--- /dev/null
+From 0f475ee0ebce5c9492b260027cd95270191675fa Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Fri, 27 Feb 2026 00:02:33 +0000
+Subject: btrfs: abort transaction on failure to update root in the received subvol ioctl
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 0f475ee0ebce5c9492b260027cd95270191675fa upstream.
+
+If we failed to update the root we don't abort the transaction, which is
+wrong since we already used the transaction to remove an item from the
+uuid tree.
+
+Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree")
+CC: stable@vger.kernel.org # 3.12+
+Reviewed-by: Anand Jain <asj@kernel.org>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ioctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4524,7 +4524,8 @@ static long _btrfs_ioctl_set_received_su
+
+ ret = btrfs_update_root(trans, fs_info->tree_root,
+ &root->root_key, &root->root_item);
+- if (ret < 0) {
++ if (unlikely(ret < 0)) {
++ btrfs_abort_transaction(trans, ret);
+ btrfs_end_transaction(trans);
+ goto out;
+ }
--- /dev/null
+From 2c1030f2e84885cc58bffef6af67d5b9d2e7098f Mon Sep 17 00:00:00 2001
+From: Alysa Liu <Alysa.Liu@amd.com>
+Date: Thu, 5 Feb 2026 11:21:45 -0500
+Subject: drm/amdgpu: Fix use-after-free race in VM acquire
+
+From: Alysa Liu <Alysa.Liu@amd.com>
+
+commit 2c1030f2e84885cc58bffef6af67d5b9d2e7098f upstream.
+
+Replace non-atomic vm->process_info assignment with cmpxchg()
+to prevent race when parent/child processes sharing a drm_file
+both try to acquire the same VM after fork().
+
+Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
+Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+@@ -932,7 +932,10 @@ static int init_kfd_vm(struct amdgpu_vm
+ *ef = dma_fence_get(&info->eviction_fence->base);
+ }
+
+- vm->process_info = *process_info;
++ if (cmpxchg(&vm->process_info, NULL, *process_info) != NULL) {
++ ret = -EINVAL;
++ goto already_acquired;
++ }
+
+ /* Validate page directory and attach eviction fence */
+ ret = amdgpu_bo_reserve(vm->root.base.bo, true);
+@@ -969,6 +972,7 @@ validate_pd_fail:
+ amdgpu_bo_unreserve(vm->root.base.bo);
+ reserve_pd_fail:
+ vm->process_info = NULL;
++already_acquired:
+ if (info) {
+ /* Two fence references: one in info and one in *ef */
+ dma_fence_put(&info->eviction_fence->base);
--- /dev/null
+From f55b9510cd9437da3a0efa08b089caeb47595ff1 Mon Sep 17 00:00:00 2001
+From: Chris Spencer <spencercw@gmail.com>
+Date: Thu, 5 Feb 2026 14:55:45 +0000
+Subject: iio: chemical: bme680: Fix measurement wait duration calculation
+
+From: Chris Spencer <spencercw@gmail.com>
+
+commit f55b9510cd9437da3a0efa08b089caeb47595ff1 upstream.
+
+This function refers to the Bosch BME680 API as the source of the
+calculation, but one of the constants does not match the Bosch
+implementation. This appears to be a simple transposition of two digits,
+resulting in a wait time that is too short. This can cause the following
+'device measurement cycle incomplete' check to occasionally fail, returning
+EBUSY to user space.
+
+Adjust the constant to match the Bosch implementation and resolve the EBUSY
+errors.
