem->start,
++ resource_size(mem), MEMREMAP_WB);
++
++ if (IS_ERR(screen_base))
++ return ERR_CAST(screen_base);
++ iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++ } else {
+ drm_err(dev, "invalid mem_flags: 0x%llx\n", mem_flags);
+- if (!screen_base)
+- return ERR_PTR(-ENOMEM);
+- iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ return ERR_PTR(-EINVAL);
++ }
+
+ /*
+ * Modesetting
+--
+2.53.0
+
--- /dev/null
+From 734d662f41597d3c2964f06763cfa282099ac252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:20 -0700
+Subject: drm/xe/pxp: Clean up termination status on failure
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit e2628e670bb0923fcdc00828bfcd67b26a7df020 ]
+
+If the PXP HW termination fails during PXP start, the normal completion
+code won't be called, so the termination will remain uncomplete. To avoid
+unnecessary waits, mark the termination as completed from the error path.
+Note that we already do this if the termination fails when handling a
+termination irq from the HW.
+
+Fixes: f8caa80154c4 ("drm/xe/pxp: Add PXP queue tracking and session start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-7-daniele.ceraolospurio@intel.com
+(cherry picked from commit 5d9e708d2a69ab1f64a17aec810cd7c70c5b9fab)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index bdbdbbf6a6781..ba4d52001b853 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -603,6 +603,7 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ drm_err(&pxp->xe->drm, "PXP termination failed before start\n");
+ mutex_lock(&pxp->mutex);
+ pxp->status = XE_PXP_ERROR;
++ complete_all(&pxp->termination);
+
+ goto out_unlock;
+ }
+--
+2.53.0
+
--- /dev/null
+From 1d4058835a4bd305bc4cfe549971864128a29299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:22 -0700
+Subject: drm/xe/pxp: Clear restart flag in pxp_start after jumping back
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 76903b2057c8677c2c006e87fede15f496555dc0 ]
+
+If we don't clear the flag we'll keep jumping back at the beginning of
+the function once we reach the end.
+
+Fixes: ccd3c6820a90 ("drm/xe/pxp: Decouple queue addition from PXP start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-9-daniele.ceraolospurio@intel.com
+(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index fdcecc026e937..9261a8412b64f 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -532,7 +532,7 @@ static int __exec_queue_add(struct xe_pxp *pxp, struct xe_exec_queue *q)
+ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ {
+ int ret = 0;
+- bool restart = false;
++ bool restart;
+
+ if (!xe_pxp_is_enabled(pxp))
+ return -ENODEV;
+@@ -561,6 +561,8 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ msecs_to_jiffies(PXP_ACTIVATION_TIMEOUT_MS)))
+ return -ETIMEDOUT;
+
++ restart = false;
++
+ mutex_lock(&pxp->mutex);
+
+ /* If PXP is not already active, turn it on */
+--
+2.53.0
+
--- /dev/null
+From 827f4c6e8f1c3f3587a17e404930e0c1e34952cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:21 -0700
+Subject: drm/xe/pxp: Remove incorrect handling of impossible state during
+ suspend
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 4fed244954c2dc9aafa333d08f66b14345225e03 ]
+
+The default case of the PXP suspend switch is incorrectly exiting
+without releasing the lock. However, this case is impossible to hit
+because we're switching on an enum and all the valid enum values have
+their own cases. Therefore, we can just get rid of the default case
+and rely on the compiler to warn us if a new enum value is added and
+we forget to add it to the switch.
+
+Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-8-daniele.ceraolospurio@intel.com
+(cherry picked from commit f1b5a77fc9b6a90cd9a5e3db9d4c73ae1edfcfac)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index ba4d52001b853..fdcecc026e937 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -891,11 +891,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ pxp->key_instance++;
+ needs_queue_inval = true;
+ break;
+- default:
+- drm_err(&pxp->xe->drm, "unexpected state during PXP suspend: %u",
+- pxp->status);
+- ret = -EIO;
+- goto out;
+ }
+
+ /*
+@@ -920,7 +915,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+
+ pxp->last_suspend_key_instance = pxp->key_instance;
+
+-out:
+ return ret;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 5302f7d02ce0f830ce9ee1b2223f50ecc8bbdfe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d78da7dd2a566..dafd80bdd23aa 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -34,7 +34,7 @@ properties:
+ const: 2
+
+ "#interrupt-cells":
+- const: 1
++ const: 2
+
+ ngpios:
+ description:
+@@ -83,7 +83,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupts = <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+--
+2.53.0
+
--- /dev/null
+From 68da4dce56260e5974879b6312a4fd9cf67e1180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 11:09:25 +0200
+Subject: gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit df900536e85819f6168783d5f6b3908d47811fdd ]
+
+This function takes a GPIO descriptor as first argument. Make its naming
+consistent with the rest of the GPIO codebase and use the gpiod_ prefix.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Link: https://lore.kernel.org/r/20251016-aspeed-gpiolib-include-v1-1-31201c06d124@linaro.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 6df6ea4b3d15 ("gpiolib: clear requested flag if line is invalid")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed.c | 6 ++---
+ drivers/gpio/gpiolib-cdev.c | 12 +++++-----
+ drivers/gpio/gpiolib-sysfs.c | 14 +++++------
+ drivers/gpio/gpiolib.c | 46 ++++++++++++++++++------------------
+ drivers/gpio/gpiolib.h | 2 +-
+ 5 files changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 7953a9c4e36d7..3da37a0fda3fb 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -24,7 +24,7 @@
+
+ /*
+ * These two headers aren't meant to be used by GPIO drivers. We need
+- * them in order to access gpio_chip_hwgpio() which we need to implement
++ * them in order to access gpiod_hwgpio() which we need to implement
+ * the aspeed specific API which allows the coprocessor to request
+ * access to some GPIOs and to arbitrate between coprocessor and ARM.
+ */
+@@ -942,7 +942,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc,
+ {
+ struct gpio_chip *chip = gpiod_to_chip(desc);
+ struct aspeed_gpio *gpio = gpiochip_get_data(chip);
+- int rc = 0, bindex, offset = gpio_chip_hwgpio(desc);
++ int rc = 0, bindex, offset = gpiod_hwgpio(desc);
+ const struct aspeed_gpio_bank *bank = to_bank(offset);
+
+ if (!aspeed_gpio_support_copro(gpio))
+@@ -987,7 +987,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc)
+ {
+ struct gpio_chip *chip = gpiod_to_chip(desc);
+ struct aspeed_gpio *gpio = gpiochip_get_data(chip);
+- int rc = 0, bindex, offset = gpio_chip_hwgpio(desc);
++ int rc = 0, bindex, offset = gpiod_hwgpio(desc);
+
+ if (!aspeed_gpio_support_copro(gpio))
+ return -EOPNOTSUPP;
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index e76bcbd647539..986312c71678f 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -676,7 +676,7 @@ static enum hte_return process_hw_ts_thread(void *p)
+ }
+ le.line_seqno = line->line_seqno;
+ le.seqno = (lr->num_lines == 1) ? le.line_seqno : line->req_seqno;
+- le.offset = gpio_chip_hwgpio(line->desc);
++ le.offset = gpiod_hwgpio(line->desc);
+
+ linereq_put_event(lr, &le);
+
+@@ -793,7 +793,7 @@ static irqreturn_t edge_irq_thread(int irq, void *p)
+ line->line_seqno++;
+ le.line_seqno = line->line_seqno;
+ le.seqno = (lr->num_lines == 1) ? le.line_seqno : line->req_seqno;
+- le.offset = gpio_chip_hwgpio(line->desc);
++ le.offset = gpiod_hwgpio(line->desc);
+
+ linereq_put_event(lr, &le);
+
+@@ -891,7 +891,7 @@ static void debounce_work_func(struct work_struct *work)
+
+ lr = line->req;
+ le.timestamp_ns = line_event_timestamp(line);
+- le.offset = gpio_chip_hwgpio(line->desc);
++ le.offset = gpiod_hwgpio(line->desc);
+ #ifdef CONFIG_HTE
+ if (edflags & GPIO_V2_LINE_FLAG_EVENT_CLOCK_HTE) {
+ /* discard events except the last one */
+@@ -1591,7 +1591,7 @@ static void linereq_show_fdinfo(struct seq_file *out, struct file *file)
+
+ for (i = 0; i < lr->num_lines; i++)
+ seq_printf(out, "gpio-line:\t%d\n",
+- gpio_chip_hwgpio(lr->lines[i].desc));
++ gpiod_hwgpio(lr->lines[i].desc));
+ }
+ #endif
+
+@@ -2244,7 +2244,7 @@ static void gpio_desc_to_lineinfo(struct gpio_desc *desc,
+ return;
+
+ memset(info, 0, sizeof(*info));
+- info->offset = gpio_chip_hwgpio(desc);
++ info->offset = gpiod_hwgpio(desc);
+
+ if (desc->name)
+ strscpy(info->name, desc->name, sizeof(info->name));
+@@ -2550,7 +2550,7 @@ static int lineinfo_changed_notify(struct notifier_block *nb,
+ struct gpio_desc *desc = data;
+ struct file *fp;
+
+- if (!test_bit(gpio_chip_hwgpio(desc), cdev->watched_lines))
++ if (!test_bit(gpiod_hwgpio(desc), cdev->watched_lines))
+ return NOTIFY_DONE;
+
+ /* Keep the file descriptor alive for the duration of the notification. */
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index e044690ad412b..d4a46a0a37d8f 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -244,7 +244,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)
+ * Remove this redundant call (along with the corresponding unlock)
+ * when those drivers have been fixed.
