Fixes for all trees Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/btrfs-fix-transaction-abort-on-set-received-ioctl-du.patch b/queue-5.10/btrfs-fix-transaction-abort-on-set-received-ioctl-du.patch
new file mode 100644
index 0000000..7761fb8
--- /dev/null
+++ b/queue-5.10/btrfs-fix-transaction-abort-on-set-received-ioctl-du.patch

@@ -0,0 +1,147 @@
+From 59da1e3ff3cc66b5dff4936e1209e1b93f647984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 09:02:32 -0400
+Subject: btrfs: fix transaction abort on set received ioctl due to item
+ overflow
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 87f2c46003fce4d739138aab4af1942b1afdadac ]
+
+If the set received ioctl fails due to an item overflow when attempting to
+add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction
+since we did some metadata updates before.
+
+This means that if a user calls this ioctl with the same received UUID
+field for a lot of subvolumes, we will hit the overflow, trigger the
+transaction abort and turn the filesystem into RO mode. A malicious user
+could exploit this, and this ioctl does not even requires that a user
+has admin privileges (CAP_SYS_ADMIN), only that he/she owns the subvolume.
+
+Fix this by doing an early check for item overflow before starting a
+transaction. This is also race safe because we are holding the subvol_sem
+semaphore in exclusive (write) mode.
+
+A test case for fstests will follow soon.
+
+Fixes: dd5f9615fc5c ("Btrfs: maintain subvolume items in the UUID tree")
+CC: stable@vger.kernel.org # 3.12+
+Reviewed-by: Anand Jain <asj@kernel.org>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h     |  2 ++
+ fs/btrfs/ioctl.c     | 21 +++++++++++++++++++--
+ fs/btrfs/uuid-tree.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 63 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index a9926fb10c491..c395035980eef 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2870,6 +2870,8 @@ int btrfs_uuid_tree_add(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ 			u64 subid);
+ int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info);
++int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
++				   u8 *uuid, u8 type);
+ 
+ /* dir-item.c */
+ int btrfs_check_dir_item_collision(struct btrfs_root *root, u64 dir,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 574a00db258a0..3712396c3f8a0 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4486,6 +4486,25 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ 		goto out;
+ 	}
+ 
++	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
++				       BTRFS_UUID_SIZE);
++
++	/*
++	 * Before we attempt to add the new received uuid, check if we have room
++	 * for it in case there's already an item. If the size of the existing
++	 * item plus this root's ID (u64) exceeds the maximum item size, we can
++	 * return here without the need to abort a transaction. If we don't do
++	 * this check, the btrfs_uuid_tree_add() call below would fail with
++	 * -EOVERFLOW and result in a transaction abort. Malicious users could
++	 * exploit this to turn the fs into RO mode.
++	 */
++	if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) {
++		ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid,
++						     BTRFS_UUID_KEY_RECEIVED_SUBVOL);
++		if (ret < 0)
++			goto out;
++	}
++
+ 	/*
+ 	 * 1 - root item
+ 	 * 2 - uuid items (received uuid + subvol uuid)
+@@ -4501,8 +4520,6 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ 	sa->rtime.sec = ct.tv_sec;
+ 	sa->rtime.nsec = ct.tv_nsec;
+ 
+-	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
+-				       BTRFS_UUID_SIZE);
+ 	if (received_uuid_changed &&
+ 	    !btrfs_is_empty_uuid(root_item->received_uuid)) {
+ 		ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid,
+diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
+index 28525ad7ff8cb..d40e1731b570e 100644
+--- a/fs/btrfs/uuid-tree.c
++++ b/fs/btrfs/uuid-tree.c
+@@ -226,6 +226,48 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ 	return ret;
+ }
+ 
++/*
++ * Check if we can add one root ID to a UUID key.
++ * If the key does not yet exists, we can, otherwise only if extended item does
++ * not exceeds the maximum item size permitted by the leaf size.
++ *
++ * Returns 0 on success, negative value on error.
++ */
++int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
++				   u8 *uuid, u8 type)
++{
++	struct btrfs_path *path = NULL;
++	int ret;
++	u32 item_size;
++	struct btrfs_key key;
++
++	if (WARN_ON_ONCE(!fs_info->uuid_root))
++		return -EINVAL;
++
++	path = btrfs_alloc_path();
++	if (!path)
++		return -ENOMEM;
++
++	btrfs_uuid_to_key(uuid, type, &key);
++	ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0);
++	if (ret < 0)
++		goto out;
++	if (ret > 0) {
++		ret = 0;
++		goto out;
++	}
++
++	item_size = btrfs_item_size_nr(path->nodes[0], path->slots[0]);
++
++	if (sizeof(struct btrfs_item) + item_size + sizeof(u64) >
++	    BTRFS_LEAF_DATA_SIZE(fs_info))
++		ret = -EOVERFLOW;
++
++out:
++	btrfs_free_path(path);
++	return ret;
++}
++
+ static int btrfs_uuid_iter_rem(struct btrfs_root *uuid_root, u8 *uuid, u8 type,
+ 			       u64 subid)
+ {
+-- 
+2.53.0
+

diff --git a/queue-5.10/drm-vmwgfx-add-seqno-waiter-for-sync_files.patch-18451 b/queue-5.10/drm-vmwgfx-add-seqno-waiter-for-sync_files.patch-18451
new file mode 100644
index 0000000..3069844
--- /dev/null
+++ b/queue-5.10/drm-vmwgfx-add-seqno-waiter-for-sync_files.patch-18451

@@ -0,0 +1,91 @@
+From 9d079da810823569a1246aea670560a5648ae356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2025 14:06:33 -0600
+Subject: drm/vmwgfx: Add seqno waiter for sync_files
+
+From: Ian Forbes <ian.forbes@broadcom.com>
+
+[ Upstream commit 0039a3b35b10d9c15d3d26320532ab56cc566750 ]
+
+Because sync_files are passive waiters they do not participate in
+the processing of fences like the traditional vmw_fence_wait IOCTL.
+If userspace exclusively uses sync_files for synchronization then
+nothing in the kernel actually processes fence updates as interrupts
+for fences are masked and ignored if the kernel does not indicate to the
+SVGA device that there are active waiters.
+
+This oversight results in a bug where the entire GUI can freeze waiting
+on a sync_file that will never be signalled as we've masked the interrupts
+to signal its completion. This bug is incredibly racy as any process which
+interacts with the fencing code via the 3D stack can process the stuck
+fences on behalf of the stuck process causing it to run again. Even a
+simple app like eglinfo is enough to resume the stuck process. Usually
+this bug is seen at a login screen like GDM because there are no other
+3D apps running.
+
+By adding a seqno waiter we re-enable interrupt based processing of the
+dma_fences associated with the sync_file which is signalled as part of a
+dma_fence_callback.
+
+This has likely been broken since it was initially added to the kernel in
+2017 but has gone unnoticed until mutter recently started using sync_files
+heavily over the course of 2024 as part of their explicit sync support.
+
+Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
+Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250228200633.642417-1-ian.forbes@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 +++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index daea547704ddc..9bec26fda14cb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -4039,6 +4039,23 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
+ 	return 0;
+ }
+ 
++/*
++ * DMA fence callback to remove a seqno_waiter
++ */
++struct seqno_waiter_rm_context {
++	struct dma_fence_cb base;
++	struct vmw_private *dev_priv;
++};
++
++static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
++{
++	struct seqno_waiter_rm_context *ctx =
++		container_of(cb, struct seqno_waiter_rm_context, base);
++
++	vmw_seqno_waiter_remove(ctx->dev_priv);
++	kfree(ctx);
++}
++
+ int vmw_execbuf_process(struct drm_file *file_priv,
+ 			struct vmw_private *dev_priv,
+ 			void __user *user_commands, void *kernel_commands,
+@@ -4230,8 +4247,17 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ 			fput(sync_file->file);
+ 			put_unused_fd(out_fence_fd);
+ 		} else {
++			struct seqno_waiter_rm_context *ctx;
+ 			/* Link the fence with the FD created earlier */
+ 			fd_install(out_fence_fd, sync_file->file);
++			ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
++			ctx->dev_priv = dev_priv;
++			vmw_seqno_waiter_add(dev_priv);
++			if (dma_fence_add_callback(&fence->base, &ctx->base,
++						   seqno_waiter_rm_cb) < 0) {
++				vmw_seqno_waiter_remove(dev_priv);
++				kfree(ctx);
++			}
+ 		}
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.10/efi-mokvar-table-avoid-repeated-map-unmap-of-the-sam.patch b/queue-5.10/efi-mokvar-table-avoid-repeated-map-unmap-of-the-sam.patch
new file mode 100644
index 0000000..6626b2c
--- /dev/null
+++ b/queue-5.10/efi-mokvar-table-avoid-repeated-map-unmap-of-the-sam.patch

@@ -0,0 +1,73 @@
+From 762795dc246a2cd1f66587e6a3fd74d3d5548c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2025 14:30:22 +0100
+Subject: efi/mokvar-table: Avoid repeated map/unmap of the same page
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e3cf2d91d0583cae70aeb512da87e3ade25ea912 ]
+
+Tweak the logic that traverses the MOKVAR UEFI configuration table to
+only unmap the entry header and map the next one if they don't live in
+the same physical page.
+
+Link: https://lore.kernel.org/all/8f085931-3e9d-4386-9209-1d6c95616327@uncooperative.org/
+Tested-By: Peter Jones <pjones@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/mokvar-table.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c
+index 39a49adf007a5..69ac876ca809d 100644
+--- a/drivers/firmware/efi/mokvar-table.c
++++ b/drivers/firmware/efi/mokvar-table.c
+@@ -99,13 +99,13 @@ static struct kobject *mokvar_kobj;
+  */
+ void __init efi_mokvar_table_init(void)
+ {
++	struct efi_mokvar_table_entry __aligned(1) *mokvar_entry, *next_entry;
+ 	efi_memory_desc_t md;
+ 	void *va = NULL;
+ 	unsigned long cur_offset = 0;
+ 	unsigned long offset_limit;
+ 	unsigned long map_size_needed = 0;
+ 	unsigned long size;
+-	struct efi_mokvar_table_entry *mokvar_entry;
+ 	int err;
+ 
+ 	if (!efi_enabled(EFI_MEMMAP))
+@@ -142,7 +142,7 @@ void __init efi_mokvar_table_init(void)
+ 			return;
+ 		}
+ 		mokvar_entry = va;
+-
++next:
+ 		/* Check for last sentinel entry */
+ 		if (mokvar_entry->name[0] == '\0') {
+ 			if (mokvar_entry->data_size != 0)
+@@ -156,7 +156,19 @@ void __init efi_mokvar_table_init(void)
+ 		mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0';
+ 
+ 		/* Advance to the next entry */
+-		cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size;
++		size = sizeof(*mokvar_entry) + mokvar_entry->data_size;
++		cur_offset += size;
++
++		/*
++		 * Don't bother remapping if the current entry header and the
++		 * next one end on the same page.
++		 */
++		next_entry = (void *)((unsigned long)mokvar_entry + size);
++		if (((((unsigned long)(mokvar_entry + 1) - 1) ^
++		      ((unsigned long)(next_entry + 1) - 1)) & PAGE_MASK) == 0) {
++			mokvar_entry = next_entry;
++			goto next;
++		}
+ 	}
+ 
+ 	if (va)
+-- 
+2.53.0
+

diff --git a/queue-5.10/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-5.10/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..94e2078
--- /dev/null
+++ b/queue-5.10/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From bfccb09fdb85e91114583e1ea9e7d6a2315485ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 1a6c8ebc32e16..2b088418259b0 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -727,7 +727,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%02x%02x%02x%02x\n",
+-- 
+2.53.0
+

diff --git a/queue-5.10/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-5.10/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..938ab20
--- /dev/null
+++ b/queue-5.10/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 07496096fbb353f30eaac1595383c8592732a58b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 212433eb6cc31..7794e5cf550fc 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-5.10/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch b/queue-5.10/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
new file mode 100644
index 0000000..bcc3f29
--- /dev/null
+++ b/queue-5.10/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch

@@ -0,0 +1,58 @@
+From 62e679f2c3cbd2fdede11c97fbab3d439930aff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Jun 2025 21:33:53 -0400
+Subject: media: dvb-frontends: w7090p: fix null-ptr-deref in
+ w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
+
+From: Alex Guo <alexguo1023@gmail.com>
+
+[ Upstream commit ed0234c8458b3149f15e496b48a1c9874dd24a1b ]
+
+In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add
+check on msg[0].len to prevent crash.
+
+Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
+
+Signed-off-by: Alex Guo <alexguo1023@gmail.com>
+Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index a4d060fb1babd..18b48a3984291 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2198,7 +2198,11 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
+ 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ 	u8 n_overflow = 1;
+ 	u16 i = 1000;
+-	u16 serpar_num = msg[0].buf[0];
++	u16 serpar_num;
++
++	if (msg[0].len < 3)
++		return -EOPNOTSUPP;
++	serpar_num = msg[0].buf[0];
+ 
+ 	while (n_overflow == 1 && i) {
+ 		n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+@@ -2217,9 +2221,13 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
+ 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ 	u8 n_overflow = 1, n_empty = 1;
+ 	u16 i = 1000;
+-	u16 serpar_num = msg[0].buf[0];
++	u16 serpar_num;
+ 	u16 read_word;
+ 
++	if (msg[0].len < 1 || msg[1].len < 2)
++		return -EOPNOTSUPP;
++	serpar_num = msg[0].buf[0];
++
+ 	while (n_overflow == 1 && i) {
+ 		n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+ 		i--;
+-- 
+2.53.0
+

diff --git a/queue-5.10/revert-btrfs-fix-transaction-abort-on-set-received-i.patch b/queue-5.10/revert-btrfs-fix-transaction-abort-on-set-received-i.patch
new file mode 100644
index 0000000..6c4c643
--- /dev/null
+++ b/queue-5.10/revert-btrfs-fix-transaction-abort-on-set-received-i.patch

@@ -0,0 +1,127 @@
+From bfe3c6804c83ddaade6f882277e363dadd75ac0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 08:55:23 -0400
+Subject: Revert "btrfs: fix transaction abort on set received ioctl due to
+ item overflow"
+
+This reverts commit 20b9a8d6f7ff4dc7dff3fdcba51730caa536a2de.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h     |  2 --
+ fs/btrfs/ioctl.c     | 21 ++------------------
+ fs/btrfs/uuid-tree.c | 46 --------------------------------------------
+ 3 files changed, 2 insertions(+), 67 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 15affee7c6d11..a9926fb10c491 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2869,8 +2869,6 @@ int btrfs_uuid_tree_add(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ 			u64 subid);
+ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ 			u64 subid);
+-int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
+-				   u8 *uuid, u8 type);
+ int btrfs_uuid_tree_iterate(struct btrfs_fs_info *fs_info);
+ 
+ /* dir-item.c */
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3712396c3f8a0..574a00db258a0 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4486,25 +4486,6 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ 		goto out;
+ 	}
+ 
+-	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
+-				       BTRFS_UUID_SIZE);
+-
+-	/*
+-	 * Before we attempt to add the new received uuid, check if we have room
+-	 * for it in case there's already an item. If the size of the existing
+-	 * item plus this root's ID (u64) exceeds the maximum item size, we can
+-	 * return here without the need to abort a transaction. If we don't do
+-	 * this check, the btrfs_uuid_tree_add() call below would fail with
+-	 * -EOVERFLOW and result in a transaction abort. Malicious users could
+-	 * exploit this to turn the fs into RO mode.
+-	 */
+-	if (received_uuid_changed && !btrfs_is_empty_uuid(sa->uuid)) {
+-		ret = btrfs_uuid_tree_check_overflow(fs_info, sa->uuid,
+-						     BTRFS_UUID_KEY_RECEIVED_SUBVOL);
+-		if (ret < 0)
+-			goto out;
+-	}
+-
+ 	/*
+ 	 * 1 - root item
+ 	 * 2 - uuid items (received uuid + subvol uuid)
+@@ -4520,6 +4501,8 @@ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+ 	sa->rtime.sec = ct.tv_sec;
+ 	sa->rtime.nsec = ct.tv_nsec;
+ 
++	received_uuid_changed = memcmp(root_item->received_uuid, sa->uuid,
++				       BTRFS_UUID_SIZE);
+ 	if (received_uuid_changed &&
+ 	    !btrfs_is_empty_uuid(root_item->received_uuid)) {
+ 		ret = btrfs_uuid_tree_remove(trans, root_item->received_uuid,
+diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c
+index aee89c7293f65..28525ad7ff8cb 100644
+--- a/fs/btrfs/uuid-tree.c
++++ b/fs/btrfs/uuid-tree.c
+@@ -226,52 +226,6 @@ int btrfs_uuid_tree_remove(struct btrfs_trans_handle *trans, u8 *uuid, u8 type,
+ 	return ret;
+ }
+ 
+-/*
+- * Check if we can add one root ID to a UUID key.
+- * If the key does not yet exists, we can, otherwise only if extended item does
+- * not exceeds the maximum item size permitted by the leaf size.
+- *
+- * Returns 0 on success, negative value on error.
+- */
+-int btrfs_uuid_tree_check_overflow(struct btrfs_fs_info *fs_info,
+-				   u8 *uuid, u8 type)
+-{
+-	struct btrfs_path *path = NULL;
+-	int ret;
+-	u32 item_size;
+-	struct btrfs_key key;
+-
+-	if (WARN_ON_ONCE(!fs_info->uuid_root)) {
+-		ret = -EINVAL;
+-		goto out;
+-	}
+-
+-	path = btrfs_alloc_path();
+-	if (!path) {
+-		ret = -ENOMEM;
+-		goto out;
+-	}
+-
+-	btrfs_uuid_to_key(uuid, type, &key);
+-	ret = btrfs_search_slot(NULL, fs_info->uuid_root, &key, path, 0, 0);
+-	if (ret < 0)
+-		goto out;
+-	if (ret > 0) {
+-		ret = 0;
+-		goto out;
+-	}
+-
+-	item_size = btrfs_item_size(path->nodes[0], path->slots[0]);
+-
+-	if (sizeof(struct btrfs_item) + item_size + sizeof(u64) >
+-	    BTRFS_LEAF_DATA_SIZE(fs_info))
+-		ret = -EOVERFLOW;
+-
+-out:
+-	btrfs_free_path(path);
+-	return ret;
+-}
+-
+ static int btrfs_uuid_iter_rem(struct btrfs_root *uuid_root, u8 *uuid, u8 type,
+ 			       u64 subid)
+ {
+-- 
+2.53.0
+

diff --git a/queue-5.10/revert-drm-vmwgfx-add-seqno-waiter-for-sync_files.patch b/queue-5.10/revert-drm-vmwgfx-add-seqno-waiter-for-sync_files.patch
new file mode 100644
index 0000000..1f3a5db
--- /dev/null
+++ b/queue-5.10/revert-drm-vmwgfx-add-seqno-waiter-for-sync_files.patch