+
+Fixes: 4241665e6ea0 ("iio: chemical: bme680: Fix sensor data read operation")
+Link: https://github.com/boschsensortec/BME68x_SensorAPI/blob/v4.4.8/bme68x.c#L521
+Signed-off-by: Chris Spencer <spencercw@gmail.com>
+Acked-by: Vasileios Amoiridis <vassilisamir@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/chemical/bme680_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/chemical/bme680_core.c
++++ b/drivers/iio/chemical/bme680_core.c
+@@ -548,7 +548,7 @@ static int bme680_wait_for_eoc(struct bm
+ * + heater duration
+ */
+ int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +
+- data->oversampling_humid) * 1936) + (477 * 4) +
++ data->oversampling_humid) * 1963) + (477 * 4) +
+ (477 * 5) + 1000 + (data->heater_dur * 1000);
+
+ usleep_range(wait_eoc_us, wait_eoc_us + 100);
--- /dev/null
+From 5187e03b817c26c1c3bcb2645a612ea935c4be89 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Wed, 4 Feb 2026 15:00:33 +0100
+Subject: iio: dac: ds4424: reject -128 RAW value
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit 5187e03b817c26c1c3bcb2645a612ea935c4be89 upstream.
+
+The DS442x DAC uses sign-magnitude encoding, so -128 cannot be represented
+in hardware (7-bit magnitude).
+
+Previously, passing -128 resulted in a truncated value that programmed
+0mA (magnitude 0) instead of the expected maximum negative current,
+effectively failing silently.
+
+Reject -128 to avoid producing the wrong current.
+
+Fixes: d632a2bd8ffc ("iio: dac: ds4422/ds4424 dac driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ds4424.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ds4424.c
++++ b/drivers/iio/dac/ds4424.c
+@@ -141,7 +141,7 @@ static int ds4424_write_raw(struct iio_d
+
+ switch (mask) {
+ case IIO_CHAN_INFO_RAW:
+- if (val < S8_MIN || val > S8_MAX)
++ if (val <= S8_MIN || val > S8_MAX)
+ return -EINVAL;
+
+ if (val > 0) {
--- /dev/null
+From acc3949aab3e8094641a9c7c2768de1958c88378 Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Mon, 16 Feb 2026 11:57:56 +0200
+Subject: iio: gyro: mpu3050-core: fix pm_runtime error handling
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit acc3949aab3e8094641a9c7c2768de1958c88378 upstream.
+
+The return value of pm_runtime_get_sync() is not checked, allowing
+the driver to access hardware that may fail to resume. The device
+usage count is also unconditionally incremented. Use
+pm_runtime_resume_and_get() which propagates errors and avoids
+incrementing the usage count on failure.
+
+In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()
+failure since postdisable does not run when preenable fails.
+
+Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-core.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/gyro/mpu3050-core.c
++++ b/drivers/iio/gyro/mpu3050-core.c
+@@ -320,7 +320,9 @@ static int mpu3050_read_raw(struct iio_d
+ }
+ case IIO_CHAN_INFO_RAW:
+ /* Resume device */
+- pm_runtime_get_sync(mpu3050->dev);
++ ret = pm_runtime_resume_and_get(mpu3050->dev);
++ if (ret)
++ return ret;
+ mutex_lock(&mpu3050->lock);
+
+ ret = mpu3050_set_8khz_samplerate(mpu3050);
+@@ -651,14 +653,20 @@ out_trigger_unlock:
+ static int mpu3050_buffer_preenable(struct iio_dev *indio_dev)
+ {
+ struct mpu3050 *mpu3050 = iio_priv(indio_dev);
++ int ret;
+
+- pm_runtime_get_sync(mpu3050->dev);
++ ret = pm_runtime_resume_and_get(mpu3050->dev);
++ if (ret)
++ return ret;
+
+ /* Unless we have OUR trigger active, run at full speed */
+- if (!mpu3050->hw_irq_trigger)
+- return mpu3050_set_8khz_samplerate(mpu3050);
++ if (!mpu3050->hw_irq_trigger) {
++ ret = mpu3050_set_8khz_samplerate(mpu3050);
++ if (ret)
++ pm_runtime_put_autosuspend(mpu3050->dev);
++ }
+
+- return 0;
++ return ret;
+ }
+
+ static int mpu3050_buffer_postdisable(struct iio_dev *indio_dev)
--- /dev/null
+From 91f950b4cbb1aa9ea4eb3999f1463e8044b717fb Mon Sep 17 00:00:00 2001
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Date: Mon, 16 Feb 2026 11:57:55 +0200
+Subject: iio: gyro: mpu3050-i2c: fix pm_runtime error handling
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+commit 91f950b4cbb1aa9ea4eb3999f1463e8044b717fb upstream.