+ */
+- ret = gpiochip_lock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++ ret = gpiochip_lock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ if (ret < 0)
+ goto err_clr_bits;
+
+@@ -258,7 +258,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)
+ return 0;
+
+ err_unlock:
+- gpiochip_unlock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++ gpiochip_unlock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ err_clr_bits:
+ clear_bit(GPIOD_FLAG_EDGE_RISING, &desc->flags);
+ clear_bit(GPIOD_FLAG_EDGE_FALLING, &desc->flags);
+@@ -280,7 +280,7 @@ static void gpio_sysfs_free_irq(struct gpiod_data *data)
+
+ data->irq_flags = 0;
+ free_irq(data->irq, data);
+- gpiochip_unlock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++ gpiochip_unlock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ clear_bit(GPIOD_FLAG_EDGE_RISING, &desc->flags);
+ clear_bit(GPIOD_FLAG_EDGE_FALLING, &desc->flags);
+ }
+@@ -478,10 +478,10 @@ static int export_gpio_desc(struct gpio_desc *desc)
+ if (!guard.gc)
+ return -ENODEV;
+
+- offset = gpio_chip_hwgpio(desc);
++ offset = gpiod_hwgpio(desc);
+ if (!gpiochip_line_is_valid(guard.gc, offset)) {
+ pr_debug_ratelimited("%s: GPIO %d masked\n", __func__,
+- gpio_chip_hwgpio(desc));
++ gpiod_hwgpio(desc));
+ return -EINVAL;
+ }
+
+@@ -823,7 +823,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ }
+
+ desc_data->chip_attr_group.name = kasprintf(GFP_KERNEL, "gpio%u",
+- gpio_chip_hwgpio(desc));
++ gpiod_hwgpio(desc));
+ if (!desc_data->chip_attr_group.name) {
+ status = -ENOMEM;
+ goto err_put_dirent;
+@@ -843,7 +843,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ if (status)
+ goto err_free_name;
+
+- path = kasprintf(GFP_KERNEL, "gpio%u/value", gpio_chip_hwgpio(desc));
++ path = kasprintf(GFP_KERNEL, "gpio%u/value", gpiod_hwgpio(desc));
+ if (!path) {
+ status = -ENOMEM;
+ goto err_remove_groups;
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 4524c89946d7c..497fda9bf8f1e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -443,7 +443,7 @@ int gpiod_get_direction(struct gpio_desc *desc)
+ if (!guard.gc)
+ return -ENODEV;
+
+- offset = gpio_chip_hwgpio(desc);
++ offset = gpiod_hwgpio(desc);
+ flags = READ_ONCE(desc->flags);
+
+ /*
+@@ -2446,7 +2446,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ if (test_and_set_bit(GPIOD_FLAG_REQUESTED, &desc->flags))
+ return -EBUSY;
+
+- offset = gpio_chip_hwgpio(desc);
++ offset = gpiod_hwgpio(desc);
+ if (!gpiochip_line_is_valid(guard.gc, offset))
+ return -EINVAL;
+
+@@ -2508,7 +2508,7 @@ static void gpiod_free_commit(struct gpio_desc *desc)
+
+ if (guard.gc && test_bit(GPIOD_FLAG_REQUESTED, &flags)) {
+ if (guard.gc->free)
+- guard.gc->free(guard.gc, gpio_chip_hwgpio(desc));
++ guard.gc->free(guard.gc, gpiod_hwgpio(desc));
+
+ clear_bit(GPIOD_FLAG_ACTIVE_LOW, &flags);
+ clear_bit(GPIOD_FLAG_REQUESTED, &flags);
+@@ -2668,7 +2668,7 @@ int gpio_do_set_config(struct gpio_desc *desc, unsigned long config)
+ if (!guard.gc->set_config)
+ return -ENOTSUPP;
+
+- ret = guard.gc->set_config(guard.gc, gpio_chip_hwgpio(desc), config);
++ ret = guard.gc->set_config(guard.gc, gpiod_hwgpio(desc), config);
+ if (ret > 0)
+ ret = -EBADE;
+
+@@ -2699,7 +2699,7 @@ static int gpio_set_config_with_argument_optional(struct gpio_desc *desc,
+ u32 argument)
+ {
+ struct device *dev = &desc->gdev->dev;
+- int gpio = gpio_chip_hwgpio(desc);
++ int gpio = gpiod_hwgpio(desc);
+ int ret;
+
+ ret = gpio_set_config_with_argument(desc, mode, argument);
+@@ -2862,9 +2862,9 @@ int gpiod_direction_input_nonotify(struct gpio_desc *desc)
+ */
+ if (guard.gc->direction_input) {
+ ret = gpiochip_direction_input(guard.gc,
+- gpio_chip_hwgpio(desc));
++ gpiod_hwgpio(desc));
+ } else if (guard.gc->get_direction) {
+- dir = gpiochip_get_direction(guard.gc, gpio_chip_hwgpio(desc));
++ dir = gpiochip_get_direction(guard.gc, gpiod_hwgpio(desc));
+ if (dir < 0)
+ return dir;
+
+@@ -2923,12 +2923,12 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+
+ if (guard.gc->direction_output) {
+ ret = gpiochip_direction_output(guard.gc,
+- gpio_chip_hwgpio(desc), val);
++ gpiod_hwgpio(desc), val);
+ } else {
+ /* Check that we are in output mode if we can */
+ if (guard.gc->get_direction) {
+ dir = gpiochip_get_direction(guard.gc,
+- gpio_chip_hwgpio(desc));
++ gpiod_hwgpio(desc));
+ if (dir < 0)
+ return dir;
+
+@@ -2943,7 +2943,7 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+ * If we can't actively set the direction, we are some
+ * output-only chip, so just drive the output as desired.
+ */
+- ret = gpiochip_set(guard.gc, gpio_chip_hwgpio(desc), val);
++ ret = gpiochip_set(guard.gc, gpiod_hwgpio(desc), val);
+ if (ret)
+ return ret;
+ }
+@@ -3094,7 +3094,7 @@ int gpiod_enable_hw_timestamp_ns(struct gpio_desc *desc, unsigned long flags)
+ }
+
+ ret = guard.gc->en_hw_timestamp(guard.gc,
+- gpio_chip_hwgpio(desc), flags);
++ gpiod_hwgpio(desc), flags);
+ if (ret)
+ gpiod_warn(desc, "%s: hw ts request failed\n", __func__);
+
+@@ -3126,7 +3126,7 @@ int gpiod_disable_hw_timestamp_ns(struct gpio_desc *desc, unsigned long flags)
+ return -ENOTSUPP;
+ }
+
+- ret = guard.gc->dis_hw_timestamp(guard.gc, gpio_chip_hwgpio(desc),
++ ret = guard.gc->dis_hw_timestamp(guard.gc, gpiod_hwgpio(desc),
+ flags);
+ if (ret)
+ gpiod_warn(desc, "%s: hw ts release failed\n", __func__);
+@@ -3261,7 +3261,7 @@ static int gpiochip_get(struct gpio_chip *gc, unsigned int offset)
+
+ static int gpio_chip_get_value(struct gpio_chip *gc, const struct gpio_desc *desc)
+ {
+- return gc->get ? gpiochip_get(gc, gpio_chip_hwgpio(desc)) : -EIO;
++ return gc->get ? gpiochip_get(gc, gpiod_hwgpio(desc)) : -EIO;
+ }
+
+ /* I/O calls are only valid after configuration completed; the relevant
+@@ -3421,7 +3421,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
+ first = i;
+ do {
+ const struct gpio_desc *desc = desc_array[i];
+- int hwgpio = gpio_chip_hwgpio(desc);
++ int hwgpio = gpiod_hwgpio(desc);
+
+ __set_bit(hwgpio, mask);
+ i++;
+@@ -3443,7 +3443,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
+
+ for (j = first; j < i; ) {
+ const struct gpio_desc *desc = desc_array[j];
+- int hwgpio = gpio_chip_hwgpio(desc);
++ int hwgpio = gpiod_hwgpio(desc);
+ int value = test_bit(hwgpio, bits);
+
+ if (!raw && test_bit(GPIOD_FLAG_ACTIVE_LOW, &desc->flags))
+@@ -3580,7 +3580,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_array_value);
+ */
+ static int gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
+ {
+- int ret = 0, offset = gpio_chip_hwgpio(desc);
++ int ret = 0, offset = gpiod_hwgpio(desc);
+
+ CLASS(gpio_chip_guard, guard)(desc);
+ if (!guard.gc)
+@@ -3609,7 +3609,7 @@ static int gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
+ */
+ static int gpio_set_open_source_value_commit(struct gpio_desc *desc, bool value)
+ {
+- int ret = 0, offset = gpio_chip_hwgpio(desc);
++ int ret = 0, offset = gpiod_hwgpio(desc);
+
+ CLASS(gpio_chip_guard, guard)(desc);
+ if (!guard.gc)
+@@ -3641,7 +3641,7 @@ static int gpiod_set_raw_value_commit(struct gpio_desc *desc, bool value)
+ return -ENODEV;
+
+ trace_gpio_value(desc_to_gpio(desc), 0, value);
+- return gpiochip_set(guard.gc, gpio_chip_hwgpio(desc), value);
++ return gpiochip_set(guard.gc, gpiod_hwgpio(desc), value);
+ }
+
+ /*
+@@ -3764,7 +3764,7 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep,
+
+ do {
+ struct gpio_desc *desc = desc_array[i];
+- int hwgpio = gpio_chip_hwgpio(desc);
++ int hwgpio = gpiod_hwgpio(desc);
+ int value = test_bit(i, value_bitmap);
+
+ if (unlikely(!test_bit(GPIOD_FLAG_IS_OUT, &desc->flags)))
+@@ -4004,7 +4004,7 @@ int gpiod_to_irq(const struct gpio_desc *desc)
+ if (!gc)
+ return -ENODEV;
+
+- offset = gpio_chip_hwgpio(desc);
++ offset = gpiod_hwgpio(desc);
+ if (gc->to_irq) {
+ ret = gc->to_irq(gc, offset);
+ if (ret)
+@@ -4961,7 +4961,7 @@ int gpiod_hog(struct gpio_desc *desc, const char *name,
+ if (test_and_set_bit(GPIOD_FLAG_IS_HOGGED, &desc->flags))
+ return 0;
+
+- hwnum = gpio_chip_hwgpio(desc);
++ hwnum = gpiod_hwgpio(desc);
+
+ local_desc = gpiochip_request_own_desc(guard.gc, hwnum, name,
+ lflags, dflags);
+@@ -5042,7 +5042,7 @@ struct gpio_descs *__must_check gpiod_get_array(struct device *dev,
+ * If pin hardware number of array member 0 is also 0, select
+ * its chip as a candidate for fast bitmap processing path.
+ */
+- if (descs->ndescs == 0 && gpio_chip_hwgpio(desc) == 0) {
++ if (descs->ndescs == 0 && gpiod_hwgpio(desc) == 0) {
+ struct gpio_descs *array;
+
+ bitmap_size = BITS_TO_LONGS(gdev->ngpio > count ?
+@@ -5087,7 +5087,7 @@ struct gpio_descs *__must_check gpiod_get_array(struct device *dev,
+ * Detect array members which belong to the 'fast' chip
+ * but their pins are not in hardware order.
+ */
+- else if (gpio_chip_hwgpio(desc) != descs->ndescs) {
++ else if (gpiod_hwgpio(desc) != descs->ndescs) {
+ /*
+ * Don't use fast path if all array members processed so
+ * far belong to the same chip as this one but its pin
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 6ee29d0222393..2b4f479d32123 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -276,7 +276,7 @@ const char *gpiod_get_label(struct gpio_desc *desc);
+ /*
+ * Return the GPIO number of the passed descriptor relative to its chip
+ */
+-static inline int gpio_chip_hwgpio(const struct gpio_desc *desc)
++static inline int gpiod_hwgpio(const struct gpio_desc *desc)
+ {
+ return desc - &desc->gdev->descs[0];
+ }
+--
+2.53.0
+
--- /dev/null
+From b3ac613a95d703790e82d31c435db7b3fcab48b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2026 20:44:03 +0000
+Subject: gpiolib: clear requested flag if line is invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <pobrn@protonmail.com>
+
+[ Upstream commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f ]
+
+If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but
+`desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result
+in subsequent calls misleadingly returning `-EBUSY`.
+
+Fix that by clearing the flag in case of failure.
+
+Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs")
+Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 497fda9bf8f1e..9dd22b4bbff54 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2447,8 +2447,10 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ return -EBUSY;
+
+ offset = gpiod_hwgpio(desc);
+- if (!gpiochip_line_is_valid(guard.gc, offset))
+- return -EINVAL;
++ if (!gpiochip_line_is_valid(guard.gc, offset)) {
++ ret = -EINVAL;
++ goto out_clear_bit;
++ }
+
+ /* NOTE: gpio_request() can be called in early boot,
+ * before IRQs are enabled, for non-sleeping (SOC) GPIOs.
+--
+2.53.0
+
--- /dev/null
+From c1cb8fdf468d9fbdbbd5781acadba6acaf93ba55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 14:49:06 -0700
+Subject: hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Corey Hickey <bugfood-c@fatooh.org>
+
+[ Upstream commit cffff6df669a438ecac506dadd49a53d4475a796 ]
+
+On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of
+zero for T_Sensor. On this board, the register for T_Sensor is at a
+different address, as found by experimentation and confirmed by
+comparison to an independent temperature reading.