@@ -0,0 +1,59 @@
+From e10d488d35b51e42677b371088bdd8901edc34e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 09:44:24 -0400
+Subject: Revert "drm/vmwgfx: Add seqno waiter for sync_files"
+
+This reverts commit 7db6c88bb52f3b7525a06110cfd208990c49f8b4.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 26 -------------------------
+ 1 file changed, 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 361f96d09374d..daea547704ddc 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -4039,23 +4039,6 @@ static int vmw_execbuf_tie_context(struct vmw_private *dev_priv,
+ 	return 0;
+ }
+ 
+-/*
+- * DMA fence callback to remove a seqno_waiter
+- */
+-struct seqno_waiter_rm_context {
+-	struct dma_fence_cb base;
+-	struct vmw_private *dev_priv;
+-};
+-
+-static void seqno_waiter_rm_cb(struct dma_fence *f, struct dma_fence_cb *cb)
+-{
+-	struct seqno_waiter_rm_context *ctx =
+-		container_of(cb, struct seqno_waiter_rm_context, base);
+-
+-	vmw_seqno_waiter_remove(ctx->dev_priv);
+-	kfree(ctx);
+-}
+-
+ int vmw_execbuf_process(struct drm_file *file_priv,
+ 			struct vmw_private *dev_priv,
+ 			void __user *user_commands, void *kernel_commands,
+@@ -4249,15 +4232,6 @@ int vmw_execbuf_process(struct drm_file *file_priv,
+ 		} else {
+ 			/* Link the fence with the FD created earlier */
+ 			fd_install(out_fence_fd, sync_file->file);
+-			struct seqno_waiter_rm_context *ctx =
+-				kmalloc(sizeof(*ctx), GFP_KERNEL);
+-			ctx->dev_priv = dev_priv;
+-			vmw_seqno_waiter_add(dev_priv);
+-			if (dma_fence_add_callback(&fence->base, &ctx->base,
+-						   seqno_waiter_rm_cb) < 0) {
+-				vmw_seqno_waiter_remove(dev_priv);
+-				kfree(ctx);
+-			}
+ 		}
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.10/revert-media-dvb-frontends-w7090p-fix-null-ptr-deref.patch b/queue-5.10/revert-media-dvb-frontends-w7090p-fix-null-ptr-deref.patch
new file mode 100644
index 0000000..11fece5
--- /dev/null
+++ b/queue-5.10/revert-media-dvb-frontends-w7090p-fix-null-ptr-deref.patch

@@ -0,0 +1,38 @@
+From 1486ed19c7f53899f7b16bec0e3e857377113bbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 10:40:26 -0400
+Subject: Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in
+ w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
+
+This reverts commit b3d77a3fc71c084575d3df4ec6544b3fb6ce587d.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/dib7000p.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
+index 08b3ac8ff1083..a4d060fb1babd 100644
+--- a/drivers/media/dvb-frontends/dib7000p.c
++++ b/drivers/media/dvb-frontends/dib7000p.c
+@@ -2198,8 +2198,6 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
+ 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ 	u8 n_overflow = 1;
+ 	u16 i = 1000;
+-	if (msg[0].len < 3)
+-		return -EOPNOTSUPP;
+ 	u16 serpar_num = msg[0].buf[0];
+ 
+ 	while (n_overflow == 1 && i) {
+@@ -2219,8 +2217,6 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
+ 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
+ 	u8 n_overflow = 1, n_empty = 1;
+ 	u16 i = 1000;
+-	if (msg[0].len < 1 || msg[1].len < 2)
+-		return -EOPNOTSUPP;
+ 	u16 serpar_num = msg[0].buf[0];
+ 	u16 read_word;
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.10/revert-scsi-core-wake-up-the-error-handler-when-fina.patch b/queue-5.10/revert-scsi-core-wake-up-the-error-handler-when-fina.patch
new file mode 100644
index 0000000..6bcdb13
--- /dev/null
+++ b/queue-5.10/revert-scsi-core-wake-up-the-error-handler-when-fina.patch

@@ -0,0 +1,62 @@
+From 9632149df503f37834581279a5bada1c4cc3f5ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Apr 2026 10:26:40 -0400
+Subject: Revert "scsi: core: Wake up the error handler when final completions
+ race against each other"
+
+This reverts commit cc872e35c0df80062abc71268d690a2f749e542e.
+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_error.c | 11 +----------
+ drivers/scsi/scsi_lib.c   |  8 --------
+ 2 files changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index 4e9114f069832..ffc6f3031e82b 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -241,20 +241,11 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
+ {
+ 	struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+ 	struct Scsi_Host *shost = scmd->device->host;
+-	unsigned int busy;
++	unsigned int busy = scsi_host_busy(shost);
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(shost->host_lock, flags);
+ 	shost->host_failed++;
+-	spin_unlock_irqrestore(shost->host_lock, flags);
+-	/*
+-	 * The counting of busy requests needs to occur after adding to
+-	 * host_failed or after the lock acquire for adding to host_failed
+-	 * to prevent a race with host unbusy and missing an eh wakeup.
+-	 */
+-	busy = scsi_host_busy(shost);
+-
+-	spin_lock_irqsave(shost->host_lock, flags);
+ 	scsi_eh_wakeup(shost, busy);
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
+ }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 8d570632982f3..fb48d47e9183e 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -310,14 +310,6 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+ 	rcu_read_lock();
+ 	__clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
+ 	if (unlikely(scsi_host_in_recovery(shost))) {
+-		/*
+-		 * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
+-		 * other CPUs before counting busy requests. Otherwise,
+-		 * reordering can cause CPUs to race and miss an eh wakeup
+-		 * when no CPU sees all busy requests as done or timed out.
+-		 */
+-		smp_mb();
+-
+ 		unsigned int busy = scsi_host_busy(shost);
+ 
+ 		spin_lock_irqsave(shost->host_lock, flags);
+-- 
+2.53.0
+

diff --git a/queue-5.10/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-5.10/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..22df416
--- /dev/null
+++ b/queue-5.10/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From e5721662a492a05259c70b35ea6884ecac92f1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.10/scsi-core-wake-up-the-error-handler-when-final-compl.patch b/queue-5.10/scsi-core-wake-up-the-error-handler-when-final-compl.patch
new file mode 100644
index 0000000..e645940
--- /dev/null
+++ b/queue-5.10/scsi-core-wake-up-the-error-handler-when-final-compl.patch

@@ -0,0 +1,99 @@
+From ab5cf50f7aa60abae478128bb0ec72bd4349b375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Jan 2026 11:08:13 -0500
+Subject: scsi: core: Wake up the error handler when final completions race
+ against each other
+
+From: David Jeffery <djeffery@redhat.com>
+
+[ Upstream commit fe2f8ad6f0999db3b318359a01ee0108c703a8c3 ]
+
+The fragile ordering between marking commands completed or failed so
+that the error handler only wakes when the last running command
+completes or times out has race conditions. These race conditions can
+cause the SCSI layer to fail to wake the error handler, leaving I/O
+through the SCSI host stuck as the error state cannot advance.
+
+First, there is an memory ordering issue within scsi_dec_host_busy().
+The write which clears SCMD_STATE_INFLIGHT may be reordered with reads
+counting in scsi_host_busy(). While the local CPU will see its own
+write, reordering can allow other CPUs in scsi_dec_host_busy() or
+scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to
+see a host busy equal to the host_failed count.
+
+This race condition can be prevented with a memory barrier on the error
+path to force the write to be visible before counting host busy
+commands.
+
+Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By
+counting busy commands before incrementing host_failed, it can race with a
+final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does
+not see host_failed incremented but scsi_eh_inc_host_failed() counts busy
+commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),
+resulting in neither waking the error handler task.
+
+This needs the call to scsi_host_busy() to be moved after host_failed is
+incremented to close the race condition.
+
+Fixes: 6eb045e092ef ("scsi: core: avoid host-wide host_busy counter for scsi_mq")
+Signed-off-by: David Jeffery <djeffery@redhat.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://patch.msgid.link/20260113161036.6730-1-djeffery@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_error.c | 11 ++++++++++-
+ drivers/scsi/scsi_lib.c   | 11 ++++++++++-
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index ffc6f3031e82b..4e9114f069832 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -241,11 +241,20 @@ static void scsi_eh_inc_host_failed(struct rcu_head *head)
+ {
+ 	struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu);
+ 	struct Scsi_Host *shost = scmd->device->host;
+-	unsigned int busy = scsi_host_busy(shost);
++	unsigned int busy;
+ 	unsigned long flags;
+ 
+ 	spin_lock_irqsave(shost->host_lock, flags);
+ 	shost->host_failed++;
++	spin_unlock_irqrestore(shost->host_lock, flags);
++	/*
++	 * The counting of busy requests needs to occur after adding to
++	 * host_failed or after the lock acquire for adding to host_failed
++	 * to prevent a race with host unbusy and missing an eh wakeup.
++	 */
++	busy = scsi_host_busy(shost);
++
++	spin_lock_irqsave(shost->host_lock, flags);
+ 	scsi_eh_wakeup(shost, busy);
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
+ }
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index fb48d47e9183e..e69d1c0ea4507 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -310,7 +310,16 @@ static void scsi_dec_host_busy(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
+ 	rcu_read_lock();
+ 	__clear_bit(SCMD_STATE_INFLIGHT, &cmd->state);
+ 	if (unlikely(scsi_host_in_recovery(shost))) {
+-		unsigned int busy = scsi_host_busy(shost);
++		unsigned int busy;
++		/*
++		 * Ensure the clear of SCMD_STATE_INFLIGHT is visible to
++		 * other CPUs before counting busy requests. Otherwise,
++		 * reordering can cause CPUs to race and miss an eh wakeup
++		 * when no CPU sees all busy requests as done or timed out.
++		 */
++		smp_mb();
++
++		busy = scsi_host_busy(shost);
+ 
+ 		spin_lock_irqsave(shost->host_lock, flags);
+ 		if (shost->host_failed || shost->host_eh_scheduled)
+-- 
+2.53.0
+

diff --git a/queue-5.10/series b/queue-5.10/series
index aef9bdc..3459bca 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series

@@ -353,3 +353,15 @@
 net-sched-cls_fw-fix-null-pointer-dereference-on-sha.patch
 net-sched-cls_flow-fix-null-pointer-dereference-on-s.patch
 ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
+efi-mokvar-table-avoid-repeated-map-unmap-of-the-sam.patch
+revert-btrfs-fix-transaction-abort-on-set-received-i.patch
+btrfs-fix-transaction-abort-on-set-received-ioctl-du.patch
+revert-drm-vmwgfx-add-seqno-waiter-for-sync_files.patch
+drm-vmwgfx-add-seqno-waiter-for-sync_files.patch-18451
+revert-scsi-core-wake-up-the-error-handler-when-fina.patch
+scsi-core-wake-up-the-error-handler-when-final-compl.patch
+revert-media-dvb-frontends-w7090p-fix-null-ptr-deref.patch
+media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch

diff --git a/queue-5.15/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-5.15/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..7c093d2
--- /dev/null
+++ b/queue-5.15/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From a79c14b58ea2736af2a1d455de64dd237f4dcf35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 44007858c23fc..f178cb16b28cb 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -724,7 +724,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%02x%02x%02x%02x\n",
+-- 
+2.53.0
+

diff --git a/queue-5.15/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-5.15/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..16a12db
--- /dev/null
+++ b/queue-5.15/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 31161ebaad51a826731789ab4cedb64adf80a05f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 52bee5de29883..12d5d7297b5c9 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-5.15/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-5.15/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..5c5651f
--- /dev/null
+++ b/queue-5.15/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From be4170d4ca365e32a765cca143c4c55c454bc10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 81b9d813655ad..de91996886dbb 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.15/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-5.15/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..404328c
--- /dev/null
+++ b/queue-5.15/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From bdc17f5b7295c20f60d51794ad0bc756d4b21e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-5.15/series b/queue-5.15/series
index 029c143..cd2bc97 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series

@@ -436,3 +436,7 @@
 net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
 ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
 bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch

diff --git a/queue-6.1/dt-bindings-gpio-fix-microchip-interrupt-cells.patch b/queue-6.1/dt-bindings-gpio-fix-microchip-interrupt-cells.patch
new file mode 100644
index 0000000..16645ba
--- /dev/null
+++ b/queue-6.1/dt-bindings-gpio-fix-microchip-interrupt-cells.patch

@@ -0,0 +1,47 @@
+From da559aea5d96b8b46fde45c74687671323c3a112 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml         | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d481e78958a74..2c7355e9547a1 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -33,7 +33,7 @@ properties:
+     const: 2
+ 
+   "#interrupt-cells":
+-    const: 1
++    const: 2
+ 
+   ngpios:
+     description:
+@@ -84,7 +84,7 @@ examples:
+         gpio-controller;
+         #gpio-cells = <2>;
+         interrupt-controller;
+-        #interrupt-cells = <1>;
++        #interrupt-cells = <2>;
+         interrupts = <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+-- 
+2.53.0
+

diff --git a/queue-6.1/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-6.1/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..40d7a91
--- /dev/null
+++ b/queue-6.1/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From 4430acd035dab1b63979a9f5a23a0ae460653784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 755926fa0bf7d..c6a78436e9bba 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%4phN\n", extn->name);
+-- 
+2.53.0
+

diff --git a/queue-6.1/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-6.1/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..054482a
--- /dev/null
+++ b/queue-6.1/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 8597163006b29dc493b8347a81ce9c114c73cfa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 52bee5de29883..12d5d7297b5c9 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-6.1/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-6.1/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..799847a
--- /dev/null
+++ b/queue-6.1/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From 04c6e51b5b691c6510f6b9bd25d5d82320161696 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 81b9d813655ad..de91996886dbb 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.1/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch b/queue-6.1/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
new file mode 100644
index 0000000..b1e6877
--- /dev/null
+++ b/queue-6.1/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch

@@ -0,0 +1,43 @@
+From 94fd11083f647d1450e58d9c1fa90077f85c7869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 98f17c29da69b..7b58b418b8a8b 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG	0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG	0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG	0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG			0x34
+ #define BNO055_CALIB_STAT_REG		0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+-- 
+2.53.0
+

diff --git a/queue-6.1/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-6.1/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..39150df
--- /dev/null
+++ b/queue-6.1/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From 4b03c93ef1a41391e46322af5f7bdd41e5aaaf88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 1d83b36967212..eb737c7a563b9 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -194,7 +194,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -263,8 +263,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.1/series b/queue-6.1/series
index c467381..aaf8889 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series

@@ -189,3 +189,9 @@
 net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
 ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
 bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch

diff --git a/queue-6.12/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch b/queue-6.12/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
new file mode 100644
index 0000000..ada3419
--- /dev/null
+++ b/queue-6.12/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch

@@ -0,0 +1,111 @@
+From 77a9f24f2e2627e8afd04af19bd8419b92678b1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index b86a8e48e731b..8eae30fe14f98 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ 		 */
+ 		return -ENODEV;
+ 
+-	if (status) {
++	if (usr && status) {
+ 		/*
+ 		 * Releasing resources failed on the device side, which puts
+ 		 * us in a bind since they may still be in use, so enable the
+@@ -1105,6 +1105,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ 	mutex_lock(&qdev->cntl_mutex);
+ 	if (!list_empty(&elem.list))
+ 		list_del(&elem.list);
++	/* resp_worker() processed the response but the wait was interrupted */
++	else if (ret == -ERESTARTSYS)
++		ret = 0;
+ 	if (!ret && !elem.buf)
+ 		ret = -ETIMEDOUT;
+ 	else if (ret > 0 && !elem.buf)
+@@ -1415,9 +1418,49 @@ static void resp_worker(struct work_struct *work)
+ 	}
+ 	mutex_unlock(&qdev->cntl_mutex);
+ 
+-	if (!found)
++	if (!found) {
++		/*
++		 * The user might have gone away at this point without waiting
++		 * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++		 * the device. If this is not handled correctly, the host will
++		 * not know that the DBC[n] has been freed on the device.
++		 * Due to this failure in synchronization between the device and
++		 * the host, if another user requests to activate a network, and
++		 * the device assigns DBC[n] again, save_dbc_buf() will hang,
++		 * waiting for dbc[n]->in_use to be set to false, which will not
++		 * happen unless the qaic_dev_reset_clean_local_state() gets
++		 * called by resetting the device (or re-inserting the module).
++		 *
++		 * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++		 * transactions in the message before disposing of it, then
++		 * handle releasing the DBC resources.
++		 *
++		 * Since the user has gone away, if the device could not
++		 * deactivate the network (status != 0), there is no way to
++		 * enable and reassign the DBC to the user. We can put trust in
++		 * the device that it will release all the active DBCs in
++		 * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++		 * otherwise, the user can issue an soc_reset to the device.
++		 */
++		u32 msg_count = le32_to_cpu(msg->hdr.count);
++		u32 msg_len = le32_to_cpu(msg->hdr.len);
++		u32 len = 0;
++		int j;
++
++		for (j = 0; j < msg_count && len < msg_len; ++j) {
++			struct wire_trans_hdr *trans_hdr;
++
++			trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++			if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++				if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++					len += le32_to_cpu(trans_hdr->len);
++			} else {
++				len += le32_to_cpu(trans_hdr->len);
++			}
++		}
+ 		/* request must have timed out, drop packet */
+ 		kfree(msg);
++	}
+ 
+ 	kfree(resp);
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.12/dt-bindings-gpio-fix-microchip-interrupt-cells.patch b/queue-6.12/dt-bindings-gpio-fix-microchip-interrupt-cells.patch
new file mode 100644
index 0000000..8271784
--- /dev/null
+++ b/queue-6.12/dt-bindings-gpio-fix-microchip-interrupt-cells.patch

@@ -0,0 +1,47 @@
+From 93b23055139428192e95f78d236a875cafee6e74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml         | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d78da7dd2a566..dafd80bdd23aa 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -34,7 +34,7 @@ properties:
+     const: 2
+ 
+   "#interrupt-cells":
+-    const: 1
++    const: 2
+ 
+   ngpios:
+     description:
+@@ -83,7 +83,7 @@ examples:
+         gpio-controller;
+         #gpio-cells = <2>;
+         interrupt-controller;
+-        #interrupt-cells = <1>;
++        #interrupt-cells = <2>;
+         interrupts = <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+-- 
+2.53.0
+

diff --git a/queue-6.12/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch b/queue-6.12/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
new file mode 100644
index 0000000..3b20ee1
--- /dev/null
+++ b/queue-6.12/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch

@@ -0,0 +1,35 @@
+From a730f9477a4942dcd752149b9452d2be986605d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+-- 
+2.53.0
+

diff --git a/queue-6.12/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-6.12/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..7794e6e
--- /dev/null
+++ b/queue-6.12/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From 0055f19461abea51f48ec8f3a8fe75214087da4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%4phN\n", extn->name);
+-- 
+2.53.0
+

diff --git a/queue-6.12/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-6.12/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..0a20791
--- /dev/null
+++ b/queue-6.12/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 8d0072cdbeae86c939494a4664a5f3d4e7f436dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 5ac476d3cdd2a..4cf98ffae841c 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-6.12/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-6.12/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..3ac8b6b
--- /dev/null
+++ b/queue-6.12/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From 8c0eb4be14f5e5d59d2c7a4b8e44fc69a11e49d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 5c9466244d70d..ecc1be33b3b1b 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.12/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch b/queue-6.12/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
new file mode 100644
index 0000000..430233e
--- /dev/null
+++ b/queue-6.12/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch

@@ -0,0 +1,43 @@
+From d3e78dd6236955258ee81d58ab1124e1a06915eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 0b2d6ad699f30..932821254bf89 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG	0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG	0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG	0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG			0x34
+ #define BNO055_CALIB_STAT_REG		0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+-- 
+2.53.0
+

diff --git a/queue-6.12/mips-ralink-update-cpu-clock-index.patch b/queue-6.12/mips-ralink-update-cpu-clock-index.patch
new file mode 100644
index 0000000..9eccd07
--- /dev/null
+++ b/queue-6.12/mips-ralink-update-cpu-clock-index.patch

@@ -0,0 +1,49 @@
+From 74940713c49e293fce31ad1eac6cde60f506fe26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ 	switch (ralink_soc) {
+ 	case RT2880_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt2880-sysc";
+ 	case RT3883_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3883-sysc";
+ 	case RT305X_SOC_RT3050:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3050-sysc";
+ 	case RT305X_SOC_RT3052:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3052-sysc";
+ 	case RT305X_SOC_RT3350:
+ 		*idx = 1;
+-- 
+2.53.0
+

diff --git a/queue-6.12/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-6.12/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..da5a597
--- /dev/null
+++ b/queue-6.12/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From ce6733647d60ccaba762b60ddcd0c9c7a09ff4d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 9f3db3503dabd..edaab2aa16a3e 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.12/sched-fair-fix-zero_vruntime-tracking-fix.patch b/queue-6.12/sched-fair-fix-zero_vruntime-tracking-fix.patch
new file mode 100644
index 0000000..a3cfe1b
--- /dev/null
+++ b/queue-6.12/sched-fair-fix-zero_vruntime-tracking-fix.patch

@@ -0,0 +1,103 @@
+From b74fe4717c0c335e3c0efe9446f946842b3cd4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index fff27f3378cbf..a0a47e50b71ca 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -669,7 +669,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+  * Called in:
+  *  - place_entity()      -- before enqueue
+  *  - update_entity_lag() -- before dequeue
+- *  - entity_tick()
++ *  - update_deadline()   -- slice expiration
+  *
+  * This means it is one entry 'behind' but that puts it close enough to where
+  * the bound on entity_key() is at most two lag bounds.
+@@ -1036,6 +1036,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ 	 * EEVDF: vd_i = ve_i + r_i / w_i
+ 	 */
+ 	se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++	avg_vruntime(cfs_rq);
+ 
+ 	/*
+ 	 * The task has consumed its request, reschedule.
+@@ -5725,11 +5726,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ 	update_load_avg(cfs_rq, curr, UPDATE_TG);
+ 	update_cfs_group(curr);
+ 
+-	/*
+-	 * Pulls along cfs_rq::zero_vruntime.
+-	 */
+-	avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ 	/*
+ 	 * queued ticks are scheduled to match the slice, so don't bother
+@@ -9143,7 +9139,7 @@ static void yield_task_fair(struct rq *rq)
+ 	 */
+ 	if (entity_eligible(cfs_rq, se)) {
+ 		se->vruntime = se->deadline;
+-		se->deadline += calc_delta_fair(se->slice, se);
++		update_deadline(cfs_rq, se);
+ 	}
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.12/sched-fair-use-protect_slice-instead-of-direct-compa.patch b/queue-6.12/sched-fair-use-protect_slice-instead-of-direct-compa.patch
new file mode 100644
index 0000000..a61d042
--- /dev/null
+++ b/queue-6.12/sched-fair-use-protect_slice-instead-of-direct-compa.patch

@@ -0,0 +1,37 @@
+From 53aaf3f310af379ed4c9f06452007c748c185cd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jul 2025 18:56:25 +0200
+Subject: sched/fair: Use protect_slice() instead of direct comparison
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit 9cdb4fe20cd239c848b5c3f5753d83a9443ba329 ]
+
+Replace the test by the relevant protect_slice() function.
+
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dhaval Giani (AMD) <dhaval@gianis.ca>
+Link: https://lkml.kernel.org/r/20250708165630.1948751-2-vincent.guittot@linaro.org
+Stable-dep-of: 1319ea57529e ("sched/fair: Fix zero_vruntime tracking fix")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index efd3cbefb5a22..fff27f3378cbf 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1181,7 +1181,7 @@ static inline bool did_preempt_short(struct cfs_rq *cfs_rq, struct sched_entity
+ 	if (!sched_feat(PREEMPT_SHORT))
+ 		return false;
+ 
+-	if (curr->vlag == curr->deadline)
++	if (protect_slice(curr))
+ 		return false;
+ 
+ 	return !entity_eligible(cfs_rq, curr);
+-- 
+2.53.0
+

diff --git a/queue-6.12/series b/queue-6.12/series
index cff16e5..5c665d6 100644
--- a/queue-6.12/series
+++ b/queue-6.12/series

@@ -105,3 +105,14 @@
 ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
 bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
 revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-use-protect_slice-instead-of-direct-compa.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch

diff --git a/queue-6.18/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch b/queue-6.18/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
new file mode 100644
index 0000000..5987410
--- /dev/null
+++ b/queue-6.18/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch

@@ -0,0 +1,111 @@
+From f5319f8ccd21f394655901ae5f76b6135f790a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index b86a8e48e731b..8eae30fe14f98 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ 		 */
+ 		return -ENODEV;
+ 
+-	if (status) {
++	if (usr && status) {
+ 		/*
+ 		 * Releasing resources failed on the device side, which puts
+ 		 * us in a bind since they may still be in use, so enable the
+@@ -1105,6 +1105,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ 	mutex_lock(&qdev->cntl_mutex);
+ 	if (!list_empty(&elem.list))
+ 		list_del(&elem.list);
++	/* resp_worker() processed the response but the wait was interrupted */
++	else if (ret == -ERESTARTSYS)
++		ret = 0;
+ 	if (!ret && !elem.buf)
+ 		ret = -ETIMEDOUT;
+ 	else if (ret > 0 && !elem.buf)
+@@ -1415,9 +1418,49 @@ static void resp_worker(struct work_struct *work)
+ 	}
+ 	mutex_unlock(&qdev->cntl_mutex);
+ 
+-	if (!found)
++	if (!found) {
++		/*
++		 * The user might have gone away at this point without waiting
++		 * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++		 * the device. If this is not handled correctly, the host will
++		 * not know that the DBC[n] has been freed on the device.
++		 * Due to this failure in synchronization between the device and
++		 * the host, if another user requests to activate a network, and
++		 * the device assigns DBC[n] again, save_dbc_buf() will hang,
++		 * waiting for dbc[n]->in_use to be set to false, which will not
++		 * happen unless the qaic_dev_reset_clean_local_state() gets
++		 * called by resetting the device (or re-inserting the module).
++		 *
++		 * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++		 * transactions in the message before disposing of it, then
++		 * handle releasing the DBC resources.
++		 *
++		 * Since the user has gone away, if the device could not
++		 * deactivate the network (status != 0), there is no way to
++		 * enable and reassign the DBC to the user. We can put trust in
++		 * the device that it will release all the active DBCs in
++		 * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++		 * otherwise, the user can issue an soc_reset to the device.
++		 */
++		u32 msg_count = le32_to_cpu(msg->hdr.count);
++		u32 msg_len = le32_to_cpu(msg->hdr.len);
++		u32 len = 0;
++		int j;
++
++		for (j = 0; j < msg_count && len < msg_len; ++j) {
++			struct wire_trans_hdr *trans_hdr;
++
++			trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++			if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++				if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++					len += le32_to_cpu(trans_hdr->len);
++			} else {
++				len += le32_to_cpu(trans_hdr->len);
++			}
++		}
+ 		/* request must have timed out, drop packet */
+ 		kfree(msg);
++	}
+ 
+ 	kfree(resp);
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.18/acpi-rimt-add-dependency-between-iommu-and-devices.patch b/queue-6.18/acpi-rimt-add-dependency-between-iommu-and-devices.patch
new file mode 100644
index 0000000..57dbe91
--- /dev/null
+++ b/queue-6.18/acpi-rimt-add-dependency-between-iommu-and-devices.patch

@@ -0,0 +1,44 @@
+From ebb6341ca64853ce0c6093f4d98d19a8b0e795c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 11:46:05 +0530
+Subject: ACPI: RIMT: Add dependency between iommu and devices
+
+From: Sunil V L <sunilvl@oss.qualcomm.com>
+
+[ Upstream commit 9156585280f161fc1c3552cf1860559edb2bb7e3 ]
+
+EPROBE_DEFER ensures IOMMU devices are probed before the devices that
+depend on them. During shutdown, however, the IOMMU may be removed
+first, leading to issues. To avoid this, a device link is added
+which enforces the correct removal order.
+
+Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT")
+Signed-off-by: Sunil V L <sunilvl@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/riscv/rimt.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/riscv/rimt.c b/drivers/acpi/riscv/rimt.c
+index 7f423405e5ef0..8eaa8731bddd6 100644
+--- a/drivers/acpi/riscv/rimt.c
++++ b/drivers/acpi/riscv/rimt.c
+@@ -263,6 +263,13 @@ static int rimt_iommu_xlate(struct device *dev, struct acpi_rimt_node *node, u32
+ 	if (!rimt_fwnode)
+ 		return -EPROBE_DEFER;
+ 
++	/*
++	 * EPROBE_DEFER ensures IOMMU is probed before the devices that
++	 * depend on them. During shutdown, however, the IOMMU may be removed
++	 * first, leading to issues. To avoid this, a device link is added
++	 * which enforces the correct removal order.
++	 */
++	device_link_add(dev, rimt_fwnode->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+ 	return acpi_iommu_fwspec_init(dev, deviceid, rimt_fwnode);
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch b/queue-6.18/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
new file mode 100644
index 0000000..e8ca1f1
--- /dev/null
+++ b/queue-6.18/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch

@@ -0,0 +1,96 @@
+From 7587f6c0f8ee45faa1f6905c798b1fded99b87d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2026 14:46:52 +0800
+Subject: drm/sysfb: Fix efidrm error handling and memory type mismatch
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af ]
+
+Fix incorrect error checking and memory type confusion in
+efidrm_device_create(). devm_memremap() returns error pointers, not
+NULL, and returns system memory while devm_ioremap() returns I/O memory.
+The code incorrectly passes system memory to iosys_map_set_vaddr_iomem().
+
+Restructure to handle each memory type separately. Use devm_ioremap*()
+with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for
+WT/WB.
+
+Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260311064652.2903449-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sysfb/efidrm.c | 46 +++++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
+index 1883c4a8604c2..97a3711e79337 100644
+--- a/drivers/gpu/drm/sysfb/efidrm.c
++++ b/drivers/gpu/drm/sysfb/efidrm.c
+@@ -150,7 +150,6 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ 	struct drm_sysfb_device *sysfb;
+ 	struct drm_device *dev;
+ 	struct resource *mem = NULL;
+-	void __iomem *screen_base = NULL;
+ 	struct drm_plane *primary_plane;
+ 	struct drm_crtc *crtc;
+ 	struct drm_encoder *encoder;
+@@ -235,21 +234,38 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ 
+ 	mem_flags = efidrm_get_mem_flags(dev, res->start, vsize);
+ 
+-	if (mem_flags & EFI_MEMORY_WC)
+-		screen_base = devm_ioremap_wc(&pdev->dev, mem->start, resource_size(mem));
+-	else if (mem_flags & EFI_MEMORY_UC)
+-		screen_base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
+-	else if (mem_flags & EFI_MEMORY_WT)
+-		screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+-					    MEMREMAP_WT);
+-	else if (mem_flags & EFI_MEMORY_WB)
+-		screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+-					    MEMREMAP_WB);
+-	else
++	if (mem_flags & EFI_MEMORY_WC) {
++		void __iomem *screen_base = devm_ioremap_wc(&pdev->dev, mem->start,
++							    resource_size(mem));
++
++		if (!screen_base)
++			return ERR_PTR(-ENXIO);
++		iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_UC) {
++		void __iomem *screen_base = devm_ioremap(&pdev->dev, mem->start,
++							 resource_size(mem));
++
++		if (!screen_base)
++			return ERR_PTR(-ENXIO);
++		iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_WT) {
++		void *screen_base = devm_memremap(&pdev->dev, mem->start,
++						  resource_size(mem), MEMREMAP_WT);
++
++		if (IS_ERR(screen_base))
++			return ERR_CAST(screen_base);
++		iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_WB) {
++		void *screen_base = devm_memremap(&pdev->dev, mem->start,
++						  resource_size(mem), MEMREMAP_WB);
++
++		if (IS_ERR(screen_base))
++			return ERR_CAST(screen_base);
++		iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++	} else {
+ 		drm_err(dev, "invalid mem_flags: 0x%llx\n", mem_flags);
+-	if (!screen_base)
+-		return ERR_PTR(-ENOMEM);
+-	iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++		return ERR_PTR(-EINVAL);
++	}
+ 
+ 	/*
+ 	 * Modesetting
+-- 
+2.53.0
+

diff --git a/queue-6.18/drm-xe-pxp-clean-up-termination-status-on-failure.patch b/queue-6.18/drm-xe-pxp-clean-up-termination-status-on-failure.patch
new file mode 100644
index 0000000..8ef3b35
--- /dev/null
+++ b/queue-6.18/drm-xe-pxp-clean-up-termination-status-on-failure.patch