+
+The return value of pm_runtime_get_sync() is not checked, and the
+function always returns success. This allows I2C mux operations to
+proceed even when the device fails to resume.
+
+Use pm_runtime_resume_and_get() and propagate its return value to
+properly handle resume failures.
+
+Fixes: 3904b28efb2c ("iio: gyro: Add driver for the MPU-3050 gyroscope")
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/mpu3050-i2c.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/gyro/mpu3050-i2c.c
++++ b/drivers/iio/gyro/mpu3050-i2c.c
+@@ -19,8 +19,7 @@ static int mpu3050_i2c_bypass_select(str
+ struct mpu3050 *mpu3050 = i2c_mux_priv(mux);
+
+ /* Just power up the device, that is all that is needed */
+- pm_runtime_get_sync(mpu3050->dev);
+- return 0;
++ return pm_runtime_resume_and_get(mpu3050->dev);
+ }
+
+ static int mpu3050_i2c_bypass_deselect(struct i2c_mux_core *mux, u32 chan_id)
--- /dev/null
+From c9f3a593137d862d424130343e77d4b5260a4f5a Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Fri, 30 Jan 2026 16:38:47 +0100
+Subject: iio: imu: inv_icm42600: fix odr switch to the same value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit c9f3a593137d862d424130343e77d4b5260a4f5a upstream.
+
+ODR switch is done in 2 steps when FIFO is on : change the ODR register
+value and acknowledge change when reading the FIFO ODR change flag.
+When we are switching to the same odr value, we end up waiting for a
+FIFO ODR flag that is never happening.
+
+Fix the issue by doing nothing and exiting properly when we are
+switching to the same ODR value.
+
+Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 ++
+ drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+@@ -322,6 +322,8 @@ static int inv_icm42600_accel_write_odr(
+ return -EINVAL;
+
+ conf.odr = inv_icm42600_accel_odr_conv[idx / 2];
++ if (conf.odr == st->conf.accel.odr)
++ return 0;
+
+ pm_runtime_get_sync(dev);
+ mutex_lock(&st->lock);
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+@@ -334,6 +334,8 @@ static int inv_icm42600_gyro_write_odr(s
+ return -EINVAL;
+
+ conf.odr = inv_icm42600_gyro_odr_conv[idx / 2];
++ if (conf.odr == st->conf.gyro.odr)
++ return 0;
+
+ pm_runtime_get_sync(dev);
+ mutex_lock(&st->lock);
--- /dev/null
+From 85e4614524dca6c0a43874f475a17de2b9725648 Mon Sep 17 00:00:00 2001
+From: Lukas Schmid <lukas.schmid@netcube.li>
+Date: Mon, 2 Feb 2026 21:15:35 +0100
+Subject: iio: potentiometer: mcp4131: fix double application of wiper shift
+
+From: Lukas Schmid <lukas.schmid@netcube.li>
+
+commit 85e4614524dca6c0a43874f475a17de2b9725648 upstream.
+
+The MCP4131 wiper address is shifted twice when preparing the SPI
+command in mcp4131_write_raw().
+
+The address is already shifted when assigned to the local variable
+"address", but is then shifted again when written to data->buf[0].
+This results in an incorrect command being sent to the device and
+breaks wiper writes to the second channel.
+
+Remove the second shift and use the pre-shifted address directly
+when composing the SPI transfer.