+
+* sensor disconnected: -62.0°C
+* ambient temperature: +22.0°C
+* held between fingers: +30.0°C
+
+Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI
+without causing a regression for other 600-series boards
+
+Fixes: e0444758dd1b ("hwmon: (asus-ec-sensors) add PRIME X670E-PRO WIFI")
+Signed-off-by: Corey Hickey <bugfood-c@fatooh.org>
+Link: https://lore.kernel.org/r/20260331215414.368785-1-bugfood-ml@fatooh.org
+[groeck: Fixed typo, updated Fixes: reference]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 34a8f6b834c97..95c50d3a788ce 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -111,6 +111,8 @@ enum ec_sensors {
+ ec_sensor_temp_mb,
+ /* "T_Sensor" temperature sensor reading [℃] */
+ ec_sensor_temp_t_sensor,
++ /* like ec_sensor_temp_t_sensor, but at an alternate address [℃] */
++ ec_sensor_temp_t_sensor_alt1,
+ /* VRM temperature [℃] */
+ ec_sensor_temp_vrm,
+ /* CPU Core voltage [mV] */
+@@ -156,6 +158,7 @@ enum ec_sensors {
+ #define SENSOR_TEMP_CPU_PACKAGE BIT(ec_sensor_temp_cpu_package)
+ #define SENSOR_TEMP_MB BIT(ec_sensor_temp_mb)
+ #define SENSOR_TEMP_T_SENSOR BIT(ec_sensor_temp_t_sensor)
++#define SENSOR_TEMP_T_SENSOR_ALT1 BIT(ec_sensor_temp_t_sensor_alt1)
+ #define SENSOR_TEMP_VRM BIT(ec_sensor_temp_vrm)
+ #define SENSOR_IN_CPU_CORE BIT(ec_sensor_in_cpu_core)
+ #define SENSOR_FAN_CPU_OPT BIT(ec_sensor_fan_cpu_opt)
+@@ -272,6 +275,8 @@ static const struct ec_sensor_info sensors_family_amd_600[] = {
+ EC_SENSOR("VRM", hwmon_temp, 1, 0x00, 0x33),
+ [ec_sensor_temp_t_sensor] =
+ EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x36),
++ [ec_sensor_temp_t_sensor_alt1] =
++ EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x37),
+ [ec_sensor_fan_cpu_opt] =
+ EC_SENSOR("CPU_Opt", hwmon_fan, 2, 0x00, 0xb0),
+ [ec_sensor_temp_water_in] =
+@@ -489,7 +494,7 @@ static const struct ec_board_info board_info_prime_x570_pro = {
+ static const struct ec_board_info board_info_prime_x670e_pro_wifi = {
+ .sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
+ SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
+- SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
++ SENSOR_TEMP_T_SENSOR_ALT1 | SENSOR_FAN_CPU_OPT,
+ .mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
+ .family = family_amd_600_series,
+ };
+--
+2.53.0
+
--- /dev/null
+From 43e7ff37d0bca7c361bc15f71068ed17af0cb26f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+--
+2.53.0
+
--- /dev/null
+From 464816df44e8301a19facad1c7bfc93556964833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%4phN\n", extn->name);
+--
+2.53.0
+
--- /dev/null
+From 46f2c875c7dd587bebb0923348dc15e7d1e43e12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 6a4a978eca7e8..24c1f961c7668 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 359de1206b33eca18789ab0bbaf8e227843837de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:40 +0000
+Subject: hwmon: (tps53679) Fix array access with zero-length block read
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 ]
+
+i2c_smbus_read_block_data() can return 0, indicating a zero-length
+read. When this happens, tps53679_identify_chip() accesses buf[ret - 1]
+which is buf[-1], reading one byte before the buffer on the stack.
+
+Fix by changing the check from "ret < 0" to "ret <= 0", treating a
+zero-length read as an error (-EIO), which prevents the out-of-bounds
+array access.
+
+Also fix a typo in the adjacent comment: "if present" instead of
+duplicate "if".
+
+Fixes: 75ca1e5875fe ("hwmon: (pmbus/tps53679) Add support for TPS53685")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-2-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index ca2bfa25eb04c..3bca543817a60 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -103,10 +103,10 @@ static int tps53679_identify_chip(struct i2c_client *client,
+ }
+
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+- if (ret < 0)
+- return ret;
++ if (ret <= 0)
++ return ret < 0 ? ret : -EIO;
+
+- /* Adjust length if null terminator if present */
++ /* Adjust length if null terminator is present */
+ buf_len = (buf[ret - 1] != '\x00' ? ret : ret - 1);
+
+ id_len = strlen(id);
+--
+2.53.0
+
--- /dev/null
+From abe81700aa56a6d75149850a382e6839c30feba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 3bca543817a60..249974c13aa39 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -175,8 +175,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From cc2c1a027ef46c4f676d0bf6b0b13884c296210c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 303bc308f80a8..c96fec2ebb3e7 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG 0x34
+ #define BNO055_CALIB_STAT_REG 0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+--
+2.53.0
+
--- /dev/null
+From e6f4db2841483f7d834482ad52fae83a379a29dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 00:49:36 +0800
+Subject: io_uring/rsrc: reject zero-length fixed buffer import
+
+From: Qi Tang <tpluszz77@gmail.com>
+
+[ Upstream commit 111a12b422a8cfa93deabaef26fec48237163214 ]
+
+validate_fixed_range() admits buf_addr at the exact end of the
+registered region when len is zero, because the check uses strict
+greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed()
+then computes offset == imu->len, which causes the bvec skip logic
+to advance past the last bio_vec entry and read bv_offset from
+out-of-bounds slab memory.
+
+Return early from io_import_fixed() when len is zero. A zero-length
+import has no data to transfer and should not walk the bvec array
+at all.
+
+ BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0
+ Read of size 4 at addr ffff888002bcc254 by task poc/103
+ Call Trace:
+ io_import_reg_buf+0x697/0x7f0
+ io_write_fixed+0xd9/0x250
+ __io_issue_sqe+0xad/0x710
+ io_issue_sqe+0x7d/0x1100
+ io_submit_sqes+0x86a/0x23c0
+ __do_sys_io_uring_enter+0xa98/0x1590
+ Allocated by task 103:
+ The buggy address is located 12 bytes to the right of
+ allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
+
+Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer")
+Signed-off-by: Qi Tang <tpluszz77@gmail.com>
+Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index 44442bf4827e4..dc87c6a86e346 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1082,6 +1082,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
+ return ret;
+ if (!(imu->dir & (1 << ddir)))
+ return -EFAULT;
++ if (unlikely(!len)) {
++ iov_iter_bvec(iter, ddir, NULL, 0, 0);
++ return 0;
++ }
+
+ offset = buf_addr - imu->ubuf;
+
+--
+2.53.0
+
--- /dev/null
+From addb22f58714353051c1cc26a3dd801f2fcbcb6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ switch (ralink_soc) {
+ case RT2880_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt2880-sysc";
+ case RT3883_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3883-sysc";
+ case RT305X_SOC_RT3050:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3050-sysc";
+ case RT305X_SOC_RT3052:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3052-sysc";
+ case RT305X_SOC_RT3350:
+ *idx = 1;
+--
+2.53.0
+
--- /dev/null
+From e19c2e6351a6da8d6445ceae43db64033291d430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2026 12:43:05 -0700
+Subject: perf/x86: Fix potential bad container_of in intel_pmu_hw_config
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit dbde07f06226438cd2cf1179745fa1bec5d8914a ]
+
+Auto counter reload may have a group of events with software events
+present within it. The software event PMU isn't the x86_hybrid_pmu and
+a container_of operation in intel_pmu_set_acr_caused_constr (via the
+hybrid helper) could cause out of bound memory reads. Avoid this by
+guarding the call to intel_pmu_set_acr_caused_constr with an
+is_x86_event check.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
+Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index f43aba3ac779d..3046058e7e238 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4441,8 +4441,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask);
+
+ if (leader->nr_siblings) {
+- for_each_sibling_event(sibling, leader)
+- intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++ for_each_sibling_event(sibling, leader) {
++ if (is_x86_event(sibling))
++ intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++ }
+ }
+
+ if (leader != event)
+--
+2.53.0
+
--- /dev/null
+From 9d8f80ab5b69538151bfd9c58a9668282f4a0fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 15fec5d1e6dec..0bf629204c76a 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From af7250a375bcaf5ae1a9a40aee379f285f38b183 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 00:00:22 +0800
+Subject: riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
+
+From: Zishun Yi <vulab@iscas.ac.cn>
+
+[ Upstream commit 3033b2b1e3949274f33a140e2a97571b5a307298 ]
+
+In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen
+is correctly set to 0, but it forgets to reset pmm. This results in the
+CPU pmm state not corresponding to the software pmlen state.
+
+Fix this by resetting pmm along with pmlen.
+
+Fixes: 2e1743085887 ("riscv: Add support for the tagged address ABI")
+Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
+Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
+Link: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/process.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 31a392993cb45..b5188dc74727d 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -324,8 +324,10 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)
+ if (arg & PR_TAGGED_ADDR_ENABLE && (tagged_addr_disabled || !pmlen))
+ return -EINVAL;
+
+- if (!(arg & PR_TAGGED_ADDR_ENABLE))
++ if (!(arg & PR_TAGGED_ADDR_ENABLE)) {
+ pmlen = PMLEN_0;
++ pmm = ENVCFG_PMM_PMLEN_0;
++ }
+
+ if (mmap_write_lock_killable(mm))
+ return -EINTR;
+--
+2.53.0
+
--- /dev/null
+From da042ca9e55d846171900f7ffbd8c990f566df6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 292141f4aaa54..d9777c81db0da 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -707,7 +707,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+ * Called in:
+ * - place_entity() -- before enqueue
+ * - update_entity_lag() -- before dequeue
+- * - entity_tick()
++ * - update_deadline() -- slice expiration
+ *
+ * This means it is one entry 'behind' but that puts it close enough to where
+ * the bound on entity_key() is at most two lag bounds.
+@@ -1121,6 +1121,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ * EEVDF: vd_i = ve_i + r_i / w_i
+ */
+ se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++ avg_vruntime(cfs_rq);
+
+ /*
+ * The task has consumed its request, reschedule.
+@@ -5635,11 +5636,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ update_load_avg(cfs_rq, curr, UPDATE_TG);
+ update_cfs_group(curr);
+
+- /*
+- * Pulls along cfs_rq::zero_vruntime.
+- */
+- avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ /*
+ * queued ticks are scheduled to match the slice, so don't bother
+@@ -9086,7 +9082,7 @@ static void yield_task_fair(struct rq *rq)
+ */
+ if (entity_eligible(cfs_rq, se)) {
+ se->vruntime = se->deadline;
+- se->deadline += calc_delta_fair(se->slice, se);
++ update_deadline(cfs_rq, se);
+ }
+ }
+
+--
+2.53.0
+
bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+gpio-rename-gpio_chip_hwgpio-to-gpiod_hwgpio.patch
+gpiolib-clear-requested-flag-if-line-is-invalid.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
+hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
+spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
+drm-xe-pxp-clean-up-termination-status-on-failure.patch
+drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
+drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
+hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
+riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
+acpi-rimt-add-dependency-between-iommu-and-devices.patch
--- /dev/null
+From 3c3fa8cdbf5bfe4d86389e789686fd5b01b654ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2026 22:28:45 +0800
+Subject: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and
+ remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f ]
+
+aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was
+missing from both probe unwind and remove-time cleanup. Add a devm cleanup
+action after successful registration so
+nand_ecc_unregister_on_host_hw_engine() runs automatically on probe
+failures and during device removal.
+
+Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-amlogic-spifc-a4.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/spi/spi-amlogic-spifc-a4.c b/drivers/spi/spi-amlogic-spifc-a4.c
+index b2589fe2425cc..3393e1f305709 100644
+--- a/drivers/spi/spi-amlogic-spifc-a4.c
++++ b/drivers/spi/spi-amlogic-spifc-a4.c
+@@ -1066,6 +1066,13 @@ static const struct nand_ecc_engine_ops aml_sfc_ecc_engine_ops = {
+ .finish_io_req = aml_sfc_ecc_finish_io_req,
+ };
+
++static void aml_sfc_unregister_ecc_engine(void *data)
++{
++ struct nand_ecc_engine *eng = data;
++
++ nand_ecc_unregister_on_host_hw_engine(eng);
++}
++
+ static int aml_sfc_clk_init(struct aml_sfc *sfc)
+ {
+ sfc->gate_clk = devm_clk_get_enabled(sfc->dev, "gate");
+@@ -1149,6 +1156,11 @@ static int aml_sfc_probe(struct platform_device *pdev)
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "failed to register Aml host ecc engine.\n");
+
++ ret = devm_add_action_or_reset(dev, aml_sfc_unregister_ecc_engine,
++ &sfc->ecc_eng);
++ if (ret)
++ return dev_err_probe(dev, ret, "failed to add ECC unregister action\n");
++
+ ret = of_property_read_u32(np, "amlogic,rx-adj", &val);
+ if (!ret)
+ sfc->rx_adj = val;
+--
+2.53.0
+
--- /dev/null
+From 54f15c51696e48ef774e8a0dc24beaa66803a1c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 00:07:06 +0800
+Subject: spi: stm32-ospi: Fix reset control leak on probe error
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 ]
+
+When spi_register_controller() fails after reset_control_acquire()
+succeeds, the reset control is never released. This causes a resource
+leak in the error path.