@@ -0,0 +1,43 @@
+From 734d662f41597d3c2964f06763cfa282099ac252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:20 -0700
+Subject: drm/xe/pxp: Clean up termination status on failure
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit e2628e670bb0923fcdc00828bfcd67b26a7df020 ]
+
+If the PXP HW termination fails during PXP start, the normal completion
+code won't be called, so the termination will remain uncomplete. To avoid
+unnecessary waits, mark the termination as completed from the error path.
+Note that we already do this if the termination fails when handling a
+termination irq from the HW.
+
+Fixes: f8caa80154c4 ("drm/xe/pxp: Add PXP queue tracking and session start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-7-daniele.ceraolospurio@intel.com
+(cherry picked from commit 5d9e708d2a69ab1f64a17aec810cd7c70c5b9fab)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index bdbdbbf6a6781..ba4d52001b853 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -603,6 +603,7 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ 			drm_err(&pxp->xe->drm, "PXP termination failed before start\n");
+ 			mutex_lock(&pxp->mutex);
+ 			pxp->status = XE_PXP_ERROR;
++			complete_all(&pxp->termination);
+ 
+ 			goto out_unlock;
+ 		}
+-- 
+2.53.0
+

diff --git a/queue-6.18/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch b/queue-6.18/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
new file mode 100644
index 0000000..674b8b1
--- /dev/null
+++ b/queue-6.18/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch

@@ -0,0 +1,49 @@
+From 1d4058835a4bd305bc4cfe549971864128a29299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:22 -0700
+Subject: drm/xe/pxp: Clear restart flag in pxp_start after jumping back
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 76903b2057c8677c2c006e87fede15f496555dc0 ]
+
+If we don't clear the flag we'll keep jumping back at the beginning of
+the function once we reach the end.
+
+Fixes: ccd3c6820a90 ("drm/xe/pxp: Decouple queue addition from PXP start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-9-daniele.ceraolospurio@intel.com
+(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index fdcecc026e937..9261a8412b64f 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -532,7 +532,7 @@ static int __exec_queue_add(struct xe_pxp *pxp, struct xe_exec_queue *q)
+ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ {
+ 	int ret = 0;
+-	bool restart = false;
++	bool restart;
+ 
+ 	if (!xe_pxp_is_enabled(pxp))
+ 		return -ENODEV;
+@@ -561,6 +561,8 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ 					 msecs_to_jiffies(PXP_ACTIVATION_TIMEOUT_MS)))
+ 		return -ETIMEDOUT;
+ 
++	restart = false;
++
+ 	mutex_lock(&pxp->mutex);
+ 
+ 	/* If PXP is not already active, turn it on */
+-- 
+2.53.0
+

diff --git a/queue-6.18/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch b/queue-6.18/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
new file mode 100644
index 0000000..8f0867d
--- /dev/null
+++ b/queue-6.18/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch

@@ -0,0 +1,57 @@
+From 827f4c6e8f1c3f3587a17e404930e0c1e34952cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:21 -0700
+Subject: drm/xe/pxp: Remove incorrect handling of impossible state during
+ suspend
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 4fed244954c2dc9aafa333d08f66b14345225e03 ]
+
+The default case of the PXP suspend switch is incorrectly exiting
+without releasing the lock. However, this case is impossible to hit
+because we're switching on an enum and all the valid enum values have
+their own cases. Therefore, we can just get rid of the default case
+and rely on the compiler to warn us if a new enum value is added and
+we forget to add it to the switch.
+
+Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-8-daniele.ceraolospurio@intel.com
+(cherry picked from commit f1b5a77fc9b6a90cd9a5e3db9d4c73ae1edfcfac)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index ba4d52001b853..fdcecc026e937 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -891,11 +891,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ 		pxp->key_instance++;
+ 		needs_queue_inval = true;
+ 		break;
+-	default:
+-		drm_err(&pxp->xe->drm, "unexpected state during PXP suspend: %u",
+-			pxp->status);
+-		ret = -EIO;
+-		goto out;
+ 	}
+ 
+ 	/*
+@@ -920,7 +915,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ 
+ 	pxp->last_suspend_key_instance = pxp->key_instance;
+ 
+-out:
+ 	return ret;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/dt-bindings-gpio-fix-microchip-interrupt-cells.patch b/queue-6.18/dt-bindings-gpio-fix-microchip-interrupt-cells.patch
new file mode 100644
index 0000000..7f38ad3
--- /dev/null
+++ b/queue-6.18/dt-bindings-gpio-fix-microchip-interrupt-cells.patch

@@ -0,0 +1,47 @@
+From 5302f7d02ce0f830ce9ee1b2223f50ecc8bbdfe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml         | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d78da7dd2a566..dafd80bdd23aa 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -34,7 +34,7 @@ properties:
+     const: 2
+ 
+   "#interrupt-cells":
+-    const: 1
++    const: 2
+ 
+   ngpios:
+     description:
+@@ -83,7 +83,7 @@ examples:
+         gpio-controller;
+         #gpio-cells = <2>;
+         interrupt-controller;
+-        #interrupt-cells = <1>;
++        #interrupt-cells = <2>;
+         interrupts = <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+-- 
+2.53.0
+

diff --git a/queue-6.18/gpio-rename-gpio_chip_hwgpio-to-gpiod_hwgpio.patch b/queue-6.18/gpio-rename-gpio_chip_hwgpio-to-gpiod_hwgpio.patch
new file mode 100644
index 0000000..f906926
--- /dev/null
+++ b/queue-6.18/gpio-rename-gpio_chip_hwgpio-to-gpiod_hwgpio.patch

@@ -0,0 +1,395 @@
+From 68da4dce56260e5974879b6312a4fd9cf67e1180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Oct 2025 11:09:25 +0200
+Subject: gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit df900536e85819f6168783d5f6b3908d47811fdd ]
+
+This function takes a GPIO descriptor as first argument. Make its naming
+consistent with the rest of the GPIO codebase and use the gpiod_ prefix.
+
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
+Link: https://lore.kernel.org/r/20251016-aspeed-gpiolib-include-v1-1-31201c06d124@linaro.org
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Stable-dep-of: 6df6ea4b3d15 ("gpiolib: clear requested flag if line is invalid")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-aspeed.c   |  6 ++---
+ drivers/gpio/gpiolib-cdev.c  | 12 +++++-----
+ drivers/gpio/gpiolib-sysfs.c | 14 +++++------
+ drivers/gpio/gpiolib.c       | 46 ++++++++++++++++++------------------
+ drivers/gpio/gpiolib.h       |  2 +-
+ 5 files changed, 40 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
+index 7953a9c4e36d7..3da37a0fda3fb 100644
+--- a/drivers/gpio/gpio-aspeed.c
++++ b/drivers/gpio/gpio-aspeed.c
+@@ -24,7 +24,7 @@
+ 
+ /*
+  * These two headers aren't meant to be used by GPIO drivers. We need
+- * them in order to access gpio_chip_hwgpio() which we need to implement
++ * them in order to access gpiod_hwgpio() which we need to implement
+  * the aspeed specific API which allows the coprocessor to request
+  * access to some GPIOs and to arbitrate between coprocessor and ARM.
+  */
+@@ -942,7 +942,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc,
+ {
+ 	struct gpio_chip *chip = gpiod_to_chip(desc);
+ 	struct aspeed_gpio *gpio = gpiochip_get_data(chip);
+-	int rc = 0, bindex, offset = gpio_chip_hwgpio(desc);
++	int rc = 0, bindex, offset = gpiod_hwgpio(desc);
+ 	const struct aspeed_gpio_bank *bank = to_bank(offset);
+ 
+ 	if (!aspeed_gpio_support_copro(gpio))
+@@ -987,7 +987,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc)
+ {
+ 	struct gpio_chip *chip = gpiod_to_chip(desc);
+ 	struct aspeed_gpio *gpio = gpiochip_get_data(chip);
+-	int rc = 0, bindex, offset = gpio_chip_hwgpio(desc);
++	int rc = 0, bindex, offset = gpiod_hwgpio(desc);
+ 
+ 	if (!aspeed_gpio_support_copro(gpio))
+ 		return -EOPNOTSUPP;
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index e76bcbd647539..986312c71678f 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -676,7 +676,7 @@ static enum hte_return process_hw_ts_thread(void *p)
+ 	}
+ 	le.line_seqno = line->line_seqno;
+ 	le.seqno = (lr->num_lines == 1) ? le.line_seqno : line->req_seqno;
+-	le.offset = gpio_chip_hwgpio(line->desc);
++	le.offset = gpiod_hwgpio(line->desc);
+ 
+ 	linereq_put_event(lr, &le);
+ 
+@@ -793,7 +793,7 @@ static irqreturn_t edge_irq_thread(int irq, void *p)
+ 	line->line_seqno++;
+ 	le.line_seqno = line->line_seqno;
+ 	le.seqno = (lr->num_lines == 1) ? le.line_seqno : line->req_seqno;
+-	le.offset = gpio_chip_hwgpio(line->desc);
++	le.offset = gpiod_hwgpio(line->desc);
+ 
+ 	linereq_put_event(lr, &le);
+ 
+@@ -891,7 +891,7 @@ static void debounce_work_func(struct work_struct *work)
+ 
+ 	lr = line->req;
+ 	le.timestamp_ns = line_event_timestamp(line);
+-	le.offset = gpio_chip_hwgpio(line->desc);
++	le.offset = gpiod_hwgpio(line->desc);
+ #ifdef CONFIG_HTE
+ 	if (edflags & GPIO_V2_LINE_FLAG_EVENT_CLOCK_HTE) {
+ 		/* discard events except the last one */
+@@ -1591,7 +1591,7 @@ static void linereq_show_fdinfo(struct seq_file *out, struct file *file)
+ 
+ 	for (i = 0; i < lr->num_lines; i++)
+ 		seq_printf(out, "gpio-line:\t%d\n",
+-			   gpio_chip_hwgpio(lr->lines[i].desc));
++			   gpiod_hwgpio(lr->lines[i].desc));
+ }
+ #endif
+ 
+@@ -2244,7 +2244,7 @@ static void gpio_desc_to_lineinfo(struct gpio_desc *desc,
+ 		return;
+ 
+ 	memset(info, 0, sizeof(*info));
+-	info->offset = gpio_chip_hwgpio(desc);
++	info->offset = gpiod_hwgpio(desc);
+ 
+ 	if (desc->name)
+ 		strscpy(info->name, desc->name, sizeof(info->name));
+@@ -2550,7 +2550,7 @@ static int lineinfo_changed_notify(struct notifier_block *nb,
+ 	struct gpio_desc *desc = data;
+ 	struct file *fp;
+ 
+-	if (!test_bit(gpio_chip_hwgpio(desc), cdev->watched_lines))
++	if (!test_bit(gpiod_hwgpio(desc), cdev->watched_lines))
+ 		return NOTIFY_DONE;
+ 
+ 	/* Keep the file descriptor alive for the duration of the notification. */
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index e044690ad412b..d4a46a0a37d8f 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -244,7 +244,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)
+ 	 * Remove this redundant call (along with the corresponding unlock)
+ 	 * when those drivers have been fixed.
+ 	 */
+-	ret = gpiochip_lock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++	ret = gpiochip_lock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ 	if (ret < 0)
+ 		goto err_clr_bits;
+ 
+@@ -258,7 +258,7 @@ static int gpio_sysfs_request_irq(struct gpiod_data *data, unsigned char flags)
+ 	return 0;
+ 
+ err_unlock:
+-	gpiochip_unlock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++	gpiochip_unlock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ err_clr_bits:
+ 	clear_bit(GPIOD_FLAG_EDGE_RISING, &desc->flags);
+ 	clear_bit(GPIOD_FLAG_EDGE_FALLING, &desc->flags);
+@@ -280,7 +280,7 @@ static void gpio_sysfs_free_irq(struct gpiod_data *data)
+ 
+ 	data->irq_flags = 0;
+ 	free_irq(data->irq, data);
+-	gpiochip_unlock_as_irq(guard.gc, gpio_chip_hwgpio(desc));
++	gpiochip_unlock_as_irq(guard.gc, gpiod_hwgpio(desc));
+ 	clear_bit(GPIOD_FLAG_EDGE_RISING, &desc->flags);
+ 	clear_bit(GPIOD_FLAG_EDGE_FALLING, &desc->flags);
+ }
+@@ -478,10 +478,10 @@ static int export_gpio_desc(struct gpio_desc *desc)
+ 	if (!guard.gc)
+ 		return -ENODEV;
+ 
+-	offset = gpio_chip_hwgpio(desc);
++	offset = gpiod_hwgpio(desc);
+ 	if (!gpiochip_line_is_valid(guard.gc, offset)) {
+ 		pr_debug_ratelimited("%s: GPIO %d masked\n", __func__,
+-				     gpio_chip_hwgpio(desc));
++				     gpiod_hwgpio(desc));
+ 		return -EINVAL;
+ 	}
+ 
+@@ -823,7 +823,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ 	}
+ 
+ 	desc_data->chip_attr_group.name = kasprintf(GFP_KERNEL, "gpio%u",
+-						    gpio_chip_hwgpio(desc));
++						    gpiod_hwgpio(desc));
+ 	if (!desc_data->chip_attr_group.name) {
+ 		status = -ENOMEM;
+ 		goto err_put_dirent;
+@@ -843,7 +843,7 @@ int gpiod_export(struct gpio_desc *desc, bool direction_may_change)
+ 	if (status)
+ 		goto err_free_name;
+ 
+-	path = kasprintf(GFP_KERNEL, "gpio%u/value", gpio_chip_hwgpio(desc));
++	path = kasprintf(GFP_KERNEL, "gpio%u/value", gpiod_hwgpio(desc));
+ 	if (!path) {
+ 		status = -ENOMEM;
+ 		goto err_remove_groups;
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 4524c89946d7c..497fda9bf8f1e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -443,7 +443,7 @@ int gpiod_get_direction(struct gpio_desc *desc)
+ 	if (!guard.gc)
+ 		return -ENODEV;
+ 
+-	offset = gpio_chip_hwgpio(desc);
++	offset = gpiod_hwgpio(desc);
+ 	flags = READ_ONCE(desc->flags);
+ 
+ 	/*
+@@ -2446,7 +2446,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ 	if (test_and_set_bit(GPIOD_FLAG_REQUESTED, &desc->flags))
+ 		return -EBUSY;
+ 
+-	offset = gpio_chip_hwgpio(desc);
++	offset = gpiod_hwgpio(desc);
+ 	if (!gpiochip_line_is_valid(guard.gc, offset))
+ 		return -EINVAL;
+ 
+@@ -2508,7 +2508,7 @@ static void gpiod_free_commit(struct gpio_desc *desc)
+ 
+ 	if (guard.gc && test_bit(GPIOD_FLAG_REQUESTED, &flags)) {
+ 		if (guard.gc->free)
+-			guard.gc->free(guard.gc, gpio_chip_hwgpio(desc));
++			guard.gc->free(guard.gc, gpiod_hwgpio(desc));
+ 
+ 		clear_bit(GPIOD_FLAG_ACTIVE_LOW, &flags);
+ 		clear_bit(GPIOD_FLAG_REQUESTED, &flags);
+@@ -2668,7 +2668,7 @@ int gpio_do_set_config(struct gpio_desc *desc, unsigned long config)
+ 	if (!guard.gc->set_config)
+ 		return -ENOTSUPP;
+ 
+-	ret = guard.gc->set_config(guard.gc, gpio_chip_hwgpio(desc), config);
++	ret = guard.gc->set_config(guard.gc, gpiod_hwgpio(desc), config);
+ 	if (ret > 0)
+ 		ret = -EBADE;
+ 
+@@ -2699,7 +2699,7 @@ static int gpio_set_config_with_argument_optional(struct gpio_desc *desc,
+ 						  u32 argument)
+ {
+ 	struct device *dev = &desc->gdev->dev;
+-	int gpio = gpio_chip_hwgpio(desc);
++	int gpio = gpiod_hwgpio(desc);
+ 	int ret;
+ 
+ 	ret = gpio_set_config_with_argument(desc, mode, argument);
+@@ -2862,9 +2862,9 @@ int gpiod_direction_input_nonotify(struct gpio_desc *desc)
+ 	 */
+ 	if (guard.gc->direction_input) {
+ 		ret = gpiochip_direction_input(guard.gc,
+-					       gpio_chip_hwgpio(desc));
++					       gpiod_hwgpio(desc));
+ 	} else if (guard.gc->get_direction) {
+-		dir = gpiochip_get_direction(guard.gc, gpio_chip_hwgpio(desc));
++		dir = gpiochip_get_direction(guard.gc, gpiod_hwgpio(desc));
+ 		if (dir < 0)
+ 			return dir;
+ 
+@@ -2923,12 +2923,12 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+ 
+ 	if (guard.gc->direction_output) {
+ 		ret = gpiochip_direction_output(guard.gc,
+-						gpio_chip_hwgpio(desc), val);
++						gpiod_hwgpio(desc), val);
+ 	} else {
+ 		/* Check that we are in output mode if we can */
+ 		if (guard.gc->get_direction) {
+ 			dir = gpiochip_get_direction(guard.gc,
+-						     gpio_chip_hwgpio(desc));
++						     gpiod_hwgpio(desc));
+ 			if (dir < 0)
+ 				return dir;
+ 
+@@ -2943,7 +2943,7 @@ static int gpiod_direction_output_raw_commit(struct gpio_desc *desc, int value)
+ 		 * If we can't actively set the direction, we are some
+ 		 * output-only chip, so just drive the output as desired.
+ 		 */
+-		ret = gpiochip_set(guard.gc, gpio_chip_hwgpio(desc), val);
++		ret = gpiochip_set(guard.gc, gpiod_hwgpio(desc), val);
+ 		if (ret)
+ 			return ret;
+ 	}
+@@ -3094,7 +3094,7 @@ int gpiod_enable_hw_timestamp_ns(struct gpio_desc *desc, unsigned long flags)
+ 	}
+ 
+ 	ret = guard.gc->en_hw_timestamp(guard.gc,
+-					gpio_chip_hwgpio(desc), flags);
++					gpiod_hwgpio(desc), flags);
+ 	if (ret)
+ 		gpiod_warn(desc, "%s: hw ts request failed\n", __func__);
+ 
+@@ -3126,7 +3126,7 @@ int gpiod_disable_hw_timestamp_ns(struct gpio_desc *desc, unsigned long flags)
+ 		return -ENOTSUPP;
+ 	}
+ 
+-	ret = guard.gc->dis_hw_timestamp(guard.gc, gpio_chip_hwgpio(desc),
++	ret = guard.gc->dis_hw_timestamp(guard.gc, gpiod_hwgpio(desc),
+ 					 flags);
+ 	if (ret)
+ 		gpiod_warn(desc, "%s: hw ts release failed\n", __func__);
+@@ -3261,7 +3261,7 @@ static int gpiochip_get(struct gpio_chip *gc, unsigned int offset)
+ 
+ static int gpio_chip_get_value(struct gpio_chip *gc, const struct gpio_desc *desc)
+ {
+-	return gc->get ? gpiochip_get(gc, gpio_chip_hwgpio(desc)) : -EIO;
++	return gc->get ? gpiochip_get(gc, gpiod_hwgpio(desc)) : -EIO;
+ }
+ 
+ /* I/O calls are only valid after configuration completed; the relevant
+@@ -3421,7 +3421,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
+ 		first = i;
+ 		do {
+ 			const struct gpio_desc *desc = desc_array[i];
+-			int hwgpio = gpio_chip_hwgpio(desc);
++			int hwgpio = gpiod_hwgpio(desc);
+ 
+ 			__set_bit(hwgpio, mask);
+ 			i++;
+@@ -3443,7 +3443,7 @@ int gpiod_get_array_value_complex(bool raw, bool can_sleep,
+ 
+ 		for (j = first; j < i; ) {
+ 			const struct gpio_desc *desc = desc_array[j];
+-			int hwgpio = gpio_chip_hwgpio(desc);
++			int hwgpio = gpiod_hwgpio(desc);
+ 			int value = test_bit(hwgpio, bits);
+ 
+ 			if (!raw && test_bit(GPIOD_FLAG_ACTIVE_LOW, &desc->flags))
+@@ -3580,7 +3580,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_array_value);
+  */
+ static int gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
+ {
+-	int ret = 0, offset = gpio_chip_hwgpio(desc);
++	int ret = 0, offset = gpiod_hwgpio(desc);
+ 
+ 	CLASS(gpio_chip_guard, guard)(desc);
+ 	if (!guard.gc)
+@@ -3609,7 +3609,7 @@ static int gpio_set_open_drain_value_commit(struct gpio_desc *desc, bool value)
+  */
+ static int gpio_set_open_source_value_commit(struct gpio_desc *desc, bool value)
+ {
+-	int ret = 0, offset = gpio_chip_hwgpio(desc);
++	int ret = 0, offset = gpiod_hwgpio(desc);
+ 
+ 	CLASS(gpio_chip_guard, guard)(desc);
+ 	if (!guard.gc)
+@@ -3641,7 +3641,7 @@ static int gpiod_set_raw_value_commit(struct gpio_desc *desc, bool value)
+ 		return -ENODEV;
+ 
+ 	trace_gpio_value(desc_to_gpio(desc), 0, value);
+-	return gpiochip_set(guard.gc, gpio_chip_hwgpio(desc), value);
++	return gpiochip_set(guard.gc, gpiod_hwgpio(desc), value);
+ }
+ 
+ /*
+@@ -3764,7 +3764,7 @@ int gpiod_set_array_value_complex(bool raw, bool can_sleep,
+ 
+ 		do {
+ 			struct gpio_desc *desc = desc_array[i];
+-			int hwgpio = gpio_chip_hwgpio(desc);
++			int hwgpio = gpiod_hwgpio(desc);
+ 			int value = test_bit(i, value_bitmap);
+ 
+ 			if (unlikely(!test_bit(GPIOD_FLAG_IS_OUT, &desc->flags)))
+@@ -4004,7 +4004,7 @@ int gpiod_to_irq(const struct gpio_desc *desc)
+ 	if (!gc)
+ 		return -ENODEV;
+ 
+-	offset = gpio_chip_hwgpio(desc);
++	offset = gpiod_hwgpio(desc);
+ 	if (gc->to_irq) {
+ 		ret = gc->to_irq(gc, offset);
+ 		if (ret)
+@@ -4961,7 +4961,7 @@ int gpiod_hog(struct gpio_desc *desc, const char *name,
+ 	if (test_and_set_bit(GPIOD_FLAG_IS_HOGGED, &desc->flags))
+ 		return 0;
+ 
+-	hwnum = gpio_chip_hwgpio(desc);
++	hwnum = gpiod_hwgpio(desc);
+ 
+ 	local_desc = gpiochip_request_own_desc(guard.gc, hwnum, name,
+ 					       lflags, dflags);
+@@ -5042,7 +5042,7 @@ struct gpio_descs *__must_check gpiod_get_array(struct device *dev,
+ 		 * If pin hardware number of array member 0 is also 0, select
+ 		 * its chip as a candidate for fast bitmap processing path.
+ 		 */
+-		if (descs->ndescs == 0 && gpio_chip_hwgpio(desc) == 0) {
++		if (descs->ndescs == 0 && gpiod_hwgpio(desc) == 0) {
+ 			struct gpio_descs *array;
+ 
+ 			bitmap_size = BITS_TO_LONGS(gdev->ngpio > count ?
+@@ -5087,7 +5087,7 @@ struct gpio_descs *__must_check gpiod_get_array(struct device *dev,
+ 		 * Detect array members which belong to the 'fast' chip
+ 		 * but their pins are not in hardware order.
+ 		 */
+-		else if (gpio_chip_hwgpio(desc) != descs->ndescs) {
++		else if (gpiod_hwgpio(desc) != descs->ndescs) {
+ 			/*
+ 			 * Don't use fast path if all array members processed so
+ 			 * far belong to the same chip as this one but its pin
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 6ee29d0222393..2b4f479d32123 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -276,7 +276,7 @@ const char *gpiod_get_label(struct gpio_desc *desc);
+ /*
+  * Return the GPIO number of the passed descriptor relative to its chip
+  */
+-static inline int gpio_chip_hwgpio(const struct gpio_desc *desc)
++static inline int gpiod_hwgpio(const struct gpio_desc *desc)
+ {
+ 	return desc - &desc->gdev->descs[0];
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.18/gpiolib-clear-requested-flag-if-line-is-invalid.patch b/queue-6.18/gpiolib-clear-requested-flag-if-line-is-invalid.patch
new file mode 100644
index 0000000..5807d27
--- /dev/null
+++ b/queue-6.18/gpiolib-clear-requested-flag-if-line-is-invalid.patch