+
+Fixes: 22d199a53910 ("iio: potentiometer: add driver for Microchip MCP413X/414X/415X/416X/423X/424X/425X/426X")
+Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>#
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/potentiometer/mcp4131.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/potentiometer/mcp4131.c
++++ b/drivers/iio/potentiometer/mcp4131.c
+@@ -222,7 +222,7 @@ static int mcp4131_write_raw(struct iio_
+
+ mutex_lock(&data->lock);
+
+- data->buf[0] = address << MCP4131_WIPER_SHIFT;
++ data->buf[0] = address;
+ data->buf[0] |= MCP4131_WRITE | (val >> 8);
+ data->buf[1] = val & 0xFF; /* 8 bits here */
+
--- /dev/null
+From 560f763baa0f2c9a44da4294c06af071405ac46f Mon Sep 17 00:00:00 2001
+From: Josh Law <objecting@objecting.org>
+Date: Thu, 12 Mar 2026 19:11:42 +0000
+Subject: lib/bootconfig: check bounds before writing in __xbc_open_brace()
+
+From: Josh Law <objecting@objecting.org>
+
+commit 560f763baa0f2c9a44da4294c06af071405ac46f upstream.
+
+The bounds check for brace_index happens after the array write.
+While the current call pattern prevents an actual out-of-bounds
+access (the previous call would have returned an error), the
+write-before-check pattern is fragile and would become a real
+out-of-bounds write if the error return were ever not propagated.
+
+Move the bounds check before the array write so the function is
+self-contained and safe regardless of caller behavior.
+
+Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/
+
+Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josh Law <objecting@objecting.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/bootconfig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/bootconfig.c
++++ b/lib/bootconfig.c
+@@ -436,9 +436,9 @@ static char *skip_spaces_until_newline(c
+ static int __init __xbc_open_brace(char *p)
+ {
+ /* Push the last key as open brace */
+- open_brace[brace_index++] = xbc_node_index(last_parent);
+ if (brace_index >= XBC_DEPTH_MAX)
+ return xbc_parse_error("Exceed max depth of braces", p);
++ open_brace[brace_index++] = xbc_node_index(last_parent);
+
+ return 0;
+ }
--- /dev/null
+From 39ebc8d7f561e1b64eca87353ef9b18e2825e591 Mon Sep 17 00:00:00 2001
+From: Josh Law <objecting@objecting.org>
+Date: Thu, 12 Mar 2026 19:11:41 +0000
+Subject: lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
+
+From: Josh Law <objecting@objecting.org>
+
+commit 39ebc8d7f561e1b64eca87353ef9b18e2825e591 upstream.
+
+__xbc_open_brace() pushes entries with post-increment
+(open_brace[brace_index++]), so brace_index always points one past
+the last valid entry. xbc_verify_tree() reads open_brace[brace_index]
+to report which brace is unclosed, but this is one past the last
+pushed entry and contains stale/zero data, causing the error message
+to reference the wrong node.
+
+Use open_brace[brace_index - 1] to correctly identify the unclosed
+brace. brace_index is known to be > 0 here since we are inside the
+if (brace_index) guard.
+
+Link: https://lore.kernel.org/all/20260312191143.28719-2-objecting@objecting.org/
+
+Fixes: ead1e19ad905 ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josh Law <objecting@objecting.org>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/bootconfig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/bootconfig.c
++++ b/lib/bootconfig.c
+@@ -685,7 +685,7 @@ static int __init xbc_verify_tree(void)
+
+ /* Brace closing */
+ if (brace_index) {
+- n = &xbc_nodes[open_brace[brace_index]];
++ n = &xbc_nodes[open_brace[brace_index - 1]];
+ return xbc_parse_error("Brace is not closed",
+ xbc_node_get_data(n));
+ }
--- /dev/null
+From 1120a36bb1e9b9e22de75ecb4ef0b998f73a97f1 Mon Sep 17 00:00:00 2001
+From: Josh Law <objecting@objecting.org>
+Date: Thu, 12 Mar 2026 19:11:43 +0000
+Subject: lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
+
+From: Josh Law <objecting@objecting.org>
+
+commit 1120a36bb1e9b9e22de75ecb4ef0b998f73a97f1 upstream.