+
+Add the missing reset_control_release() call in the error path.
+
+Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index 5fa27de89210a..2988ff288ff02 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -939,13 +939,15 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ if (ret) {
+ /* Disable ospi */
+ writel_relaxed(0, ospi->regs_base + OSPI_CR);
+- goto err_pm_resume;
++ goto err_reset_control;
+ }
+
+ pm_runtime_put_autosuspend(ospi->dev);
+
+ return 0;
+
++err_reset_control:
++ reset_control_release(ospi->rstc);
+ err_pm_resume:
+ pm_runtime_put_sync_suspend(ospi->dev);
+
+--
+2.53.0
+
--- /dev/null
+From e899a2c653c3b690d1c6c0e4bc4484ec3b66e2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 19:14:05 +0800
+Subject: spi: stm32-ospi: Fix resource leak in remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 73cd1f97946ae3796544448ff12c07f399bb2881 ]
+
+The remove() callback returned early if pm_runtime_resume_and_get()
+failed, skipping the cleanup of spi controller and other resources.
+
+Remove the early return so cleanup completes regardless of PM resume
+result.
+
+Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index f36fd36da2692..5fa27de89210a 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -963,11 +963,8 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ static void stm32_ospi_remove(struct platform_device *pdev)
+ {
+ struct stm32_ospi *ospi = platform_get_drvdata(pdev);
+- int ret;
+
+- ret = pm_runtime_resume_and_get(ospi->dev);
+- if (ret < 0)
+- return;
++ pm_runtime_resume_and_get(ospi->dev);
+
+ spi_unregister_controller(ospi->ctrl);
+ /* Disable ospi */
+--
+2.53.0
+
--- /dev/null
+From 8ebf6cc52c51fe456fcf8c062cef09a2093b196a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index 428d8f65bff36..3842e59291b93 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -913,7 +913,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ */
+ return -ENODEV;
+
+- if (status) {
++ if (usr && status) {
+ /*
+ * Releasing resources failed on the device side, which puts
+ * us in a bind since they may still be in use, so enable the
+@@ -1108,6 +1108,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ mutex_lock(&qdev->cntl_mutex);
+ if (!list_empty(&elem.list))
+ list_del(&elem.list);
++ /* resp_worker() processed the response but the wait was interrupted */
++ else if (ret == -ERESTARTSYS)
++ ret = 0;
+ if (!ret && !elem.buf)
+ ret = -ETIMEDOUT;
+ else if (ret > 0 && !elem.buf)
+@@ -1418,9 +1421,49 @@ static void resp_worker(struct work_struct *work)
+ }
+ mutex_unlock(&qdev->cntl_mutex);
+
+- if (!found)
++ if (!found) {
++ /*
++ * The user might have gone away at this point without waiting
++ * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++ * the device. If this is not handled correctly, the host will
++ * not know that the DBC[n] has been freed on the device.
++ * Due to this failure in synchronization between the device and
++ * the host, if another user requests to activate a network, and
++ * the device assigns DBC[n] again, save_dbc_buf() will hang,
++ * waiting for dbc[n]->in_use to be set to false, which will not
++ * happen unless the qaic_dev_reset_clean_local_state() gets
++ * called by resetting the device (or re-inserting the module).
++ *
++ * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++ * transactions in the message before disposing of it, then
++ * handle releasing the DBC resources.
++ *
++ * Since the user has gone away, if the device could not
++ * deactivate the network (status != 0), there is no way to
++ * enable and reassign the DBC to the user. We can put trust in
++ * the device that it will release all the active DBCs in
++ * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++ * otherwise, the user can issue an soc_reset to the device.
++ */
++ u32 msg_count = le32_to_cpu(msg->hdr.count);
++ u32 msg_len = le32_to_cpu(msg->hdr.len);
++ u32 len = 0;
++ int j;
++
++ for (j = 0; j < msg_count && len < msg_len; ++j) {
++ struct wire_trans_hdr *trans_hdr;
++
++ trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++ if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++ if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++ len += le32_to_cpu(trans_hdr->len);
++ } else {
++ len += le32_to_cpu(trans_hdr->len);
++ }
++ }
+ /* request must have timed out, drop packet */
+ kfree(msg);
++ }
+
+ kfree(resp);
+ }
+--
+2.53.0
+
--- /dev/null
+From 81fda71c8356b4cc762209184119413e838d943e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 11:46:05 +0530
+Subject: ACPI: RIMT: Add dependency between iommu and devices
+
+From: Sunil V L <sunilvl@oss.qualcomm.com>
+
+[ Upstream commit 9156585280f161fc1c3552cf1860559edb2bb7e3 ]
+
+EPROBE_DEFER ensures IOMMU devices are probed before the devices that
+depend on them. During shutdown, however, the IOMMU may be removed
+first, leading to issues. To avoid this, a device link is added
+which enforces the correct removal order.
+
+Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT")
+Signed-off-by: Sunil V L <sunilvl@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/riscv/rimt.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/riscv/rimt.c b/drivers/acpi/riscv/rimt.c
+index 7f423405e5ef0..8eaa8731bddd6 100644
+--- a/drivers/acpi/riscv/rimt.c
++++ b/drivers/acpi/riscv/rimt.c
+@@ -263,6 +263,13 @@ static int rimt_iommu_xlate(struct device *dev, struct acpi_rimt_node *node, u32
+ if (!rimt_fwnode)
+ return -EPROBE_DEFER;
+
++ /*
++ * EPROBE_DEFER ensures IOMMU is probed before the devices that
++ * depend on them. During shutdown, however, the IOMMU may be removed
++ * first, leading to issues. To avoid this, a device link is added
++ * which enforces the correct removal order.
++ */
++ device_link_add(dev, rimt_fwnode->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+ return acpi_iommu_fwspec_init(dev, deviceid, rimt_fwnode);
+ }
+
+--
+2.53.0
+
--- /dev/null
+From ff272405b103285518948e616315631149399e14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 13:26:05 +0800
+Subject: drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show()
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit f078634c184a9b5ccaa056e8b8d6cd32f7bff1b6 ]
+
+A typical bridge refcount value is 3 after a bridge chain is formed:
+- devm_drm_bridge_alloc() initializes the refcount value to be 1.
+- drm_bridge_add() gets an additional reference hence 2.
+- drm_bridge_attach() gets the third reference hence 3.
+
+This typical refcount value aligns with allbridges_show()'s behaviour.
+However, since encoder_bridges_show() uses
+drm_for_each_bridge_in_chain_scoped() to automatically get/put the
+bridge reference while iterating, a bogus reference is accidentally
+got when showing the wrong typical refcount value as 4 to users via
+debugfs. Fix this by caching the refcount value returned from
+kref_read() while iterating and explicitly decreasing the cached
+refcount value by 1 before showing it to users.
+
+Fixes: bd57048e4576 ("drm/bridge: use drm_for_each_bridge_in_chain_scoped()")
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20260318-drm-misc-next-2026-03-05-fix-encoder-bridges-refcount-v3-1-147fea581279@nxp.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_bridge.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
+index 8f355df883d8a..250bf8fa51677 100644
+--- a/drivers/gpu/drm/drm_bridge.c
++++ b/drivers/gpu/drm/drm_bridge.c
+@@ -1465,11 +1465,17 @@ EXPORT_SYMBOL(devm_drm_put_bridge);
+ static void drm_bridge_debugfs_show_bridge(struct drm_printer *p,
+ struct drm_bridge *bridge,
+ unsigned int idx,
+- bool lingering)
++ bool lingering,
++ bool scoped)
+ {
++ unsigned int refcount = kref_read(&bridge->refcount);
++
++ if (scoped)
++ refcount--;
++
+ drm_printf(p, "bridge[%u]: %ps\n", idx, bridge->funcs);
+
+- drm_printf(p, "\trefcount: %u%s\n", kref_read(&bridge->refcount),
++ drm_printf(p, "\trefcount: %u%s\n", refcount,
+ lingering ? " [lingering]" : "");
+
+ drm_printf(p, "\ttype: [%d] %s\n",
+@@ -1503,10 +1509,10 @@ static int allbridges_show(struct seq_file *m, void *data)
+ mutex_lock(&bridge_lock);
+
+ list_for_each_entry(bridge, &bridge_list, list)
+- drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false);
++ drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false, false);
+
+ list_for_each_entry(bridge, &bridge_lingering_list, list)
+- drm_bridge_debugfs_show_bridge(&p, bridge, idx++, true);
++ drm_bridge_debugfs_show_bridge(&p, bridge, idx++, true, false);
+
+ mutex_unlock(&bridge_lock);
+
+@@ -1521,7 +1527,7 @@ static int encoder_bridges_show(struct seq_file *m, void *data)
+ unsigned int idx = 0;
+
+ drm_for_each_bridge_in_chain_scoped(encoder, bridge)
+- drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false);
++ drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false, true);
+
+ return 0;
+ }
+--
+2.53.0
+
--- /dev/null
+From ce28341235dac4c095f76a422f658bd492e10bcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2026 14:46:52 +0800
+Subject: drm/sysfb: Fix efidrm error handling and memory type mismatch
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af ]
+
+Fix incorrect error checking and memory type confusion in
+efidrm_device_create(). devm_memremap() returns error pointers, not
+NULL, and returns system memory while devm_ioremap() returns I/O memory.
+The code incorrectly passes system memory to iosys_map_set_vaddr_iomem().
+
+Restructure to handle each memory type separately. Use devm_ioremap*()
+with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for
+WT/WB.
+
+Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260311064652.2903449-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sysfb/efidrm.c | 46 +++++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
+index 1b683d55d6ea4..ac48bfa47e081 100644
+--- a/drivers/gpu/drm/sysfb/efidrm.c
++++ b/drivers/gpu/drm/sysfb/efidrm.c
+@@ -151,7 +151,6 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ struct drm_sysfb_device *sysfb;
+ struct drm_device *dev;
+ struct resource *mem = NULL;
+- void __iomem *screen_base = NULL;
+ struct drm_plane *primary_plane;
+ struct drm_crtc *crtc;
+ struct drm_encoder *encoder;
+@@ -236,21 +235,38 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+
+ mem_flags = efidrm_get_mem_flags(dev, res->start, vsize);
+
+- if (mem_flags & EFI_MEMORY_WC)
+- screen_base = devm_ioremap_wc(&pdev->dev, mem->start, resource_size(mem));
+- else if (mem_flags & EFI_MEMORY_UC)
+- screen_base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
+- else if (mem_flags & EFI_MEMORY_WT)
+- screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+- MEMREMAP_WT);
+- else if (mem_flags & EFI_MEMORY_WB)
+- screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+- MEMREMAP_WB);
+- else
++ if (mem_flags & EFI_MEMORY_WC) {
++ void __iomem *screen_base = devm_ioremap_wc(&pdev->dev, mem->start,
++ resource_size(mem));
++
++ if (!screen_base)
++ return ERR_PTR(-ENXIO);
++ iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_UC) {
++ void __iomem *screen_base = devm_ioremap(&pdev->dev, mem->start,
++ resource_size(mem));
++
++ if (!screen_base)
++ return ERR_PTR(-ENXIO);
++ iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_WT) {
++ void *screen_base = devm_memremap(&pdev->dev, mem->start,
++ resource_size(mem), MEMREMAP_WT);
++
++ if (IS_ERR(screen_base))
++ return ERR_CAST(screen_base);
++ iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++ } else if (mem_flags & EFI_MEMORY_WB) {
++ void *screen_base = devm_memremap(&pdev->dev, mem->start,
++ resource_size(mem), MEMREMAP_WB);
++
++ if (IS_ERR(screen_base))
++ return ERR_CAST(screen_base);
++ iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++ } else {
+ drm_err(dev, "invalid mem_flags: 0x%llx\n", mem_flags);
+- if (!screen_base)
+- return ERR_PTR(-ENOMEM);
+- iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++ return ERR_PTR(-EINVAL);
++ }
+
+ /*
+ * Modesetting
+--
+2.53.0
+
--- /dev/null
+From 43f75c99f2577c1950565134653c3db5ee29f8e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:20 -0700
+Subject: drm/xe/pxp: Clean up termination status on failure
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit e2628e670bb0923fcdc00828bfcd67b26a7df020 ]
+
+If the PXP HW termination fails during PXP start, the normal completion
+code won't be called, so the termination will remain uncomplete. To avoid
+unnecessary waits, mark the termination as completed from the error path.