@@ -0,0 +1,48 @@
+From b3ac613a95d703790e82d31c435db7b3fcab48b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2026 20:44:03 +0000
+Subject: gpiolib: clear requested flag if line is invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <pobrn@protonmail.com>
+
+[ Upstream commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f ]
+
+If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but
+`desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result
+in subsequent calls misleadingly returning `-EBUSY`.
+
+Fix that by clearing the flag in case of failure.
+
+Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs")
+Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 497fda9bf8f1e..9dd22b4bbff54 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2447,8 +2447,10 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ 		return -EBUSY;
+ 
+ 	offset = gpiod_hwgpio(desc);
+-	if (!gpiochip_line_is_valid(guard.gc, offset))
+-		return -EINVAL;
++	if (!gpiochip_line_is_valid(guard.gc, offset)) {
++		ret = -EINVAL;
++		goto out_clear_bit;
++	}
+ 
+ 	/* NOTE:  gpio_request() can be called in early boot,
+ 	 * before IRQs are enabled, for non-sleeping (SOC) GPIOs.
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch b/queue-6.18/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
new file mode 100644
index 0000000..7edc4b1
--- /dev/null
+++ b/queue-6.18/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch

@@ -0,0 +1,76 @@
+From c1cb8fdf468d9fbdbbd5781acadba6acaf93ba55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 14:49:06 -0700
+Subject: hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Corey Hickey <bugfood-c@fatooh.org>
+
+[ Upstream commit cffff6df669a438ecac506dadd49a53d4475a796 ]
+
+On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of
+zero for T_Sensor. On this board, the register for T_Sensor is at a
+different address, as found by experimentation and confirmed by
+comparison to an independent temperature reading.
+
+* sensor disconnected: -62.0°C
+* ambient temperature: +22.0°C
+* held between fingers: +30.0°C
+
+Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI
+without causing a regression for other 600-series boards
+
+Fixes: e0444758dd1b ("hwmon: (asus-ec-sensors) add PRIME X670E-PRO WIFI")
+Signed-off-by: Corey Hickey <bugfood-c@fatooh.org>
+Link: https://lore.kernel.org/r/20260331215414.368785-1-bugfood-ml@fatooh.org
+[groeck: Fixed typo, updated Fixes: reference]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index 34a8f6b834c97..95c50d3a788ce 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -111,6 +111,8 @@ enum ec_sensors {
+ 	ec_sensor_temp_mb,
+ 	/* "T_Sensor" temperature sensor reading [℃] */
+ 	ec_sensor_temp_t_sensor,
++	/* like ec_sensor_temp_t_sensor, but at an alternate address [℃] */
++	ec_sensor_temp_t_sensor_alt1,
+ 	/* VRM temperature [℃] */
+ 	ec_sensor_temp_vrm,
+ 	/* CPU Core voltage [mV] */
+@@ -156,6 +158,7 @@ enum ec_sensors {
+ #define SENSOR_TEMP_CPU_PACKAGE BIT(ec_sensor_temp_cpu_package)
+ #define SENSOR_TEMP_MB BIT(ec_sensor_temp_mb)
+ #define SENSOR_TEMP_T_SENSOR BIT(ec_sensor_temp_t_sensor)
++#define SENSOR_TEMP_T_SENSOR_ALT1 BIT(ec_sensor_temp_t_sensor_alt1)
+ #define SENSOR_TEMP_VRM BIT(ec_sensor_temp_vrm)
+ #define SENSOR_IN_CPU_CORE BIT(ec_sensor_in_cpu_core)
+ #define SENSOR_FAN_CPU_OPT BIT(ec_sensor_fan_cpu_opt)
+@@ -272,6 +275,8 @@ static const struct ec_sensor_info sensors_family_amd_600[] = {
+ 		EC_SENSOR("VRM", hwmon_temp, 1, 0x00, 0x33),
+ 	[ec_sensor_temp_t_sensor] =
+ 		EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x36),
++	[ec_sensor_temp_t_sensor_alt1] =
++		EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x37),
+ 	[ec_sensor_fan_cpu_opt] =
+ 		EC_SENSOR("CPU_Opt", hwmon_fan, 2, 0x00, 0xb0),
+ 	[ec_sensor_temp_water_in] =
+@@ -489,7 +494,7 @@ static const struct ec_board_info board_info_prime_x570_pro = {
+ static const struct ec_board_info board_info_prime_x670e_pro_wifi = {
+ 	.sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
+ 		SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
+-		SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
++		SENSOR_TEMP_T_SENSOR_ALT1 | SENSOR_FAN_CPU_OPT,
+ 	.mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
+ 	.family = family_amd_600_series,
+ };
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch b/queue-6.18/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
new file mode 100644
index 0000000..6f5aa2d
--- /dev/null
+++ b/queue-6.18/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch

@@ -0,0 +1,35 @@
+From 43e7ff37d0bca7c361bc15f71068ed17af0cb26f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-6.18/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..3fea125
--- /dev/null
+++ b/queue-6.18/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From 464816df44e8301a19facad1c7bfc93556964833 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%4phN\n", extn->name);
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-6.18/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..2d9b2ea
--- /dev/null
+++ b/queue-6.18/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 46f2c875c7dd587bebb0923348dc15e7d1e43e12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 6a4a978eca7e8..24c1f961c7668 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch b/queue-6.18/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
new file mode 100644
index 0000000..3e5e0f9
--- /dev/null
+++ b/queue-6.18/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch

@@ -0,0 +1,50 @@
+From 359de1206b33eca18789ab0bbaf8e227843837de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:40 +0000
+Subject: hwmon: (tps53679) Fix array access with zero-length block read
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 ]
+
+i2c_smbus_read_block_data() can return 0, indicating a zero-length
+read. When this happens, tps53679_identify_chip() accesses buf[ret - 1]
+which is buf[-1], reading one byte before the buffer on the stack.
+
+Fix by changing the check from "ret < 0" to "ret <= 0", treating a
+zero-length read as an error (-EIO), which prevents the out-of-bounds
+array access.
+
+Also fix a typo in the adjacent comment: "if present" instead of
+duplicate "if".
+
+Fixes: 75ca1e5875fe ("hwmon: (pmbus/tps53679) Add support for TPS53685")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-2-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index ca2bfa25eb04c..3bca543817a60 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -103,10 +103,10 @@ static int tps53679_identify_chip(struct i2c_client *client,
+ 	}
+ 
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+-	if (ret < 0)
+-		return ret;
++	if (ret <= 0)
++		return ret < 0 ? ret : -EIO;
+ 
+-	/* Adjust length if null terminator if present */
++	/* Adjust length if null terminator is present */
+ 	buf_len = (buf[ret - 1] != '\x00' ? ret : ret - 1);
+ 
+ 	id_len = strlen(id);
+-- 
+2.53.0
+

diff --git a/queue-6.18/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-6.18/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..a0bb2ca
--- /dev/null
+++ b/queue-6.18/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From abe81700aa56a6d75149850a382e6839c30feba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 3bca543817a60..249974c13aa39 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -175,8 +175,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch b/queue-6.18/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
new file mode 100644
index 0000000..2db318e
--- /dev/null
+++ b/queue-6.18/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch

@@ -0,0 +1,43 @@
+From cc2c1a027ef46c4f676d0bf6b0b13884c296210c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 303bc308f80a8..c96fec2ebb3e7 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG	0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG	0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG	0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG			0x34
+ #define BNO055_CALIB_STAT_REG		0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+-- 
+2.53.0
+

diff --git a/queue-6.18/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch b/queue-6.18/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
new file mode 100644
index 0000000..ef9ce71
--- /dev/null
+++ b/queue-6.18/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch

@@ -0,0 +1,60 @@
+From e6f4db2841483f7d834482ad52fae83a379a29dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 00:49:36 +0800
+Subject: io_uring/rsrc: reject zero-length fixed buffer import
+
+From: Qi Tang <tpluszz77@gmail.com>
+
+[ Upstream commit 111a12b422a8cfa93deabaef26fec48237163214 ]
+
+validate_fixed_range() admits buf_addr at the exact end of the
+registered region when len is zero, because the check uses strict
+greater-than (buf_end > imu->ubuf + imu->len).  io_import_fixed()
+then computes offset == imu->len, which causes the bvec skip logic
+to advance past the last bio_vec entry and read bv_offset from
+out-of-bounds slab memory.
+
+Return early from io_import_fixed() when len is zero.  A zero-length
+import has no data to transfer and should not walk the bvec array
+at all.
+
+  BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0
+  Read of size 4 at addr ffff888002bcc254 by task poc/103
+  Call Trace:
+   io_import_reg_buf+0x697/0x7f0
+   io_write_fixed+0xd9/0x250
+   __io_issue_sqe+0xad/0x710
+   io_issue_sqe+0x7d/0x1100
+   io_submit_sqes+0x86a/0x23c0
+   __do_sys_io_uring_enter+0xa98/0x1590
+  Allocated by task 103:
+  The buggy address is located 12 bytes to the right of
+   allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
+
+Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer")
+Signed-off-by: Qi Tang <tpluszz77@gmail.com>
+Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index 44442bf4827e4..dc87c6a86e346 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1082,6 +1082,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
+ 		return ret;
+ 	if (!(imu->dir & (1 << ddir)))
+ 		return -EFAULT;
++	if (unlikely(!len)) {
++		iov_iter_bvec(iter, ddir, NULL, 0, 0);
++		return 0;
++	}
+ 
+ 	offset = buf_addr - imu->ubuf;
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/mips-ralink-update-cpu-clock-index.patch b/queue-6.18/mips-ralink-update-cpu-clock-index.patch
new file mode 100644
index 0000000..3a5c73b
--- /dev/null
+++ b/queue-6.18/mips-ralink-update-cpu-clock-index.patch