+
+snprintf() returns the number of characters that would have been
+written excluding the NUL terminator. Output is truncated when the
+return value is >= the buffer size, not just > the buffer size.
+
+When ret == size, the current code takes the non-truncated path,
+advancing buf by ret and reducing size to 0. This is wrong because
+the output was actually truncated (the last character was replaced by
+NUL). Fix by using >= so the truncation path is taken correctly.
+
+Link: https://lore.kernel.org/all/20260312191143.28719-4-objecting@objecting.org/
+
+Fixes: 76db5a27a827 ("bootconfig: Add Extra Boot Config support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Josh Law <objecting@objecting.org>
+Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/bootconfig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/bootconfig.c
++++ b/lib/bootconfig.c
+@@ -250,7 +250,7 @@ int __init xbc_node_compose_key_after(st
+ depth ? "." : "");
+ if (ret < 0)
+ return ret;
+- if (ret > size) {
++ if (ret >= size) {
+ size = 0;
+ } else {
+ size -= ret;
parisc-fix-initial-page-table-creation-for-boot.patch
net-ncsi-fix-skb-leak-in-error-paths.patch
net-ethernet-arc-emac-quiesce-interrupts-before-requesting-irq.patch
+drm-amdgpu-fix-use-after-free-race-in-vm-acquire.patch
+tracing-fix-trace_buf_size-cmdline-parameter-with-sizes-2g.patch
+lib-bootconfig-fix-off-by-one-in-xbc_verify_tree-unclosed-brace-error.patch
+x86-apic-disable-x2apic-on-resume-if-the-kernel-expects-so.patch
+lib-bootconfig-fix-snprintf-truncation-check-in-xbc_node_compose_key_after.patch
+lib-bootconfig-check-bounds-before-writing-in-__xbc_open_brace.patch
+btrfs-abort-transaction-on-failure-to-update-root-in-the-received-subvol-ioctl.patch
+iio-dac-ds4424-reject-128-raw-value.patch
+iio-potentiometer-mcp4131-fix-double-application-of-wiper-shift.patch
+iio-chemical-bme680-fix-measurement-wait-duration-calculation.patch
+iio-gyro-mpu3050-core-fix-pm_runtime-error-handling.patch
+iio-gyro-mpu3050-i2c-fix-pm_runtime-error-handling.patch
+iio-imu-inv_icm42600-fix-odr-switch-to-the-same-value.patch
--- /dev/null
+From d008ba8be8984760e36d7dcd4adbd5a41a645708 Mon Sep 17 00:00:00 2001
+From: Calvin Owens <calvin@wbinvd.org>
+Date: Fri, 6 Mar 2026 19:19:25 -0800
+Subject: tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
+
+From: Calvin Owens <calvin@wbinvd.org>
+
+commit d008ba8be8984760e36d7dcd4adbd5a41a645708 upstream.
+
+Some of the sizing logic through tracer_alloc_buffers() uses int
+internally, causing unexpected behavior if the user passes a value that
+does not fit in an int (on my x86 machine, the result is uselessly tiny
+buffers).
+
+Fix by plumbing the parameter's real type (unsigned long) through to the
+ring buffer allocation functions, which already use unsigned long.
+
+It has always been possible to create larger ring buffers via the sysfs
+interface: this only affects the cmdline parameter.