+Note that we already do this if the termination fails when handling a
+termination irq from the HW.
+
+Fixes: f8caa80154c4 ("drm/xe/pxp: Add PXP queue tracking and session start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-7-daniele.ceraolospurio@intel.com
+(cherry picked from commit 5d9e708d2a69ab1f64a17aec810cd7c70c5b9fab)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index bdbdbbf6a6781..ba4d52001b853 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -603,6 +603,7 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ drm_err(&pxp->xe->drm, "PXP termination failed before start\n");
+ mutex_lock(&pxp->mutex);
+ pxp->status = XE_PXP_ERROR;
++ complete_all(&pxp->termination);
+
+ goto out_unlock;
+ }
+--
+2.53.0
+
--- /dev/null
+From a645ad0d4bc94481034a71c231333c2c4ba06d1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:22 -0700
+Subject: drm/xe/pxp: Clear restart flag in pxp_start after jumping back
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 76903b2057c8677c2c006e87fede15f496555dc0 ]
+
+If we don't clear the flag we'll keep jumping back at the beginning of
+the function once we reach the end.
+
+Fixes: ccd3c6820a90 ("drm/xe/pxp: Decouple queue addition from PXP start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-9-daniele.ceraolospurio@intel.com
+(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index fdcecc026e937..9261a8412b64f 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -532,7 +532,7 @@ static int __exec_queue_add(struct xe_pxp *pxp, struct xe_exec_queue *q)
+ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ {
+ int ret = 0;
+- bool restart = false;
++ bool restart;
+
+ if (!xe_pxp_is_enabled(pxp))
+ return -ENODEV;
+@@ -561,6 +561,8 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ msecs_to_jiffies(PXP_ACTIVATION_TIMEOUT_MS)))
+ return -ETIMEDOUT;
+
++ restart = false;
++
+ mutex_lock(&pxp->mutex);
+
+ /* If PXP is not already active, turn it on */
+--
+2.53.0
+
--- /dev/null
+From 76f2719cf331b8c9649c489d7bc2d74ef090e231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:21 -0700
+Subject: drm/xe/pxp: Remove incorrect handling of impossible state during
+ suspend
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 4fed244954c2dc9aafa333d08f66b14345225e03 ]
+
+The default case of the PXP suspend switch is incorrectly exiting
+without releasing the lock. However, this case is impossible to hit
+because we're switching on an enum and all the valid enum values have
+their own cases. Therefore, we can just get rid of the default case
+and rely on the compiler to warn us if a new enum value is added and
+we forget to add it to the switch.
+
+Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-8-daniele.ceraolospurio@intel.com
+(cherry picked from commit f1b5a77fc9b6a90cd9a5e3db9d4c73ae1edfcfac)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index ba4d52001b853..fdcecc026e937 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -891,11 +891,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ pxp->key_instance++;
+ needs_queue_inval = true;
+ break;
+- default:
+- drm_err(&pxp->xe->drm, "unexpected state during PXP suspend: %u",
+- pxp->status);
+- ret = -EIO;
+- goto out;
+ }
+
+ /*
+@@ -920,7 +915,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+
+ pxp->last_suspend_key_instance = pxp->key_instance;
+
+-out:
+ return ret;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 30eebb5febe0d774cb9463cd70abeaa93a5857b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 15:29:37 +0000
+Subject: drm/xe/xe_pagefault: Disallow writes to read-only VMAs
+
+From: Jonathan Cavitt <jonathan.cavitt@intel.com>
+
+[ Upstream commit 6d192b4f2d644d15d9a9f1d33dab05af936f6540 ]
+
+The page fault handler should reject write/atomic access to read only
+VMAs. Add code to handle this in xe_pagefault_service after the VMA
+lookup.
+
+v2:
+- Apply max line length (Matthew)
+
+Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work")
+Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Suggested-by: Matthew Brost <matthew.brost@intel.com>
+Cc: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260324152935.72444-7-jonathan.cavitt@intel.com
+(cherry picked from commit 714ee6754ac5fa3dc078856a196a6b124cd797a0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pagefault.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pagefault.c b/drivers/gpu/drm/xe/xe_pagefault.c
+index afb06598b6e1a..0b625a52a5984 100644
+--- a/drivers/gpu/drm/xe/xe_pagefault.c
++++ b/drivers/gpu/drm/xe/xe_pagefault.c
+@@ -187,6 +187,12 @@ static int xe_pagefault_service(struct xe_pagefault *pf)
+ goto unlock_vm;
+ }
+
++ if (xe_vma_read_only(vma) &&
++ pf->consumer.access_type != XE_PAGEFAULT_ACCESS_TYPE_READ) {
++ err = -EPERM;
++ goto unlock_vm;
++ }
++
+ atomic = xe_pagefault_access_is_atomic(pf->consumer.access_type);
+
+ if (xe_vma_is_cpu_addr_mirror(vma))
+--
+2.53.0
+
--- /dev/null
+From 1a68ba00e7c6bf166212e811f7157dbeebe231c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index 184432d24ea18..f42c54653d521 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -37,7 +37,7 @@ properties:
+ const: 2
+
+ "#interrupt-cells":
+- const: 1
++ const: 2
+
+ ngpios:
+ description:
+@@ -86,7 +86,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupts = <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+--
+2.53.0
+
--- /dev/null
+From ea8a66b5940b0a4dd572063c317218918e2fe0af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2026 22:56:38 +0800
+Subject: gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 8de4e0f44c638c66cdc5eeb4d5ab9acd61c31e4f ]
+
+devm_regmap_init_mmio() returns an ERR_PTR() on failure, not NULL.
+The original code checked for NULL which would never trigger on error,
+potentially leading to an invalid pointer dereference.
+Use IS_ERR() and PTR_ERR() to properly handle the error case.
+
+Fixes: e88500247dc3 ("gpio: add QIXIS FPGA GPIO controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260320-qixis-v1-1-a8efc22e8945@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-qixis-fpga.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-qixis-fpga.c b/drivers/gpio/gpio-qixis-fpga.c
+index 6e67f43ac0bdd..3ced47db1521c 100644
+--- a/drivers/gpio/gpio-qixis-fpga.c
++++ b/drivers/gpio/gpio-qixis-fpga.c
+@@ -60,8 +60,8 @@ static int qixis_cpld_gpio_probe(struct platform_device *pdev)
+ return PTR_ERR(reg);
+
+ regmap = devm_regmap_init_mmio(&pdev->dev, reg, ®map_config_8r_8v);
+- if (!regmap)
+- return -ENODEV;
++ if (IS_ERR(regmap))
++ return PTR_ERR(regmap);
+
+ /* In this case, the offset of our register is 0 inside the
+ * regmap area that we just created.
+--
+2.53.0
+
--- /dev/null
+From 39a413521a63a48a7086f28c37e1cca850f21338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 15:00:53 +0100
+Subject: gpio: shared: call gpio_chip::of_xlate() if set
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 710abda58055ed5eaa8958107633cc12a365c328 ]
+
+OF-based GPIO controller drivers may provide a translation function that
+calculates the real chip offset from whatever devicetree sources
+provide. We need to take this into account in the shared GPIO management
+and call of_xlate() if it's provided and adjust the entry->offset we
+initially set when scanning the tree.
+
+To that end: modify the shared GPIO API to take the GPIO chip as
+argument on setup (to avoid having to rcu_dereference() it from the GPIO
+device) and protect the access to entry->offset with the existing lock.
+
+Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-1-0ce34c707e81@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 27 ++++++++++++++++++++++++++-
+ drivers/gpio/gpiolib-shared.h | 4 ++--
+ drivers/gpio/gpiolib.c | 2 +-
+ 3 files changed, 29 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index e16f467b72e7a..6316ae5a1c310 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -511,8 +511,9 @@ static void gpio_shared_remove_adev(struct auxiliary_device *adev)
+ auxiliary_device_uninit(adev);
+ }
+
+-int gpio_device_setup_shared(struct gpio_device *gdev)
++int gpiochip_setup_shared(struct gpio_chip *gc)
+ {
++ struct gpio_device *gdev = gc->gpiodev;
+ struct gpio_shared_entry *entry;
+ struct gpio_shared_ref *ref;
+ struct gpio_desc *desc;
+@@ -537,12 +538,34 @@ int gpio_device_setup_shared(struct gpio_device *gdev)
+ * exposing shared pins. Find them and create the proxy devices.
+ */
+ list_for_each_entry(entry, &gpio_shared_list, list) {
++ guard(mutex)(&entry->lock);
++
+ if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ continue;
+
+ if (list_count_nodes(&entry->refs) <= 1)
+ continue;
+
++#if IS_ENABLED(CONFIG_OF)
++ if (is_of_node(entry->fwnode) && gc->of_xlate) {
++ /*
++ * This is the earliest that we can tranlate the
++ * devicetree offset to the chip offset.
++ */
++ struct of_phandle_args gpiospec = { };
++
++ gpiospec.np = to_of_node(entry->fwnode);
++ gpiospec.args_count = 2;
++ gpiospec.args[0] = entry->offset;
++
++ ret = gc->of_xlate(gc, &gpiospec, NULL);
++ if (ret < 0)
++ return ret;
++
++ entry->offset = ret;
++ }
++#endif /* CONFIG_OF */
++
+ desc = &gdev->descs[entry->offset];
+
+ __set_bit(GPIOD_FLAG_SHARED, &desc->flags);
+@@ -580,6 +603,8 @@ void gpio_device_teardown_shared(struct gpio_device *gdev)
+ struct gpio_shared_ref *ref;
+
+ list_for_each_entry(entry, &gpio_shared_list, list) {
++ guard(mutex)(&entry->lock);
++
+ if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ continue;
+
+diff --git a/drivers/gpio/gpiolib-shared.h b/drivers/gpio/gpiolib-shared.h
+index 40568ef7364cc..e11e260e1f590 100644
+--- a/drivers/gpio/gpiolib-shared.h
++++ b/drivers/gpio/gpiolib-shared.h
+@@ -14,14 +14,14 @@ struct device;
+
+ #if IS_ENABLED(CONFIG_GPIO_SHARED)
+
+-int gpio_device_setup_shared(struct gpio_device *gdev);
++int gpiochip_setup_shared(struct gpio_chip *gc);
+ void gpio_device_teardown_shared(struct gpio_device *gdev);
+ int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+ unsigned long lflags);
+
+ #else
+
+-static inline int gpio_device_setup_shared(struct gpio_device *gdev)
++static inline int gpiochip_setup_shared(struct gpio_chip *gc)
+ {
+ return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 04068f4eb3422..0285142893642 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1211,7 +1211,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ if (ret)
+ goto err_remove_irqchip_mask;
+
+- ret = gpio_device_setup_shared(gdev);
++ ret = gpiochip_setup_shared(gc);
+ if (ret)
+ goto err_remove_irqchip;
+
+--
+2.53.0
+
--- /dev/null
+From b68719fbe0b8c8c65e3f7889edc9c9a0efc79895 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 15:00:54 +0100
+Subject: gpio: shared: handle pins shared by child nodes of devices
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit ec42a3a90ae9ae64b16d01a2e5d32ec0865ca8cf ]
+
+Shared GPIOs may be assigned to child nodes of device nodes which don't
+themselves bind to any struct device. We need to pass the firmware node
+that is the actual consumer to gpiolib-shared and compare against it
+instead of unconditionally using the fwnode of the consumer device.