@@ -0,0 +1,49 @@
+From addb22f58714353051c1cc26a3dd801f2fcbcb6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ 	switch (ralink_soc) {
+ 	case RT2880_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt2880-sysc";
+ 	case RT3883_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3883-sysc";
+ 	case RT305X_SOC_RT3050:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3050-sysc";
+ 	case RT305X_SOC_RT3052:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3052-sysc";
+ 	case RT305X_SOC_RT3350:
+ 		*idx = 1;
+-- 
+2.53.0
+

diff --git a/queue-6.18/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch b/queue-6.18/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
new file mode 100644
index 0000000..9ffd371
--- /dev/null
+++ b/queue-6.18/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch

@@ -0,0 +1,46 @@
+From e19c2e6351a6da8d6445ceae43db64033291d430 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2026 12:43:05 -0700
+Subject: perf/x86: Fix potential bad container_of in intel_pmu_hw_config
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit dbde07f06226438cd2cf1179745fa1bec5d8914a ]
+
+Auto counter reload may have a group of events with software events
+present within it. The software event PMU isn't the x86_hybrid_pmu and
+a container_of operation in intel_pmu_set_acr_caused_constr (via the
+hybrid helper) could cause out of bound memory reads. Avoid this by
+guarding the call to intel_pmu_set_acr_caused_constr with an
+is_x86_event check.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
+Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index f43aba3ac779d..3046058e7e238 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4441,8 +4441,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ 		intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask);
+ 
+ 		if (leader->nr_siblings) {
+-			for_each_sibling_event(sibling, leader)
+-				intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++			for_each_sibling_event(sibling, leader) {
++				if (is_x86_event(sibling))
++					intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++			}
+ 		}
+ 
+ 		if (leader != event)
+-- 
+2.53.0
+

diff --git a/queue-6.18/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-6.18/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..e9903d4
--- /dev/null
+++ b/queue-6.18/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From 9d8f80ab5b69538151bfd9c58a9668282f4a0fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 15fec5d1e6dec..0bf629204c76a 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch b/queue-6.18/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
new file mode 100644
index 0000000..8312a2a
--- /dev/null
+++ b/queue-6.18/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch

@@ -0,0 +1,44 @@
+From af7250a375bcaf5ae1a9a40aee379f285f38b183 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 00:00:22 +0800
+Subject: riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
+
+From: Zishun Yi <vulab@iscas.ac.cn>
+
+[ Upstream commit 3033b2b1e3949274f33a140e2a97571b5a307298 ]
+
+In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen
+is correctly set to 0, but it forgets to reset pmm. This results in the
+CPU pmm state not corresponding to the software pmlen state.
+
+Fix this by resetting pmm along with pmlen.
+
+Fixes: 2e1743085887 ("riscv: Add support for the tagged address ABI")
+Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
+Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
+Link: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/process.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 31a392993cb45..b5188dc74727d 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -324,8 +324,10 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)
+ 	if (arg & PR_TAGGED_ADDR_ENABLE && (tagged_addr_disabled || !pmlen))
+ 		return -EINVAL;
+ 
+-	if (!(arg & PR_TAGGED_ADDR_ENABLE))
++	if (!(arg & PR_TAGGED_ADDR_ENABLE)) {
+ 		pmlen = PMLEN_0;
++		pmm = ENVCFG_PMM_PMLEN_0;
++	}
+ 
+ 	if (mmap_write_lock_killable(mm))
+ 		return -EINTR;
+-- 
+2.53.0
+

diff --git a/queue-6.18/sched-fair-fix-zero_vruntime-tracking-fix.patch b/queue-6.18/sched-fair-fix-zero_vruntime-tracking-fix.patch
new file mode 100644
index 0000000..b02ebdc
--- /dev/null
+++ b/queue-6.18/sched-fair-fix-zero_vruntime-tracking-fix.patch

@@ -0,0 +1,103 @@
+From da042ca9e55d846171900f7ffbd8c990f566df6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 292141f4aaa54..d9777c81db0da 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -707,7 +707,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+  * Called in:
+  *  - place_entity()      -- before enqueue
+  *  - update_entity_lag() -- before dequeue
+- *  - entity_tick()
++ *  - update_deadline()   -- slice expiration
+  *
+  * This means it is one entry 'behind' but that puts it close enough to where
+  * the bound on entity_key() is at most two lag bounds.
+@@ -1121,6 +1121,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ 	 * EEVDF: vd_i = ve_i + r_i / w_i
+ 	 */
+ 	se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++	avg_vruntime(cfs_rq);
+ 
+ 	/*
+ 	 * The task has consumed its request, reschedule.
+@@ -5635,11 +5636,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ 	update_load_avg(cfs_rq, curr, UPDATE_TG);
+ 	update_cfs_group(curr);
+ 
+-	/*
+-	 * Pulls along cfs_rq::zero_vruntime.
+-	 */
+-	avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ 	/*
+ 	 * queued ticks are scheduled to match the slice, so don't bother
+@@ -9086,7 +9082,7 @@ static void yield_task_fair(struct rq *rq)
+ 	 */
+ 	if (entity_eligible(cfs_rq, se)) {
+ 		se->vruntime = se->deadline;
+-		se->deadline += calc_delta_fair(se->slice, se);
++		update_deadline(cfs_rq, se);
+ 	}
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/series b/queue-6.18/series
index 62f275c..6bf2947 100644
--- a/queue-6.18/series
+++ b/queue-6.18/series

@@ -101,3 +101,28 @@
 bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
 bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
 revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+gpio-rename-gpio_chip_hwgpio-to-gpiod_hwgpio.patch
+gpiolib-clear-requested-flag-if-line-is-invalid.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
+hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
+spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
+drm-xe-pxp-clean-up-termination-status-on-failure.patch
+drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
+drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
+hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
+riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
+acpi-rimt-add-dependency-between-iommu-and-devices.patch

diff --git a/queue-6.18/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch b/queue-6.18/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
new file mode 100644
index 0000000..886c281
--- /dev/null
+++ b/queue-6.18/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch

@@ -0,0 +1,58 @@
+From 3c3fa8cdbf5bfe4d86389e789686fd5b01b654ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2026 22:28:45 +0800
+Subject: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and
+ remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f ]
+
+aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was
+missing from both probe unwind and remove-time cleanup. Add a devm cleanup
+action after successful registration so
+nand_ecc_unregister_on_host_hw_engine() runs automatically on probe
+failures and during device removal.
+
+Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-amlogic-spifc-a4.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/spi/spi-amlogic-spifc-a4.c b/drivers/spi/spi-amlogic-spifc-a4.c
+index b2589fe2425cc..3393e1f305709 100644
+--- a/drivers/spi/spi-amlogic-spifc-a4.c
++++ b/drivers/spi/spi-amlogic-spifc-a4.c
+@@ -1066,6 +1066,13 @@ static const struct nand_ecc_engine_ops aml_sfc_ecc_engine_ops = {
+ 	.finish_io_req = aml_sfc_ecc_finish_io_req,
+ };
+ 
++static void aml_sfc_unregister_ecc_engine(void *data)
++{
++	struct nand_ecc_engine *eng = data;
++
++	nand_ecc_unregister_on_host_hw_engine(eng);
++}
++
+ static int aml_sfc_clk_init(struct aml_sfc *sfc)
+ {
+ 	sfc->gate_clk = devm_clk_get_enabled(sfc->dev, "gate");
+@@ -1149,6 +1156,11 @@ static int aml_sfc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(&pdev->dev, ret, "failed to register Aml host ecc engine.\n");
+ 
++	ret = devm_add_action_or_reset(dev, aml_sfc_unregister_ecc_engine,
++				       &sfc->ecc_eng);
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to add ECC unregister action\n");
++
+ 	ret = of_property_read_u32(np, "amlogic,rx-adj", &val);
+ 	if (!ret)
+ 		sfc->rx_adj = val;
+-- 
+2.53.0
+

diff --git a/queue-6.18/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch b/queue-6.18/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
new file mode 100644
index 0000000..483ae0f
--- /dev/null
+++ b/queue-6.18/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch

@@ -0,0 +1,49 @@
+From 54f15c51696e48ef774e8a0dc24beaa66803a1c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 00:07:06 +0800
+Subject: spi: stm32-ospi: Fix reset control leak on probe error
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 ]
+
+When spi_register_controller() fails after reset_control_acquire()
+succeeds, the reset control is never released. This causes a resource
+leak in the error path.
+
+Add the missing reset_control_release() call in the error path.
+
+Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index 5fa27de89210a..2988ff288ff02 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -939,13 +939,15 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ 	if (ret) {
+ 		/* Disable ospi */
+ 		writel_relaxed(0, ospi->regs_base + OSPI_CR);
+-		goto err_pm_resume;
++		goto err_reset_control;
+ 	}
+ 
+ 	pm_runtime_put_autosuspend(ospi->dev);
+ 
+ 	return 0;
+ 
++err_reset_control:
++	reset_control_release(ospi->rstc);
+ err_pm_resume:
+ 	pm_runtime_put_sync_suspend(ospi->dev);
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.18/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch b/queue-6.18/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
new file mode 100644
index 0000000..1e37ec5
--- /dev/null
+++ b/queue-6.18/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch

@@ -0,0 +1,45 @@
+From e899a2c653c3b690d1c6c0e4bc4484ec3b66e2dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 19:14:05 +0800
+Subject: spi: stm32-ospi: Fix resource leak in remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 73cd1f97946ae3796544448ff12c07f399bb2881 ]
+
+The remove() callback returned early if pm_runtime_resume_and_get()
+failed, skipping the cleanup of spi controller and other resources.
+
+Remove the early return so cleanup completes regardless of PM resume
+result.
+
+Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index f36fd36da2692..5fa27de89210a 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -963,11 +963,8 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ static void stm32_ospi_remove(struct platform_device *pdev)
+ {
+ 	struct stm32_ospi *ospi = platform_get_drvdata(pdev);
+-	int ret;
+ 
+-	ret = pm_runtime_resume_and_get(ospi->dev);
+-	if (ret < 0)
+-		return;
++	pm_runtime_resume_and_get(ospi->dev);
+ 
+ 	spi_unregister_controller(ospi->ctrl);
+ 	/* Disable ospi */
+-- 
+2.53.0
+

diff --git a/queue-6.19/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch b/queue-6.19/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
new file mode 100644
index 0000000..90dc493
--- /dev/null
+++ b/queue-6.19/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch

@@ -0,0 +1,111 @@
+From 8ebf6cc52c51fe456fcf8c062cef09a2093b196a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index 428d8f65bff36..3842e59291b93 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -913,7 +913,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ 		 */
+ 		return -ENODEV;
+ 
+-	if (status) {
++	if (usr && status) {
+ 		/*
+ 		 * Releasing resources failed on the device side, which puts
+ 		 * us in a bind since they may still be in use, so enable the
+@@ -1108,6 +1108,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ 	mutex_lock(&qdev->cntl_mutex);
+ 	if (!list_empty(&elem.list))
+ 		list_del(&elem.list);
++	/* resp_worker() processed the response but the wait was interrupted */
++	else if (ret == -ERESTARTSYS)
++		ret = 0;
+ 	if (!ret && !elem.buf)
+ 		ret = -ETIMEDOUT;
+ 	else if (ret > 0 && !elem.buf)
+@@ -1418,9 +1421,49 @@ static void resp_worker(struct work_struct *work)
+ 	}
+ 	mutex_unlock(&qdev->cntl_mutex);
+ 
+-	if (!found)
++	if (!found) {
++		/*
++		 * The user might have gone away at this point without waiting
++		 * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++		 * the device. If this is not handled correctly, the host will
++		 * not know that the DBC[n] has been freed on the device.
++		 * Due to this failure in synchronization between the device and
++		 * the host, if another user requests to activate a network, and
++		 * the device assigns DBC[n] again, save_dbc_buf() will hang,
++		 * waiting for dbc[n]->in_use to be set to false, which will not
++		 * happen unless the qaic_dev_reset_clean_local_state() gets
++		 * called by resetting the device (or re-inserting the module).
++		 *
++		 * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++		 * transactions in the message before disposing of it, then
++		 * handle releasing the DBC resources.
++		 *
++		 * Since the user has gone away, if the device could not
++		 * deactivate the network (status != 0), there is no way to
++		 * enable and reassign the DBC to the user. We can put trust in
++		 * the device that it will release all the active DBCs in
++		 * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++		 * otherwise, the user can issue an soc_reset to the device.
++		 */
++		u32 msg_count = le32_to_cpu(msg->hdr.count);
++		u32 msg_len = le32_to_cpu(msg->hdr.len);
++		u32 len = 0;
++		int j;
++
++		for (j = 0; j < msg_count && len < msg_len; ++j) {
++			struct wire_trans_hdr *trans_hdr;
++
++			trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++			if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++				if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++					len += le32_to_cpu(trans_hdr->len);
++			} else {
++				len += le32_to_cpu(trans_hdr->len);
++			}
++		}
+ 		/* request must have timed out, drop packet */
+ 		kfree(msg);
++	}
+ 
+ 	kfree(resp);
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.19/acpi-rimt-add-dependency-between-iommu-and-devices.patch b/queue-6.19/acpi-rimt-add-dependency-between-iommu-and-devices.patch
new file mode 100644
index 0000000..1ef187c
--- /dev/null
+++ b/queue-6.19/acpi-rimt-add-dependency-between-iommu-and-devices.patch

@@ -0,0 +1,44 @@
+From 81fda71c8356b4cc762209184119413e838d943e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2026 11:46:05 +0530
+Subject: ACPI: RIMT: Add dependency between iommu and devices
+
+From: Sunil V L <sunilvl@oss.qualcomm.com>
+
+[ Upstream commit 9156585280f161fc1c3552cf1860559edb2bb7e3 ]
+
+EPROBE_DEFER ensures IOMMU devices are probed before the devices that
+depend on them. During shutdown, however, the IOMMU may be removed
+first, leading to issues. To avoid this, a device link is added
+which enforces the correct removal order.
+
+Fixes: 8f7729552582 ("ACPI: RISC-V: Add support for RIMT")
+Signed-off-by: Sunil V L <sunilvl@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260303061605.722949-1-sunilvl@oss.qualcomm.com
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/riscv/rimt.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/riscv/rimt.c b/drivers/acpi/riscv/rimt.c
+index 7f423405e5ef0..8eaa8731bddd6 100644
+--- a/drivers/acpi/riscv/rimt.c
++++ b/drivers/acpi/riscv/rimt.c
+@@ -263,6 +263,13 @@ static int rimt_iommu_xlate(struct device *dev, struct acpi_rimt_node *node, u32
+ 	if (!rimt_fwnode)
+ 		return -EPROBE_DEFER;
+ 
++	/*
++	 * EPROBE_DEFER ensures IOMMU is probed before the devices that
++	 * depend on them. During shutdown, however, the IOMMU may be removed
++	 * first, leading to issues. To avoid this, a device link is added
++	 * which enforces the correct removal order.
++	 */
++	device_link_add(dev, rimt_fwnode->dev, DL_FLAG_AUTOREMOVE_CONSUMER);
+ 	return acpi_iommu_fwspec_init(dev, deviceid, rimt_fwnode);
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-bridge-fix-refcount-shown-via-debugfs-for-encode.patch b/queue-6.19/drm-bridge-fix-refcount-shown-via-debugfs-for-encode.patch
new file mode 100644
index 0000000..b8b9e90
--- /dev/null
+++ b/queue-6.19/drm-bridge-fix-refcount-shown-via-debugfs-for-encode.patch