+
+Cc: stable@vger.kernel.org
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Link: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.1772852067.git.calvin@wbinvd.org
+Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")
+Signed-off-by: Calvin Owens <calvin@wbinvd.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -8771,7 +8771,7 @@ static void
+ init_tracer_tracefs(struct trace_array *tr, struct dentry *d_tracer);
+
+ static int
+-allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
++allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, unsigned long size)
+ {
+ enum ring_buffer_flags rb_flags;
+
+@@ -8797,7 +8797,7 @@ allocate_trace_buffer(struct trace_array
+ return 0;
+ }
+
+-static int allocate_trace_buffers(struct trace_array *tr, int size)
++static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
+ {
+ int ret;
+
+@@ -9728,7 +9728,7 @@ out:
+
+ __init static int tracer_alloc_buffers(void)
+ {
+- int ring_buf_size;
++ unsigned long ring_buf_size;
+ int ret = -ENOMEM;
+
+
--- /dev/null
+From 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 Mon Sep 17 00:00:00 2001
+From: Shashank Balaji <shashank.mahadasyam@sony.com>
+Date: Fri, 6 Mar 2026 14:46:28 +0900
+Subject: x86/apic: Disable x2apic on resume if the kernel expects so
+
+From: Shashank Balaji <shashank.mahadasyam@sony.com>
+
+commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 upstream.
+
+When resuming from s2ram, firmware may re-enable x2apic mode, which may have
+been disabled by the kernel during boot either because it doesn't support IRQ
+remapping or for other reasons. This causes the kernel to continue using the
+xapic interface, while the hardware is in x2apic mode, which causes hangs.
+This happens on defconfig + bare metal + s2ram.
+
+Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be
+disabled, i.e. when x2apic_mode = 0.
+
+The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the
+pre-sleep configuration or initial boot configuration for each CPU, including
+MSR state:
+
+ When executing from the power-on reset vector as a result of waking from an
+ S2 or S3 sleep state, the platform firmware performs only the hardware
+ initialization required to restore the system to either the state the
+ platform was in prior to the initial operating system boot, or to the
+ pre-sleep configuration state. In multiprocessor systems, non-boot
+ processors should be placed in the same state as prior to the initial
+ operating system boot.
+
+ (further ahead)
+
+ If this is an S2 or S3 wake, then the platform runtime firmware restores
+ minimum context of the system before jumping to the waking vector. This
+ includes:
+
+ CPU configuration. Platform runtime firmware restores the pre-sleep
+ configuration or initial boot configuration of each CPU (MSR, MTRR,
+ firmware update, SMBase, and so on). Interrupts must be disabled (for
+ IA-32 processors, disabled by CLI instruction).
+
+ (and other things)
+
+So at least as per the spec, re-enablement of x2apic by the firmware is
+allowed if "x2apic on" is a part of the initial boot configuration.
+
+ [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization
+
+ [ bp: Massage. ]
+
+Fixes: 6e1cb38a2aef ("x64, x2apic/intr-remap: add x2apic support, including enabling interrupt-remapping")
+Co-developed-by: Rahul Bukte <rahul.bukte@sony.com>
+Signed-off-by: Rahul Bukte <rahul.bukte@sony.com>
+Signed-off-by: Shashank Balaji <shashank.mahadasyam@sony.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Thomas Gleixner <tglx@kernel.org>
+Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260306-x2apic-fix-v2-1-bee99c12efa3@sony.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kernel/apic/apic.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1901,6 +1901,7 @@ early_initcall(validate_x2apic);
+
+ static inline void try_to_enable_x2apic(int remap_mode) { }
+ static inline void __x2apic_enable(void) { }
++static inline void __x2apic_disable(void) { }
+ #endif /* !CONFIG_X86_X2APIC */
+
+ void __init enable_IR_x2apic(void)
+@@ -2664,6 +2665,11 @@ static void lapic_resume(void)
+ if (x2apic_mode) {
+ __x2apic_enable();
+ } else {
++ if (x2apic_enabled()) {
++ pr_warn_once("x2apic: re-enabled by firmware during resume. Disabling\n");
++ __x2apic_disable();
++ }
++
+ /*
+ * Make sure the APICBASE points to the right address
+ *
projects / thirdparty / kernel / stable-queue.git / commitdiff