+
+Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-2-0ce34c707e81@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 6 +++---
+ drivers/gpio/gpiolib-shared.h | 7 +++++--
+ drivers/gpio/gpiolib.c | 4 ++--
+ 3 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index 6316ae5a1c310..9c31736d29b77 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -443,8 +443,8 @@ static bool gpio_shared_dev_is_reset_gpio(struct device *consumer,
+ }
+ #endif /* CONFIG_RESET_GPIO */
+
+-int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+- unsigned long lflags)
++int gpio_shared_add_proxy_lookup(struct device *consumer, struct fwnode_handle *fwnode,
++ const char *con_id, unsigned long lflags)
+ {
+ const char *dev_id = dev_name(consumer);
+ struct gpiod_lookup_table *lookup;
+@@ -463,7 +463,7 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+ if (!ref->fwnode && strstarts(dev_name(consumer), "reset.gpio.")) {
+ if (!gpio_shared_dev_is_reset_gpio(consumer, entry, ref))
+ continue;
+- } else if (!device_match_fwnode(consumer, ref->fwnode)) {
++ } else if (fwnode != ref->fwnode) {
+ continue;
+ }
+
+diff --git a/drivers/gpio/gpiolib-shared.h b/drivers/gpio/gpiolib-shared.h
+index e11e260e1f590..15e72a8dcdb13 100644
+--- a/drivers/gpio/gpiolib-shared.h
++++ b/drivers/gpio/gpiolib-shared.h
+@@ -11,13 +11,15 @@
+ struct gpio_device;
+ struct gpio_desc;
+ struct device;
++struct fwnode_handle;
+
+ #if IS_ENABLED(CONFIG_GPIO_SHARED)
+
+ int gpiochip_setup_shared(struct gpio_chip *gc);
+ void gpio_device_teardown_shared(struct gpio_device *gdev);
+-int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+- unsigned long lflags);
++int gpio_shared_add_proxy_lookup(struct device *consumer,
++ struct fwnode_handle *fwnode,
++ const char *con_id, unsigned long lflags);
+
+ #else
+
+@@ -29,6 +31,7 @@ static inline int gpiochip_setup_shared(struct gpio_chip *gc)
+ static inline void gpio_device_teardown_shared(struct gpio_device *gdev) { }
+
+ static inline int gpio_shared_add_proxy_lookup(struct device *consumer,
++ struct fwnode_handle *fwnode,
+ const char *con_id,
+ unsigned long lflags)
+ {
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 0285142893642..fc7c4bf2de2be 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -4720,8 +4720,8 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+ * lookup table for the proxy device as previously
+ * we only knew the consumer's fwnode.
+ */
+- ret = gpio_shared_add_proxy_lookup(consumer, con_id,
+- lookupflags);
++ ret = gpio_shared_add_proxy_lookup(consumer, fwnode,
++ con_id, lookupflags);
+ if (ret)
+ return ERR_PTR(ret);
+
+--
+2.53.0
+
--- /dev/null
+From 00331637c0b34f84724e076366231b827a3e83b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Mar 2026 12:06:38 +0100
+Subject: gpio: shared: shorten the critical section in gpiochip_setup_shared()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 310a4a9cbb17037668ea440f6a3964d00705b400 ]
+
+Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set")
+introduced a critical section around the adjustmenet of entry->offset.
+However this may cause a deadlock if we create the auxiliary shared
+proxy devices with this lock taken. We only need to protect
+entry->offset while it's read/written so shorten the critical section
+and release the lock before creating the proxy device as the field in
+question is no longer accessed at this point.
+
+Fixes: 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set")
+Reported-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260325-gpio-shared-deadlock-v1-1-e4e7a5319e95@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 56 +++++++++++++++++------------------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index 9c31736d29b77..692f568ffe7a4 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -538,48 +538,48 @@ int gpiochip_setup_shared(struct gpio_chip *gc)
+ * exposing shared pins. Find them and create the proxy devices.
+ */
+ list_for_each_entry(entry, &gpio_shared_list, list) {
+- guard(mutex)(&entry->lock);
+-
+ if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ continue;
+
+ if (list_count_nodes(&entry->refs) <= 1)
+ continue;
+
++ scoped_guard(mutex, &entry->lock) {
+ #if IS_ENABLED(CONFIG_OF)
+- if (is_of_node(entry->fwnode) && gc->of_xlate) {
+- /*
+- * This is the earliest that we can tranlate the
+- * devicetree offset to the chip offset.
+- */
+- struct of_phandle_args gpiospec = { };
++ if (is_of_node(entry->fwnode) && gc->of_xlate) {
++ /*
++ * This is the earliest that we can tranlate the
++ * devicetree offset to the chip offset.
++ */
++ struct of_phandle_args gpiospec = { };
+
+- gpiospec.np = to_of_node(entry->fwnode);
+- gpiospec.args_count = 2;
+- gpiospec.args[0] = entry->offset;
++ gpiospec.np = to_of_node(entry->fwnode);
++ gpiospec.args_count = 2;
++ gpiospec.args[0] = entry->offset;
+
+- ret = gc->of_xlate(gc, &gpiospec, NULL);
+- if (ret < 0)
+- return ret;
++ ret = gc->of_xlate(gc, &gpiospec, NULL);
++ if (ret < 0)
++ return ret;
+
+- entry->offset = ret;
+- }
++ entry->offset = ret;
++ }
+ #endif /* CONFIG_OF */
+
+- desc = &gdev->descs[entry->offset];
++ desc = &gdev->descs[entry->offset];
+
+- __set_bit(GPIOD_FLAG_SHARED, &desc->flags);
+- /*
+- * Shared GPIOs are not requested via the normal path. Make
+- * them inaccessible to anyone even before we register the
+- * chip.
+- */
+- ret = gpiod_request_commit(desc, "shared");
+- if (ret)
+- return ret;
++ __set_bit(GPIOD_FLAG_SHARED, &desc->flags);
++ /*
++ * Shared GPIOs are not requested via the normal path. Make
++ * them inaccessible to anyone even before we register the
++ * chip.
++ */
++ ret = gpiod_request_commit(desc, "shared");
++ if (ret)
++ return ret;
+
+- pr_debug("GPIO %u owned by %s is shared by multiple consumers\n",
+- entry->offset, gpio_device_get_label(gdev));
++ pr_debug("GPIO %u owned by %s is shared by multiple consumers\n",
++ entry->offset, gpio_device_get_label(gdev));
++ }
+
+ list_for_each_entry(ref, &entry->refs, list) {
+ pr_debug("Setting up a shared GPIO entry for %s (con_id: '%s')\n",
+--
+2.53.0
+
--- /dev/null
+From 7d877eee571645ab0660b6163ad3b6e57a40a0b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2026 20:44:03 +0000
+Subject: gpiolib: clear requested flag if line is invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <pobrn@protonmail.com>
+
+[ Upstream commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f ]
+
+If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but
+`desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result
+in subsequent calls misleadingly returning `-EBUSY`.
+
+Fix that by clearing the flag in case of failure.
+
+Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs")
+Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 2e33afbbfda48..04068f4eb3422 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2466,8 +2466,10 @@ int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ return -EBUSY;
+
+ offset = gpiod_hwgpio(desc);
+- if (!gpiochip_line_is_valid(guard.gc, offset))
+- return -EINVAL;
++ if (!gpiochip_line_is_valid(guard.gc, offset)) {
++ ret = -EINVAL;
++ goto out_clear_bit;
++ }
+
+ /* NOTE: gpio_request() can be called in early boot,
+ * before IRQs are enabled, for non-sleeping (SOC) GPIOs.
+--
+2.53.0
+
--- /dev/null
+From 590d5bd41a2b19a3ca387204a6fd42b7bc3bd67a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 14:49:06 -0700
+Subject: hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Corey Hickey <bugfood-c@fatooh.org>
+
+[ Upstream commit cffff6df669a438ecac506dadd49a53d4475a796 ]
+
+On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of
+zero for T_Sensor. On this board, the register for T_Sensor is at a
+different address, as found by experimentation and confirmed by
+comparison to an independent temperature reading.
+
+* sensor disconnected: -62.0°C
+* ambient temperature: +22.0°C
+* held between fingers: +30.0°C
+
+Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI
+without causing a regression for other 600-series boards
+
+Fixes: e0444758dd1b ("hwmon: (asus-ec-sensors) add PRIME X670E-PRO WIFI")
+Signed-off-by: Corey Hickey <bugfood-c@fatooh.org>
+Link: https://lore.kernel.org/r/20260331215414.368785-1-bugfood-ml@fatooh.org
+[groeck: Fixed typo, updated Fixes: reference]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index a1445799e23d8..b685d9954df43 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -111,6 +111,8 @@ enum ec_sensors {
+ ec_sensor_temp_mb,
+ /* "T_Sensor" temperature sensor reading [℃] */
+ ec_sensor_temp_t_sensor,
++ /* like ec_sensor_temp_t_sensor, but at an alternate address [℃] */
++ ec_sensor_temp_t_sensor_alt1,
+ /* VRM temperature [℃] */
+ ec_sensor_temp_vrm,
+ /* VRM east (right) temperature [℃] */
+@@ -160,6 +162,7 @@ enum ec_sensors {
+ #define SENSOR_TEMP_CPU_PACKAGE BIT(ec_sensor_temp_cpu_package)
+ #define SENSOR_TEMP_MB BIT(ec_sensor_temp_mb)
+ #define SENSOR_TEMP_T_SENSOR BIT(ec_sensor_temp_t_sensor)
++#define SENSOR_TEMP_T_SENSOR_ALT1 BIT(ec_sensor_temp_t_sensor_alt1)
+ #define SENSOR_TEMP_VRM BIT(ec_sensor_temp_vrm)
+ #define SENSOR_TEMP_VRME BIT(ec_sensor_temp_vrme)
+ #define SENSOR_TEMP_VRMW BIT(ec_sensor_temp_vrmw)
+@@ -279,6 +282,8 @@ static const struct ec_sensor_info sensors_family_amd_600[] = {
+ EC_SENSOR("VRM", hwmon_temp, 1, 0x00, 0x33),
+ [ec_sensor_temp_t_sensor] =
+ EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x36),
++ [ec_sensor_temp_t_sensor_alt1] =
++ EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x37),
+ [ec_sensor_fan_cpu_opt] =
+ EC_SENSOR("CPU_Opt", hwmon_fan, 2, 0x00, 0xb0),
+ [ec_sensor_temp_water_in] =
+@@ -509,7 +514,7 @@ static const struct ec_board_info board_info_prime_x570_pro = {
+ static const struct ec_board_info board_info_prime_x670e_pro_wifi = {
+ .sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
+ SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
+- SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
++ SENSOR_TEMP_T_SENSOR_ALT1 | SENSOR_FAN_CPU_OPT,
+ .mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
+ .family = family_amd_600_series,
+ };
+--
+2.53.0
+
--- /dev/null
+From c33192b96de63b4f98ae1d5436a3ba78938ccf3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+--
+2.53.0
+
--- /dev/null
+From 2d665645e09bc8540e060fcaffd970fee695ef01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%4phN\n", extn->name);
+--
+2.53.0
+
--- /dev/null
+From cf5f58f1dd14b783eb039318a581d41ed590b0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 6a4a978eca7e8..24c1f961c7668 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 2b3aecff763491e1368efbdff15f30f0e8f755f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:40 +0000
+Subject: hwmon: (tps53679) Fix array access with zero-length block read
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 ]
+
+i2c_smbus_read_block_data() can return 0, indicating a zero-length
+read. When this happens, tps53679_identify_chip() accesses buf[ret - 1]
+which is buf[-1], reading one byte before the buffer on the stack.
+
+Fix by changing the check from "ret < 0" to "ret <= 0", treating a
+zero-length read as an error (-EIO), which prevents the out-of-bounds
+array access.
+
+Also fix a typo in the adjacent comment: "if present" instead of
+duplicate "if".