@@ -0,0 +1,83 @@
+From ff272405b103285518948e616315631149399e14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 13:26:05 +0800
+Subject: drm/bridge: Fix refcount shown via debugfs for encoder_bridges_show()
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit f078634c184a9b5ccaa056e8b8d6cd32f7bff1b6 ]
+
+A typical bridge refcount value is 3 after a bridge chain is formed:
+- devm_drm_bridge_alloc() initializes the refcount value to be 1.
+- drm_bridge_add() gets an additional reference hence 2.
+- drm_bridge_attach() gets the third reference hence 3.
+
+This typical refcount value aligns with allbridges_show()'s behaviour.
+However, since encoder_bridges_show() uses
+drm_for_each_bridge_in_chain_scoped() to automatically get/put the
+bridge reference while iterating, a bogus reference is accidentally
+got when showing the wrong typical refcount value as 4 to users via
+debugfs.  Fix this by caching the refcount value returned from
+kref_read() while iterating and explicitly decreasing the cached
+refcount value by 1 before showing it to users.
+
+Fixes: bd57048e4576 ("drm/bridge: use drm_for_each_bridge_in_chain_scoped()")
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Link: https://patch.msgid.link/20260318-drm-misc-next-2026-03-05-fix-encoder-bridges-refcount-v3-1-147fea581279@nxp.com
+Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_bridge.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c
+index 8f355df883d8a..250bf8fa51677 100644
+--- a/drivers/gpu/drm/drm_bridge.c
++++ b/drivers/gpu/drm/drm_bridge.c
+@@ -1465,11 +1465,17 @@ EXPORT_SYMBOL(devm_drm_put_bridge);
+ static void drm_bridge_debugfs_show_bridge(struct drm_printer *p,
+ 					   struct drm_bridge *bridge,
+ 					   unsigned int idx,
+-					   bool lingering)
++					   bool lingering,
++					   bool scoped)
+ {
++	unsigned int refcount = kref_read(&bridge->refcount);
++
++	if (scoped)
++		refcount--;
++
+ 	drm_printf(p, "bridge[%u]: %ps\n", idx, bridge->funcs);
+ 
+-	drm_printf(p, "\trefcount: %u%s\n", kref_read(&bridge->refcount),
++	drm_printf(p, "\trefcount: %u%s\n", refcount,
+ 		   lingering ? " [lingering]" : "");
+ 
+ 	drm_printf(p, "\ttype: [%d] %s\n",
+@@ -1503,10 +1509,10 @@ static int allbridges_show(struct seq_file *m, void *data)
+ 	mutex_lock(&bridge_lock);
+ 
+ 	list_for_each_entry(bridge, &bridge_list, list)
+-		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false);
++		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false, false);
+ 
+ 	list_for_each_entry(bridge, &bridge_lingering_list, list)
+-		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, true);
++		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, true, false);
+ 
+ 	mutex_unlock(&bridge_lock);
+ 
+@@ -1521,7 +1527,7 @@ static int encoder_bridges_show(struct seq_file *m, void *data)
+ 	unsigned int idx = 0;
+ 
+ 	drm_for_each_bridge_in_chain_scoped(encoder, bridge)
+-		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false);
++		drm_bridge_debugfs_show_bridge(&p, bridge, idx++, false, true);
+ 
+ 	return 0;
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch b/queue-6.19/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
new file mode 100644
index 0000000..9e059e8
--- /dev/null
+++ b/queue-6.19/drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch

@@ -0,0 +1,96 @@
+From ce28341235dac4c095f76a422f658bd492e10bcd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2026 14:46:52 +0800
+Subject: drm/sysfb: Fix efidrm error handling and memory type mismatch
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 5e77923a3eb39cce91bf08ed7670f816bf86d4af ]
+
+Fix incorrect error checking and memory type confusion in
+efidrm_device_create(). devm_memremap() returns error pointers, not
+NULL, and returns system memory while devm_ioremap() returns I/O memory.
+The code incorrectly passes system memory to iosys_map_set_vaddr_iomem().
+
+Restructure to handle each memory type separately. Use devm_ioremap*()
+with ERR_PTR(-ENXIO) for WC/UC, and devm_memremap() with ERR_CAST() for
+WT/WB.
+
+Fixes: 32ae90c66fb6 ("drm/sysfb: Add efidrm for EFI displays")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patch.msgid.link/20260311064652.2903449-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sysfb/efidrm.c | 46 +++++++++++++++++++++++-----------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/sysfb/efidrm.c b/drivers/gpu/drm/sysfb/efidrm.c
+index 1b683d55d6ea4..ac48bfa47e081 100644
+--- a/drivers/gpu/drm/sysfb/efidrm.c
++++ b/drivers/gpu/drm/sysfb/efidrm.c
+@@ -151,7 +151,6 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ 	struct drm_sysfb_device *sysfb;
+ 	struct drm_device *dev;
+ 	struct resource *mem = NULL;
+-	void __iomem *screen_base = NULL;
+ 	struct drm_plane *primary_plane;
+ 	struct drm_crtc *crtc;
+ 	struct drm_encoder *encoder;
+@@ -236,21 +235,38 @@ static struct efidrm_device *efidrm_device_create(struct drm_driver *drv,
+ 
+ 	mem_flags = efidrm_get_mem_flags(dev, res->start, vsize);
+ 
+-	if (mem_flags & EFI_MEMORY_WC)
+-		screen_base = devm_ioremap_wc(&pdev->dev, mem->start, resource_size(mem));
+-	else if (mem_flags & EFI_MEMORY_UC)
+-		screen_base = devm_ioremap(&pdev->dev, mem->start, resource_size(mem));
+-	else if (mem_flags & EFI_MEMORY_WT)
+-		screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+-					    MEMREMAP_WT);
+-	else if (mem_flags & EFI_MEMORY_WB)
+-		screen_base = devm_memremap(&pdev->dev, mem->start, resource_size(mem),
+-					    MEMREMAP_WB);
+-	else
++	if (mem_flags & EFI_MEMORY_WC) {
++		void __iomem *screen_base = devm_ioremap_wc(&pdev->dev, mem->start,
++							    resource_size(mem));
++
++		if (!screen_base)
++			return ERR_PTR(-ENXIO);
++		iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_UC) {
++		void __iomem *screen_base = devm_ioremap(&pdev->dev, mem->start,
++							 resource_size(mem));
++
++		if (!screen_base)
++			return ERR_PTR(-ENXIO);
++		iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_WT) {
++		void *screen_base = devm_memremap(&pdev->dev, mem->start,
++						  resource_size(mem), MEMREMAP_WT);
++
++		if (IS_ERR(screen_base))
++			return ERR_CAST(screen_base);
++		iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++	} else if (mem_flags & EFI_MEMORY_WB) {
++		void *screen_base = devm_memremap(&pdev->dev, mem->start,
++						  resource_size(mem), MEMREMAP_WB);
++
++		if (IS_ERR(screen_base))
++			return ERR_CAST(screen_base);
++		iosys_map_set_vaddr(&sysfb->fb_addr, screen_base);
++	} else {
+ 		drm_err(dev, "invalid mem_flags: 0x%llx\n", mem_flags);
+-	if (!screen_base)
+-		return ERR_PTR(-ENOMEM);
+-	iosys_map_set_vaddr_iomem(&sysfb->fb_addr, screen_base);
++		return ERR_PTR(-EINVAL);
++	}
+ 
+ 	/*
+ 	 * Modesetting
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-xe-pxp-clean-up-termination-status-on-failure.patch b/queue-6.19/drm-xe-pxp-clean-up-termination-status-on-failure.patch
new file mode 100644
index 0000000..5da9d7a
--- /dev/null
+++ b/queue-6.19/drm-xe-pxp-clean-up-termination-status-on-failure.patch

@@ -0,0 +1,43 @@
+From 43f75c99f2577c1950565134653c3db5ee29f8e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:20 -0700
+Subject: drm/xe/pxp: Clean up termination status on failure
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit e2628e670bb0923fcdc00828bfcd67b26a7df020 ]
+
+If the PXP HW termination fails during PXP start, the normal completion
+code won't be called, so the termination will remain uncomplete. To avoid
+unnecessary waits, mark the termination as completed from the error path.
+Note that we already do this if the termination fails when handling a
+termination irq from the HW.
+
+Fixes: f8caa80154c4 ("drm/xe/pxp: Add PXP queue tracking and session start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-7-daniele.ceraolospurio@intel.com
+(cherry picked from commit 5d9e708d2a69ab1f64a17aec810cd7c70c5b9fab)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index bdbdbbf6a6781..ba4d52001b853 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -603,6 +603,7 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ 			drm_err(&pxp->xe->drm, "PXP termination failed before start\n");
+ 			mutex_lock(&pxp->mutex);
+ 			pxp->status = XE_PXP_ERROR;
++			complete_all(&pxp->termination);
+ 
+ 			goto out_unlock;
+ 		}
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch b/queue-6.19/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
new file mode 100644
index 0000000..e05611e
--- /dev/null
+++ b/queue-6.19/drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch

@@ -0,0 +1,49 @@
+From a645ad0d4bc94481034a71c231333c2c4ba06d1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:22 -0700
+Subject: drm/xe/pxp: Clear restart flag in pxp_start after jumping back
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 76903b2057c8677c2c006e87fede15f496555dc0 ]
+
+If we don't clear the flag we'll keep jumping back at the beginning of
+the function once we reach the end.
+
+Fixes: ccd3c6820a90 ("drm/xe/pxp: Decouple queue addition from PXP start")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-9-daniele.ceraolospurio@intel.com
+(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index fdcecc026e937..9261a8412b64f 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -532,7 +532,7 @@ static int __exec_queue_add(struct xe_pxp *pxp, struct xe_exec_queue *q)
+ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ {
+ 	int ret = 0;
+-	bool restart = false;
++	bool restart;
+ 
+ 	if (!xe_pxp_is_enabled(pxp))
+ 		return -ENODEV;
+@@ -561,6 +561,8 @@ static int pxp_start(struct xe_pxp *pxp, u8 type)
+ 					 msecs_to_jiffies(PXP_ACTIVATION_TIMEOUT_MS)))
+ 		return -ETIMEDOUT;
+ 
++	restart = false;
++
+ 	mutex_lock(&pxp->mutex);
+ 
+ 	/* If PXP is not already active, turn it on */
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch b/queue-6.19/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
new file mode 100644
index 0000000..9e374a7
--- /dev/null
+++ b/queue-6.19/drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch

@@ -0,0 +1,57 @@
+From 76f2719cf331b8c9649c489d7bc2d74ef090e231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 08:37:21 -0700
+Subject: drm/xe/pxp: Remove incorrect handling of impossible state during
+ suspend
+
+From: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+
+[ Upstream commit 4fed244954c2dc9aafa333d08f66b14345225e03 ]
+
+The default case of the PXP suspend switch is incorrectly exiting
+without releasing the lock. However, this case is impossible to hit
+because we're switching on an enum and all the valid enum values have
+their own cases. Therefore, we can just get rid of the default case
+and rely on the compiler to warn us if a new enum value is added and
+we forget to add it to the switch.
+
+Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support")
+Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
+Cc: Alan Previn Teres Alexis <alan.previn.teres.alexis@intel.com>
+Cc: Julia Filipchuk <julia.filipchuk@intel.com>
+Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com>
+Link: https://patch.msgid.link/20260324153718.3155504-8-daniele.ceraolospurio@intel.com
+(cherry picked from commit f1b5a77fc9b6a90cd9a5e3db9d4c73ae1edfcfac)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pxp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_pxp.c b/drivers/gpu/drm/xe/xe_pxp.c
+index ba4d52001b853..fdcecc026e937 100644
+--- a/drivers/gpu/drm/xe/xe_pxp.c
++++ b/drivers/gpu/drm/xe/xe_pxp.c
+@@ -891,11 +891,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ 		pxp->key_instance++;
+ 		needs_queue_inval = true;
+ 		break;
+-	default:
+-		drm_err(&pxp->xe->drm, "unexpected state during PXP suspend: %u",
+-			pxp->status);
+-		ret = -EIO;
+-		goto out;
+ 	}
+ 
+ 	/*
+@@ -920,7 +915,6 @@ int xe_pxp_pm_suspend(struct xe_pxp *pxp)
+ 
+ 	pxp->last_suspend_key_instance = pxp->key_instance;
+ 
+-out:
+ 	return ret;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/drm-xe-xe_pagefault-disallow-writes-to-read-only-vma.patch b/queue-6.19/drm-xe-xe_pagefault-disallow-writes-to-read-only-vma.patch
new file mode 100644
index 0000000..129c4d0
--- /dev/null
+++ b/queue-6.19/drm-xe-xe_pagefault-disallow-writes-to-read-only-vma.patch

@@ -0,0 +1,50 @@
+From 30eebb5febe0d774cb9463cd70abeaa93a5857b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Mar 2026 15:29:37 +0000
+Subject: drm/xe/xe_pagefault: Disallow writes to read-only VMAs
+
+From: Jonathan Cavitt <jonathan.cavitt@intel.com>
+
+[ Upstream commit 6d192b4f2d644d15d9a9f1d33dab05af936f6540 ]
+
+The page fault handler should reject write/atomic access to read only
+VMAs.  Add code to handle this in xe_pagefault_service after the VMA
+lookup.
+
+v2:
+- Apply max line length (Matthew)
+
+Fixes: fb544b844508 ("drm/xe: Implement xe_pagefault_queue_work")
+Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Suggested-by: Matthew Brost <matthew.brost@intel.com>
+Cc: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260324152935.72444-7-jonathan.cavitt@intel.com
+(cherry picked from commit 714ee6754ac5fa3dc078856a196a6b124cd797a0)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_pagefault.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/xe/xe_pagefault.c b/drivers/gpu/drm/xe/xe_pagefault.c
+index afb06598b6e1a..0b625a52a5984 100644
+--- a/drivers/gpu/drm/xe/xe_pagefault.c
++++ b/drivers/gpu/drm/xe/xe_pagefault.c
+@@ -187,6 +187,12 @@ static int xe_pagefault_service(struct xe_pagefault *pf)
+ 		goto unlock_vm;
+ 	}
+ 
++	if (xe_vma_read_only(vma) &&
++	    pf->consumer.access_type != XE_PAGEFAULT_ACCESS_TYPE_READ) {
++		err = -EPERM;
++		goto unlock_vm;
++	}
++
+ 	atomic = xe_pagefault_access_is_atomic(pf->consumer.access_type);
+ 
+ 	if (xe_vma_is_cpu_addr_mirror(vma))
+-- 
+2.53.0
+

diff --git a/queue-6.19/dt-bindings-gpio-fix-microchip-interrupt-cells.patch b/queue-6.19/dt-bindings-gpio-fix-microchip-interrupt-cells.patch
new file mode 100644
index 0000000..e050e73
--- /dev/null
+++ b/queue-6.19/dt-bindings-gpio-fix-microchip-interrupt-cells.patch

@@ -0,0 +1,47 @@
+From 1a68ba00e7c6bf166212e811f7157dbeebe231c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml         | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index 184432d24ea18..f42c54653d521 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -37,7 +37,7 @@ properties:
+     const: 2
+ 
+   "#interrupt-cells":
+-    const: 1
++    const: 2
+ 
+   ngpios:
+     description:
+@@ -86,7 +86,7 @@ examples:
+         gpio-controller;
+         #gpio-cells = <2>;
+         interrupt-controller;
+-        #interrupt-cells = <1>;
++        #interrupt-cells = <2>;
+         interrupts = <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+-- 
+2.53.0
+

diff --git a/queue-6.19/gpio-qixis-fpga-fix-error-handling-for-devm_regmap_i.patch b/queue-6.19/gpio-qixis-fpga-fix-error-handling-for-devm_regmap_i.patch
new file mode 100644
index 0000000..c056f2b
--- /dev/null
+++ b/queue-6.19/gpio-qixis-fpga-fix-error-handling-for-devm_regmap_i.patch

@@ -0,0 +1,41 @@
+From ea8a66b5940b0a4dd572063c317218918e2fe0af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2026 22:56:38 +0800
+Subject: gpio: qixis-fpga: Fix error handling for devm_regmap_init_mmio()
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 8de4e0f44c638c66cdc5eeb4d5ab9acd61c31e4f ]
+
+devm_regmap_init_mmio() returns an ERR_PTR() on failure, not NULL.
+The original code checked for NULL which would never trigger on error,
+potentially leading to an invalid pointer dereference.
+Use IS_ERR() and PTR_ERR() to properly handle the error case.
+
+Fixes: e88500247dc3 ("gpio: add QIXIS FPGA GPIO controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260320-qixis-v1-1-a8efc22e8945@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-qixis-fpga.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-qixis-fpga.c b/drivers/gpio/gpio-qixis-fpga.c
+index 6e67f43ac0bdd..3ced47db1521c 100644
+--- a/drivers/gpio/gpio-qixis-fpga.c
++++ b/drivers/gpio/gpio-qixis-fpga.c
+@@ -60,8 +60,8 @@ static int qixis_cpld_gpio_probe(struct platform_device *pdev)
+ 			return PTR_ERR(reg);
+ 
+ 		regmap = devm_regmap_init_mmio(&pdev->dev, reg, &regmap_config_8r_8v);
+-		if (!regmap)
+-			return -ENODEV;
++		if (IS_ERR(regmap))
++			return PTR_ERR(regmap);
+ 
+ 		/* In this case, the offset of our register is 0 inside the
+ 		 * regmap area that we just created.
+-- 
+2.53.0
+

diff --git a/queue-6.19/gpio-shared-call-gpio_chip-of_xlate-if-set.patch b/queue-6.19/gpio-shared-call-gpio_chip-of_xlate-if-set.patch
new file mode 100644
index 0000000..c69f9cc
--- /dev/null
+++ b/queue-6.19/gpio-shared-call-gpio_chip-of_xlate-if-set.patch