+
+Fixes: 75ca1e5875fe ("hwmon: (pmbus/tps53679) Add support for TPS53685")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-2-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index ca2bfa25eb04c..3bca543817a60 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -103,10 +103,10 @@ static int tps53679_identify_chip(struct i2c_client *client,
+ }
+
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+- if (ret < 0)
+- return ret;
++ if (ret <= 0)
++ return ret < 0 ? ret : -EIO;
+
+- /* Adjust length if null terminator if present */
++ /* Adjust length if null terminator is present */
+ buf_len = (buf[ret - 1] != '\x00' ? ret : ret - 1);
+
+ id_len = strlen(id);
+--
+2.53.0
+
--- /dev/null
+From 0f9159a358380a2e18f5d4e08a9daff2582f05f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 3bca543817a60..249974c13aa39 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -175,8 +175,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 4aa4e645b99bf86dc8e70fe46ed2156954cc8bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 303bc308f80a8..c96fec2ebb3e7 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG 0x34
+ #define BNO055_CALIB_STAT_REG 0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+--
+2.53.0
+
--- /dev/null
+From e9a63377a00c083dc9ce5a0e50c7d3c5269c4cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Mar 2026 03:29:33 +0200
+Subject: interconnect: qcom: sm8450: Fix NULL pointer dereference in
+ icc_link_nodes()
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit dbbd550d7c8d90d3af9fe8a12a9caff077ddb8e3 ]
+
+The change to dynamic IDs for SM8450 platform interconnects left two links
+unconverted, fix it to avoid the NULL pointer dereference in runtime,
+when a pointer to a destination interconnect is not valid:
+
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+ <...>
+ Call trace:
+ icc_link_nodes+0x3c/0x100 (P)
+ qcom_icc_rpmh_probe+0x1b4/0x528
+ platform_probe+0x64/0xc0
+ really_probe+0xc4/0x2a8
+ __driver_probe_device+0x80/0x140
+ driver_probe_device+0x48/0x170
+ __device_attach_driver+0xc0/0x148
+ bus_for_each_drv+0x88/0xf0
+ __device_attach+0xb0/0x1c0
+ device_initial_probe+0x58/0x68
+ bus_probe_device+0x40/0xb8
+ deferred_probe_work_func+0x90/0xd0
+ process_one_work+0x15c/0x3c0
+ worker_thread+0x2e8/0x400
+ kthread+0x150/0x208
+ ret_from_fork+0x10/0x20
+ Code: 900310f4 911d6294 91008280 94176078 (f94002a0)
+ ---[ end trace 0000000000000000 ]---
+ Kernel panic - not syncing: Oops: Fatal exception
+
+Fixes: 51513bec806f ("interconnect: qcom: sm8450: convert to dynamic IDs")
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://msgid.link/20260314012933.350644-1-vladimir.zapolskiy@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8450.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sm8450.c b/drivers/interconnect/qcom/sm8450.c
+index 669a638bf3efc..c88327d200acc 100644
+--- a/drivers/interconnect/qcom/sm8450.c
++++ b/drivers/interconnect/qcom/sm8450.c
+@@ -800,7 +800,7 @@ static struct qcom_icc_node qhs_compute_cfg = {
+ .channels = 1,
+ .buswidth = 4,
+ .num_links = 1,
+- .link_nodes = { MASTER_CDSP_NOC_CFG },
++ .link_nodes = { &qhm_nsp_noc_config },
+ };
+
+ static struct qcom_icc_node qhs_cpr_cx = {
+@@ -874,7 +874,7 @@ static struct qcom_icc_node qhs_lpass_cfg = {
+ .channels = 1,
+ .buswidth = 4,
+ .num_links = 1,
+- .link_nodes = { MASTER_CNOC_LPASS_AG_NOC },
++ .link_nodes = { &qhm_config_noc },
+ };
+
+ static struct qcom_icc_node qhs_mss_cfg = {
+--
+2.53.0
+
--- /dev/null
+From 649515ee6e2727b027afdc1d98dd2d819365280d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 00:49:36 +0800
+Subject: io_uring/rsrc: reject zero-length fixed buffer import
+
+From: Qi Tang <tpluszz77@gmail.com>
+
+[ Upstream commit 111a12b422a8cfa93deabaef26fec48237163214 ]
+
+validate_fixed_range() admits buf_addr at the exact end of the
+registered region when len is zero, because the check uses strict
+greater-than (buf_end > imu->ubuf + imu->len). io_import_fixed()
+then computes offset == imu->len, which causes the bvec skip logic
+to advance past the last bio_vec entry and read bv_offset from
+out-of-bounds slab memory.
+
+Return early from io_import_fixed() when len is zero. A zero-length
+import has no data to transfer and should not walk the bvec array
+at all.
+
+ BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0
+ Read of size 4 at addr ffff888002bcc254 by task poc/103
+ Call Trace:
+ io_import_reg_buf+0x697/0x7f0
+ io_write_fixed+0xd9/0x250
+ __io_issue_sqe+0xad/0x710
+ io_issue_sqe+0x7d/0x1100
+ io_submit_sqes+0x86a/0x23c0
+ __do_sys_io_uring_enter+0xa98/0x1590
+ Allocated by task 103:
+ The buggy address is located 12 bytes to the right of
+ allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
+
+Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer")
+Signed-off-by: Qi Tang <tpluszz77@gmail.com>
+Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index 41c89f5c616da..81446f9649ae9 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1084,6 +1084,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
+ return ret;
+ if (!(imu->dir & (1 << ddir)))
+ return -EFAULT;
++ if (unlikely(!len)) {
++ iov_iter_bvec(iter, ddir, NULL, 0, 0);
++ return 0;
++ }
+
+ offset = buf_addr - imu->ubuf;
+
+--
+2.53.0
+
--- /dev/null
+From ecc42e7a617c37b42d674a32d19417caef93a0e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 09:30:29 +0800
+Subject: irqchip/riscv-aplic: Restrict genpd notifier to device tree only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jessica Liu <liu.xuemei1@zte.com.cn>
+
+[ Upstream commit af416cd9b3fb9d17ac7f4cfa12d1ea83dfd0e4be ]
+
+On ACPI systems, the aplic's pm_domain is set to acpi_general_pm_domain,
+which provides its own power management callbacks (e.g., runtime_suspend
+via acpi_subsys_runtime_suspend).
+
+aplic_pm_add() unconditionally calls dev_pm_genpd_add_notifier() when
+dev->pm_domain is non‑NULL, leading to a comparison between runtime_suspend
+and genpd_runtime_suspend. This results in the following errors when ACPI
+is enabled:
+
+ riscv-aplic RSCV0002:00: failed to create APLIC context
+ riscv-aplic RSCV0002:00: error -ENODEV: failed to setup APLIC in MSI mode
+
+Fix this by checking for dev->of_node before adding or removing the genpd
+notifier, ensuring it is only used for device tree based systems.
+
+Fixes: 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume")
+Signed-off-by: Jessica Liu <liu.xuemei1@zte.com.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260331093029749vRpdH-0qoEqjS0Wnn9M4x@zte.com.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-aplic-main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-riscv-aplic-main.c b/drivers/irqchip/irq-riscv-aplic-main.c
+index 9f53979b69625..d9afb6ae98cf5 100644
+--- a/drivers/irqchip/irq-riscv-aplic-main.c
++++ b/drivers/irqchip/irq-riscv-aplic-main.c
+@@ -150,7 +150,7 @@ static void aplic_pm_remove(void *data)
+ struct device *dev = priv->dev;
+
+ list_del(&priv->head);
+- if (dev->pm_domain)
++ if (dev->pm_domain && dev->of_node)
+ dev_pm_genpd_remove_notifier(dev);
+ }
+
+@@ -165,7 +165,7 @@ static int aplic_pm_add(struct device *dev, struct aplic_priv *priv)
+
+ priv->saved_hw_regs.srcs = srcs;
+ list_add(&priv->head, &aplics);
+- if (dev->pm_domain) {
++ if (dev->pm_domain && dev->of_node) {
+ priv->genpd_nb.notifier_call = aplic_pm_notifier;
+ ret = dev_pm_genpd_add_notifier(dev, &priv->genpd_nb);
+ if (ret)
+--
+2.53.0
+
--- /dev/null
+From c880f59374bf6ac78acc1ccf49a28dfac7bd404d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ switch (ralink_soc) {
+ case RT2880_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt2880-sysc";
+ case RT3883_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3883-sysc";
+ case RT305X_SOC_RT3050:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3050-sysc";
+ case RT305X_SOC_RT3052:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3052-sysc";
+ case RT305X_SOC_RT3350:
+ *idx = 1;
+--
+2.53.0
+
--- /dev/null
+From 5b6bfac703f41c991d0e600814a7cb7b1e7db88b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2026 12:43:05 -0700
+Subject: perf/x86: Fix potential bad container_of in intel_pmu_hw_config
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit dbde07f06226438cd2cf1179745fa1bec5d8914a ]
+
+Auto counter reload may have a group of events with software events
+present within it. The software event PMU isn't the x86_hybrid_pmu and
+a container_of operation in intel_pmu_set_acr_caused_constr (via the
+hybrid helper) could cause out of bound memory reads. Avoid this by
+guarding the call to intel_pmu_set_acr_caused_constr with an
+is_x86_event check.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
+Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 20f078ceb51da..bebaac1dbaeb3 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4594,8 +4594,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask);
+
+ if (leader->nr_siblings) {
+- for_each_sibling_event(sibling, leader)
+- intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++ for_each_sibling_event(sibling, leader) {
++ if (is_x86_event(sibling))
++ intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++ }
+ }
+
+ if (leader != event)
+--
+2.53.0
+
--- /dev/null
+From 70e8ae24d49533fc9c2f37a95323beefc1b1cc03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 15fec5d1e6dec..0bf629204c76a 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 7d44c0151156d9b65442dde2c893f09d294f035d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 00:00:22 +0800
+Subject: riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
+
+From: Zishun Yi <vulab@iscas.ac.cn>
+
+[ Upstream commit 3033b2b1e3949274f33a140e2a97571b5a307298 ]
+
+In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen
+is correctly set to 0, but it forgets to reset pmm. This results in the
+CPU pmm state not corresponding to the software pmlen state.
+
+Fix this by resetting pmm along with pmlen.
+
+Fixes: 2e1743085887 ("riscv: Add support for the tagged address ABI")
+Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
+Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
+Link: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/process.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 31a392993cb45..b5188dc74727d 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -324,8 +324,10 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)
+ if (arg & PR_TAGGED_ADDR_ENABLE && (tagged_addr_disabled || !pmlen))
+ return -EINVAL;
+
+- if (!(arg & PR_TAGGED_ADDR_ENABLE))
++ if (!(arg & PR_TAGGED_ADDR_ENABLE)) {
+ pmlen = PMLEN_0;
++ pmm = ENVCFG_PMM_PMLEN_0;
++ }
+
+ if (mmap_write_lock_killable(mm))
+ return -EINTR;
+--
+2.53.0
+
--- /dev/null
+From 4afc6d3204066f838704619459d1cad2315b8480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:21 +0200
+Subject: sched/debug: Fix avg_vruntime() usage
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit e08d007f9d813616ce7093600bc4fdb9c9d81d89 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The commit in question changes avg_vruntime() from a function that is
+a pure reader, to a function that updates variables. This turns an
+unlocked sched/debug usage of this function from a minor mistake into
+a data corruptor.
+
+Fixes: af4cf40470c2 ("sched/fair: Add cfs_rq::avg_vruntime")
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.196370805@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 93f009e1076d8..3504ec9bd7307 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -798,6 +798,7 @@ static void print_rq(struct seq_file *m, struct rq *rq, int rq_cpu)
+ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ {
+ s64 left_vruntime = -1, zero_vruntime, right_vruntime = -1, left_deadline = -1, spread;
++ u64 avruntime;
+ struct sched_entity *last, *first, *root;
+ struct rq *rq = cpu_rq(cpu);
+ unsigned long flags;
+@@ -821,6 +822,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ if (last)
+ right_vruntime = last->vruntime;
+ zero_vruntime = cfs_rq->zero_vruntime;
++ avruntime = avg_vruntime(cfs_rq);
+ raw_spin_rq_unlock_irqrestore(rq, flags);
+
+ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "left_deadline",
+@@ -830,7 +832,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "zero_vruntime",
+ SPLIT_NS(zero_vruntime));
+ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "avg_vruntime",
+- SPLIT_NS(avg_vruntime(cfs_rq)));
++ SPLIT_NS(avruntime));
+ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", "right_vruntime",
+ SPLIT_NS(right_vruntime));
+ spread = right_vruntime - left_vruntime;
+--
+2.53.0
+
--- /dev/null
+From 56840127a764d1b5d45b1abac2ff495612031b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index a8e766eaca1f9..2625a78c03001 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -707,7 +707,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+ * Called in:
+ * - place_entity() -- before enqueue
+ * - update_entity_lag() -- before dequeue
+- * - entity_tick()
++ * - update_deadline() -- slice expiration
+ *
+ * This means it is one entry 'behind' but that puts it close enough to where
+ * the bound on entity_key() is at most two lag bounds.
+@@ -1131,6 +1131,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ * EEVDF: vd_i = ve_i + r_i / w_i
+ */
+ se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++ avg_vruntime(cfs_rq);
+
+ /*
+ * The task has consumed its request, reschedule.
+@@ -5636,11 +5637,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ update_load_avg(cfs_rq, curr, UPDATE_TG);
+ update_cfs_group(curr);
+
+- /*
+- * Pulls along cfs_rq::zero_vruntime.
+- */
+- avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ /*
+ * queued ticks are scheduled to match the slice, so don't bother
+@@ -9166,7 +9162,7 @@ static void yield_task_fair(struct rq *rq)
+ */
+ if (entity_eligible(cfs_rq, se)) {
+ se->vruntime = se->deadline;
+- se->deadline += calc_delta_fair(se->slice, se);
++ update_deadline(cfs_rq, se);
+ }
+ }
+
+--
+2.53.0
+
bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
bpf-fix-incorrect-pruning-due-to-atomic-fetch-precis.patch
revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+gpiolib-clear-requested-flag-if-line-is-invalid.patch
+interconnect-qcom-sm8450-fix-null-pointer-dereferenc.patch
+gpio-shared-call-gpio_chip-of_xlate-if-set.patch
+gpio-shared-handle-pins-shared-by-child-nodes-of-dev.patch
+gpio-qixis-fpga-fix-error-handling-for-devm_regmap_i.patch
+drm-bridge-fix-refcount-shown-via-debugfs-for-encode.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
+hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+gpio-shared-shorten-the-critical-section-in-gpiochip.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
+spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
+drm-xe-xe_pagefault-disallow-writes-to-read-only-vma.patch
+drm-xe-pxp-clean-up-termination-status-on-failure.patch
+drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
+drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+irqchip-riscv-aplic-restrict-genpd-notifier-to-devic.patch
+drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
+hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+sched-debug-fix-avg_vruntime-usage.patch
+perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
+riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
+acpi-rimt-add-dependency-between-iommu-and-devices.patch
--- /dev/null
+From 0b18d2fad6d68d1832c30e382f24c11aec9c17e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2026 22:28:45 +0800
+Subject: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and
+ remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f ]
+
+aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was
+missing from both probe unwind and remove-time cleanup. Add a devm cleanup
+action after successful registration so
+nand_ecc_unregister_on_host_hw_engine() runs automatically on probe
+failures and during device removal.
+
+Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-amlogic-spifc-a4.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/spi/spi-amlogic-spifc-a4.c b/drivers/spi/spi-amlogic-spifc-a4.c
+index b2589fe2425cc..3393e1f305709 100644
+--- a/drivers/spi/spi-amlogic-spifc-a4.c
++++ b/drivers/spi/spi-amlogic-spifc-a4.c
+@@ -1066,6 +1066,13 @@ static const struct nand_ecc_engine_ops aml_sfc_ecc_engine_ops = {
+ .finish_io_req = aml_sfc_ecc_finish_io_req,
+ };
+
++static void aml_sfc_unregister_ecc_engine(void *data)
++{
++ struct nand_ecc_engine *eng = data;
++
++ nand_ecc_unregister_on_host_hw_engine(eng);
++}
++
+ static int aml_sfc_clk_init(struct aml_sfc *sfc)
+ {
+ sfc->gate_clk = devm_clk_get_enabled(sfc->dev, "gate");
+@@ -1149,6 +1156,11 @@ static int aml_sfc_probe(struct platform_device *pdev)
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret, "failed to register Aml host ecc engine.\n");
+
++ ret = devm_add_action_or_reset(dev, aml_sfc_unregister_ecc_engine,
++ &sfc->ecc_eng);
++ if (ret)
++ return dev_err_probe(dev, ret, "failed to add ECC unregister action\n");
++
+ ret = of_property_read_u32(np, "amlogic,rx-adj", &val);
+ if (!ret)
+ sfc->rx_adj = val;
+--
+2.53.0
+
--- /dev/null
+From 89f52c6c52e70e57ef4811140749b7f44067ba2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 00:07:06 +0800
+Subject: spi: stm32-ospi: Fix reset control leak on probe error
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 ]
+
+When spi_register_controller() fails after reset_control_acquire()
+succeeds, the reset control is never released. This causes a resource
+leak in the error path.
+
+Add the missing reset_control_release() call in the error path.
+
+Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index 5fa27de89210a..2988ff288ff02 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -939,13 +939,15 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ if (ret) {
+ /* Disable ospi */
+ writel_relaxed(0, ospi->regs_base + OSPI_CR);
+- goto err_pm_resume;
++ goto err_reset_control;
+ }
+
+ pm_runtime_put_autosuspend(ospi->dev);
+
+ return 0;
+
++err_reset_control:
++ reset_control_release(ospi->rstc);
+ err_pm_resume:
+ pm_runtime_put_sync_suspend(ospi->dev);
+
+--
+2.53.0
+
--- /dev/null
+From 61206127b0c9877de828b21346e6718b0126dcb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 19:14:05 +0800
+Subject: spi: stm32-ospi: Fix resource leak in remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 73cd1f97946ae3796544448ff12c07f399bb2881 ]
+
+The remove() callback returned early if pm_runtime_resume_and_get()
+failed, skipping the cleanup of spi controller and other resources.
+
+Remove the early return so cleanup completes regardless of PM resume
+result.
+
+Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index f36fd36da2692..5fa27de89210a 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -963,11 +963,8 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ static void stm32_ospi_remove(struct platform_device *pdev)
+ {
+ struct stm32_ospi *ospi = platform_get_drvdata(pdev);
+- int ret;
+
+- ret = pm_runtime_resume_and_get(ospi->dev);
+- if (ret < 0)
+- return;
++ pm_runtime_resume_and_get(ospi->dev);
+
+ spi_unregister_controller(ospi->ctrl);
+ /* Disable ospi */
+--
+2.53.0
+
--- /dev/null
+From 80ccb07a05d84290d427c5bf3e83a7d1f94b3385 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index 08b78f5678532..de8b17e2b29e1 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ */
+ return -ENODEV;
+
+- if (status) {
++ if (usr && status) {
+ /*
+ * Releasing resources failed on the device side, which puts
+ * us in a bind since they may still be in use, so enable the
+@@ -1104,6 +1104,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ mutex_lock(&qdev->cntl_mutex);
+ if (!list_empty(&elem.list))
+ list_del(&elem.list);
++ /* resp_worker() processed the response but the wait was interrupted */
++ else if (ret == -ERESTARTSYS)
++ ret = 0;
+ if (!ret && !elem.buf)
+ ret = -ETIMEDOUT;
+ else if (ret > 0 && !elem.buf)
+@@ -1414,9 +1417,49 @@ static void resp_worker(struct work_struct *work)
+ }
+ mutex_unlock(&qdev->cntl_mutex);
+
+- if (!found)
++ if (!found) {
++ /*
++ * The user might have gone away at this point without waiting
++ * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++ * the device. If this is not handled correctly, the host will
++ * not know that the DBC[n] has been freed on the device.
++ * Due to this failure in synchronization between the device and
++ * the host, if another user requests to activate a network, and
++ * the device assigns DBC[n] again, save_dbc_buf() will hang,
++ * waiting for dbc[n]->in_use to be set to false, which will not
++ * happen unless the qaic_dev_reset_clean_local_state() gets
++ * called by resetting the device (or re-inserting the module).
++ *
++ * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++ * transactions in the message before disposing of it, then
++ * handle releasing the DBC resources.
++ *
++ * Since the user has gone away, if the device could not
++ * deactivate the network (status != 0), there is no way to
++ * enable and reassign the DBC to the user. We can put trust in
++ * the device that it will release all the active DBCs in
++ * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++ * otherwise, the user can issue an soc_reset to the device.
++ */
++ u32 msg_count = le32_to_cpu(msg->hdr.count);
++ u32 msg_len = le32_to_cpu(msg->hdr.len);
++ u32 len = 0;
++ int j;
++
++ for (j = 0; j < msg_count && len < msg_len; ++j) {
++ struct wire_trans_hdr *trans_hdr;
++
++ trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++ if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++ if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++ len += le32_to_cpu(trans_hdr->len);
++ } else {
++ len += le32_to_cpu(trans_hdr->len);
++ }
++ }
+ /* request must have timed out, drop packet */
+ kfree(msg);
++ }
+
+ kfree(resp);
+ }
+--
+2.53.0
+
--- /dev/null
+From 18492ccffc3af861c46a574666f98aedaeba18a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d481e78958a74..2c7355e9547a1 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -33,7 +33,7 @@ properties:
+ const: 2
+
+ "#interrupt-cells":
+- const: 1
++ const: 2
+
+ ngpios:
+ description:
+@@ -84,7 +84,7 @@ examples:
+ gpio-controller;
+ #gpio-cells = <2>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ interrupts = <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+ <53>, <53>, <53>, <53>,
+--
+2.53.0
+
--- /dev/null
+From 02e88facbd71d136f516f9206a3ba5bc8a16a4a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 755926fa0bf7d..c6a78436e9bba 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ switch (sattr->nr) {
+ case 0:
+ if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+- rc = sysfs_emit(buf, "%u",
++ rc = sysfs_emit(buf, "%u\n",
+ get_unaligned_be32(&extn->sensor_id));
+ } else {
+ rc = sysfs_emit(buf, "%4phN\n", extn->name);
+--
+2.53.0
+
--- /dev/null
+From 841f0fee499b119fef725406d35b9f14003ee99f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index e2790a682dc80..d37e389b50d76 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ * By default this device doesn't boot to page 0, so set page 0
+ * to access all pmbus registers.
+ */
+- i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++ if (ret < 0)
++ return dev_err_probe(&client->dev, ret,
++ "Failed to set page 0\n");
+
+ /* Read Manufacturer id */
+ ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+--
+2.53.0
+
--- /dev/null
+From 2587c99709bc4d8dcd2df1238ff48eb9569f0c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 5c9466244d70d..ecc1be33b3b1b 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ if (ret < 0)
+ return ret;
+- if (strncmp("TI\x53\x67\x60", buf, 5)) {
+- dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++ if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++ dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ return -ENODEV;
+ }
+
+--
+2.53.0
+
--- /dev/null
+From 8df24b489ed4a17f5effc935e7289cc84b403d28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 98f17c29da69b..7b58b418b8a8b 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG 0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG 0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG 0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG 0x34
+ #define BNO055_CALIB_STAT_REG 0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+--
+2.53.0
+
--- /dev/null
+From c4606cf655109c03d16514db0b22028109d17509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ switch (ralink_soc) {
+ case RT2880_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt2880-sysc";
+ case RT3883_SOC:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3883-sysc";
+ case RT305X_SOC_RT3050:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3050-sysc";
+ case RT305X_SOC_RT3052:
+- *idx = 0;
++ *idx = 1;
+ return "ralink,rt3052-sysc";
+ case RT305X_SOC_RT3350:
+ *idx = 1;
+--
+2.53.0
+
--- /dev/null
+From cefbfdf175deac28fa200d9cd0e3660396c5203b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+ register embeds instead the struct pt_regs offset of the A1
+ register. Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+ S10 register into the gdb_regs[] array element meant for the S9
+ register, and copies the value of the S11 register into the array
+ element meant for the S10 register. It also neglects to copy the
+ value of the S11 register. Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 9f3db3503dabd..edaab2aa16a3e 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ {DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ {DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ {DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+- {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++ {DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ {DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ {DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ {DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+- gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+- gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++ gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++ gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++ gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+
+--
+2.53.0
+
net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+mips-ralink-update-cpu-clock-index.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