@@ -0,0 +1,130 @@
+From 39a413521a63a48a7086f28c37e1cca850f21338 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 15:00:53 +0100
+Subject: gpio: shared: call gpio_chip::of_xlate() if set
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 710abda58055ed5eaa8958107633cc12a365c328 ]
+
+OF-based GPIO controller drivers may provide a translation function that
+calculates the real chip offset from whatever devicetree sources
+provide. We need to take this into account in the shared GPIO management
+and call of_xlate() if it's provided and adjust the entry->offset we
+initially set when scanning the tree.
+
+To that end: modify the shared GPIO API to take the GPIO chip as
+argument on setup (to avoid having to rcu_dereference() it from the GPIO
+device) and protect the access to entry->offset with the existing lock.
+
+Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-1-0ce34c707e81@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 27 ++++++++++++++++++++++++++-
+ drivers/gpio/gpiolib-shared.h |  4 ++--
+ drivers/gpio/gpiolib.c        |  2 +-
+ 3 files changed, 29 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index e16f467b72e7a..6316ae5a1c310 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -511,8 +511,9 @@ static void gpio_shared_remove_adev(struct auxiliary_device *adev)
+ 	auxiliary_device_uninit(adev);
+ }
+ 
+-int gpio_device_setup_shared(struct gpio_device *gdev)
++int gpiochip_setup_shared(struct gpio_chip *gc)
+ {
++	struct gpio_device *gdev = gc->gpiodev;
+ 	struct gpio_shared_entry *entry;
+ 	struct gpio_shared_ref *ref;
+ 	struct gpio_desc *desc;
+@@ -537,12 +538,34 @@ int gpio_device_setup_shared(struct gpio_device *gdev)
+ 	 * exposing shared pins. Find them and create the proxy devices.
+ 	 */
+ 	list_for_each_entry(entry, &gpio_shared_list, list) {
++		guard(mutex)(&entry->lock);
++
+ 		if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ 			continue;
+ 
+ 		if (list_count_nodes(&entry->refs) <= 1)
+ 			continue;
+ 
++#if IS_ENABLED(CONFIG_OF)
++		if (is_of_node(entry->fwnode) && gc->of_xlate) {
++			/*
++			 * This is the earliest that we can tranlate the
++			 * devicetree offset to the chip offset.
++			 */
++			struct of_phandle_args gpiospec = { };
++
++			gpiospec.np = to_of_node(entry->fwnode);
++			gpiospec.args_count = 2;
++			gpiospec.args[0] = entry->offset;
++
++			ret = gc->of_xlate(gc, &gpiospec, NULL);
++			if (ret < 0)
++				return ret;
++
++			entry->offset = ret;
++		}
++#endif /* CONFIG_OF */
++
+ 		desc = &gdev->descs[entry->offset];
+ 
+ 		__set_bit(GPIOD_FLAG_SHARED, &desc->flags);
+@@ -580,6 +603,8 @@ void gpio_device_teardown_shared(struct gpio_device *gdev)
+ 	struct gpio_shared_ref *ref;
+ 
+ 	list_for_each_entry(entry, &gpio_shared_list, list) {
++		guard(mutex)(&entry->lock);
++
+ 		if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ 			continue;
+ 
+diff --git a/drivers/gpio/gpiolib-shared.h b/drivers/gpio/gpiolib-shared.h
+index 40568ef7364cc..e11e260e1f590 100644
+--- a/drivers/gpio/gpiolib-shared.h
++++ b/drivers/gpio/gpiolib-shared.h
+@@ -14,14 +14,14 @@ struct device;
+ 
+ #if IS_ENABLED(CONFIG_GPIO_SHARED)
+ 
+-int gpio_device_setup_shared(struct gpio_device *gdev);
++int gpiochip_setup_shared(struct gpio_chip *gc);
+ void gpio_device_teardown_shared(struct gpio_device *gdev);
+ int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+ 				 unsigned long lflags);
+ 
+ #else
+ 
+-static inline int gpio_device_setup_shared(struct gpio_device *gdev)
++static inline int gpiochip_setup_shared(struct gpio_chip *gc)
+ {
+ 	return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 04068f4eb3422..0285142893642 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1211,7 +1211,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 	if (ret)
+ 		goto err_remove_irqchip_mask;
+ 
+-	ret = gpio_device_setup_shared(gdev);
++	ret = gpiochip_setup_shared(gc);
+ 	if (ret)
+ 		goto err_remove_irqchip;
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/gpio-shared-handle-pins-shared-by-child-nodes-of-dev.patch b/queue-6.19/gpio-shared-handle-pins-shared-by-child-nodes-of-dev.patch
new file mode 100644
index 0000000..399f69d
--- /dev/null
+++ b/queue-6.19/gpio-shared-handle-pins-shared-by-child-nodes-of-dev.patch

@@ -0,0 +1,100 @@
+From b68719fbe0b8c8c65e3f7889edc9c9a0efc79895 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 15:00:54 +0100
+Subject: gpio: shared: handle pins shared by child nodes of devices
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit ec42a3a90ae9ae64b16d01a2e5d32ec0865ca8cf ]
+
+Shared GPIOs may be assigned to child nodes of device nodes which don't
+themselves bind to any struct device. We need to pass the firmware node
+that is the actual consumer to gpiolib-shared and compare against it
+instead of unconditionally using the fwnode of the consumer device.
+
+Fixes: a060b8c511ab ("gpiolib: implement low-level, shared GPIO support")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Closes: https://lore.kernel.org/all/921ba8ce-b18e-4a99-966d-c763d22081e2@nvidia.com/
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://patch.msgid.link/20260318-gpio-shared-xlate-v2-2-0ce34c707e81@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 6 +++---
+ drivers/gpio/gpiolib-shared.h | 7 +++++--
+ drivers/gpio/gpiolib.c        | 4 ++--
+ 3 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index 6316ae5a1c310..9c31736d29b77 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -443,8 +443,8 @@ static bool gpio_shared_dev_is_reset_gpio(struct device *consumer,
+ }
+ #endif /* CONFIG_RESET_GPIO */
+ 
+-int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+-				 unsigned long lflags)
++int gpio_shared_add_proxy_lookup(struct device *consumer, struct fwnode_handle *fwnode,
++				 const char *con_id, unsigned long lflags)
+ {
+ 	const char *dev_id = dev_name(consumer);
+ 	struct gpiod_lookup_table *lookup;
+@@ -463,7 +463,7 @@ int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+ 			if (!ref->fwnode && strstarts(dev_name(consumer), "reset.gpio.")) {
+ 				if (!gpio_shared_dev_is_reset_gpio(consumer, entry, ref))
+ 					continue;
+-			} else if (!device_match_fwnode(consumer, ref->fwnode)) {
++			} else if (fwnode != ref->fwnode) {
+ 				continue;
+ 			}
+ 
+diff --git a/drivers/gpio/gpiolib-shared.h b/drivers/gpio/gpiolib-shared.h
+index e11e260e1f590..15e72a8dcdb13 100644
+--- a/drivers/gpio/gpiolib-shared.h
++++ b/drivers/gpio/gpiolib-shared.h
+@@ -11,13 +11,15 @@
+ struct gpio_device;
+ struct gpio_desc;
+ struct device;
++struct fwnode_handle;
+ 
+ #if IS_ENABLED(CONFIG_GPIO_SHARED)
+ 
+ int gpiochip_setup_shared(struct gpio_chip *gc);
+ void gpio_device_teardown_shared(struct gpio_device *gdev);
+-int gpio_shared_add_proxy_lookup(struct device *consumer, const char *con_id,
+-				 unsigned long lflags);
++int gpio_shared_add_proxy_lookup(struct device *consumer,
++				 struct fwnode_handle *fwnode,
++				 const char *con_id, unsigned long lflags);
+ 
+ #else
+ 
+@@ -29,6 +31,7 @@ static inline int gpiochip_setup_shared(struct gpio_chip *gc)
+ static inline void gpio_device_teardown_shared(struct gpio_device *gdev) { }
+ 
+ static inline int gpio_shared_add_proxy_lookup(struct device *consumer,
++					       struct fwnode_handle *fwnode,
+ 					       const char *con_id,
+ 					       unsigned long lflags)
+ {
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 0285142893642..fc7c4bf2de2be 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -4720,8 +4720,8 @@ struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+ 			 * lookup table for the proxy device as previously
+ 			 * we only knew the consumer's fwnode.
+ 			 */
+-			ret = gpio_shared_add_proxy_lookup(consumer, con_id,
+-							   lookupflags);
++			ret = gpio_shared_add_proxy_lookup(consumer, fwnode,
++							   con_id, lookupflags);
+ 			if (ret)
+ 				return ERR_PTR(ret);
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/gpio-shared-shorten-the-critical-section-in-gpiochip.patch b/queue-6.19/gpio-shared-shorten-the-critical-section-in-gpiochip.patch
new file mode 100644
index 0000000..b36c8a2
--- /dev/null
+++ b/queue-6.19/gpio-shared-shorten-the-critical-section-in-gpiochip.patch

@@ -0,0 +1,110 @@
+From 00331637c0b34f84724e076366231b827a3e83b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Mar 2026 12:06:38 +0100
+Subject: gpio: shared: shorten the critical section in gpiochip_setup_shared()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+
+[ Upstream commit 310a4a9cbb17037668ea440f6a3964d00705b400 ]
+
+Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set")
+introduced a critical section around the adjustmenet of entry->offset.
+However this may cause a deadlock if we create the auxiliary shared
+proxy devices with this lock taken. We only need to protect
+entry->offset while it's read/written so shorten the critical section
+and release the lock before creating the proxy device as the field in
+question is no longer accessed at this point.
+
+Fixes: 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set")
+Reported-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260325-gpio-shared-deadlock-v1-1-e4e7a5319e95@oss.qualcomm.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-shared.c | 56 +++++++++++++++++------------------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-shared.c b/drivers/gpio/gpiolib-shared.c
+index 9c31736d29b77..692f568ffe7a4 100644
+--- a/drivers/gpio/gpiolib-shared.c
++++ b/drivers/gpio/gpiolib-shared.c
+@@ -538,48 +538,48 @@ int gpiochip_setup_shared(struct gpio_chip *gc)
+ 	 * exposing shared pins. Find them and create the proxy devices.
+ 	 */
+ 	list_for_each_entry(entry, &gpio_shared_list, list) {
+-		guard(mutex)(&entry->lock);
+-
+ 		if (!device_match_fwnode(&gdev->dev, entry->fwnode))
+ 			continue;
+ 
+ 		if (list_count_nodes(&entry->refs) <= 1)
+ 			continue;
+ 
++		scoped_guard(mutex, &entry->lock) {
+ #if IS_ENABLED(CONFIG_OF)
+-		if (is_of_node(entry->fwnode) && gc->of_xlate) {
+-			/*
+-			 * This is the earliest that we can tranlate the
+-			 * devicetree offset to the chip offset.
+-			 */
+-			struct of_phandle_args gpiospec = { };
++			if (is_of_node(entry->fwnode) && gc->of_xlate) {
++				/*
++				 * This is the earliest that we can tranlate the
++				 * devicetree offset to the chip offset.
++				 */
++				struct of_phandle_args gpiospec = { };
+ 
+-			gpiospec.np = to_of_node(entry->fwnode);
+-			gpiospec.args_count = 2;
+-			gpiospec.args[0] = entry->offset;
++				gpiospec.np = to_of_node(entry->fwnode);
++				gpiospec.args_count = 2;
++				gpiospec.args[0] = entry->offset;
+ 
+-			ret = gc->of_xlate(gc, &gpiospec, NULL);
+-			if (ret < 0)
+-				return ret;
++				ret = gc->of_xlate(gc, &gpiospec, NULL);
++				if (ret < 0)
++					return ret;
+ 
+-			entry->offset = ret;
+-		}
++				entry->offset = ret;
++			}
+ #endif /* CONFIG_OF */
+ 
+-		desc = &gdev->descs[entry->offset];
++			desc = &gdev->descs[entry->offset];
+ 
+-		__set_bit(GPIOD_FLAG_SHARED, &desc->flags);
+-		/*
+-		 * Shared GPIOs are not requested via the normal path. Make
+-		 * them inaccessible to anyone even before we register the
+-		 * chip.
+-		 */
+-		ret = gpiod_request_commit(desc, "shared");
+-		if (ret)
+-			return ret;
++			__set_bit(GPIOD_FLAG_SHARED, &desc->flags);
++			/*
++			 * Shared GPIOs are not requested via the normal path. Make
++			 * them inaccessible to anyone even before we register the
++			 * chip.
++			 */
++			ret = gpiod_request_commit(desc, "shared");
++			if (ret)
++				return ret;
+ 
+-		pr_debug("GPIO %u owned by %s is shared by multiple consumers\n",
+-			 entry->offset, gpio_device_get_label(gdev));
++			pr_debug("GPIO %u owned by %s is shared by multiple consumers\n",
++				 entry->offset, gpio_device_get_label(gdev));
++		}
+ 
+ 		list_for_each_entry(ref, &entry->refs, list) {
+ 			pr_debug("Setting up a shared GPIO entry for %s (con_id: '%s')\n",
+-- 
+2.53.0
+

diff --git a/queue-6.19/gpiolib-clear-requested-flag-if-line-is-invalid.patch b/queue-6.19/gpiolib-clear-requested-flag-if-line-is-invalid.patch
new file mode 100644
index 0000000..c3a9c6c
--- /dev/null
+++ b/queue-6.19/gpiolib-clear-requested-flag-if-line-is-invalid.patch

@@ -0,0 +1,48 @@
+From 7d877eee571645ab0660b6163ad3b6e57a40a0b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2026 20:44:03 +0000
+Subject: gpiolib: clear requested flag if line is invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Barnabás Pőcze <pobrn@protonmail.com>
+
+[ Upstream commit 6df6ea4b3d1567dbe6442f308735c23b63007c7f ]
+
+If `gpiochip_line_is_valid()` fails, then `-EINVAL` is returned, but
+`desc->flags` will have `GPIOD_FLAG_REQUESTED` set, which will result
+in subsequent calls misleadingly returning `-EBUSY`.
+
+Fix that by clearing the flag in case of failure.
+
+Fixes: a501624864f3 ("gpio: Respect valid_mask when requesting GPIOs")
+Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Link: https://patch.msgid.link/20260310204359.1202451-1-pobrn@protonmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 2e33afbbfda48..04068f4eb3422 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2466,8 +2466,10 @@ int gpiod_request_commit(struct gpio_desc *desc, const char *label)
+ 		return -EBUSY;
+ 
+ 	offset = gpiod_hwgpio(desc);
+-	if (!gpiochip_line_is_valid(guard.gc, offset))
+-		return -EINVAL;
++	if (!gpiochip_line_is_valid(guard.gc, offset)) {
++		ret = -EINVAL;
++		goto out_clear_bit;
++	}
+ 
+ 	/* NOTE:  gpio_request() can be called in early boot,
+ 	 * before IRQs are enabled, for non-sleeping (SOC) GPIOs.
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch b/queue-6.19/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
new file mode 100644
index 0000000..8e89433
--- /dev/null
+++ b/queue-6.19/hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch

@@ -0,0 +1,76 @@
+From 590d5bd41a2b19a3ca387204a6fd42b7bc3bd67a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 14:49:06 -0700
+Subject: hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Corey Hickey <bugfood-c@fatooh.org>
+
+[ Upstream commit cffff6df669a438ecac506dadd49a53d4475a796 ]
+
+On the Asus PRIME X670E-PRO WIFI, the driver reports a constant value of
+zero for T_Sensor. On this board, the register for T_Sensor is at a
+different address, as found by experimentation and confirmed by
+comparison to an independent temperature reading.
+
+* sensor disconnected: -62.0°C
+* ambient temperature: +22.0°C
+* held between fingers: +30.0°C
+
+Introduce SENSOR_TEMP_T_SENSOR_ALT1 to support the PRIME X670E-PRO WIFI
+without causing a regression for other 600-series boards
+
+Fixes: e0444758dd1b ("hwmon: (asus-ec-sensors) add PRIME X670E-PRO WIFI")
+Signed-off-by: Corey Hickey <bugfood-c@fatooh.org>
+Link: https://lore.kernel.org/r/20260331215414.368785-1-bugfood-ml@fatooh.org
+[groeck: Fixed typo, updated Fixes: reference]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/asus-ec-sensors.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/asus-ec-sensors.c b/drivers/hwmon/asus-ec-sensors.c
+index a1445799e23d8..b685d9954df43 100644
+--- a/drivers/hwmon/asus-ec-sensors.c
++++ b/drivers/hwmon/asus-ec-sensors.c
+@@ -111,6 +111,8 @@ enum ec_sensors {
+ 	ec_sensor_temp_mb,
+ 	/* "T_Sensor" temperature sensor reading [℃] */
+ 	ec_sensor_temp_t_sensor,
++	/* like ec_sensor_temp_t_sensor, but at an alternate address [℃] */
++	ec_sensor_temp_t_sensor_alt1,
+ 	/* VRM temperature [℃] */
+ 	ec_sensor_temp_vrm,
+ 	/* VRM east (right) temperature [℃] */
+@@ -160,6 +162,7 @@ enum ec_sensors {
+ #define SENSOR_TEMP_CPU_PACKAGE BIT(ec_sensor_temp_cpu_package)
+ #define SENSOR_TEMP_MB BIT(ec_sensor_temp_mb)
+ #define SENSOR_TEMP_T_SENSOR BIT(ec_sensor_temp_t_sensor)
++#define SENSOR_TEMP_T_SENSOR_ALT1 BIT(ec_sensor_temp_t_sensor_alt1)
+ #define SENSOR_TEMP_VRM BIT(ec_sensor_temp_vrm)
+ #define SENSOR_TEMP_VRME BIT(ec_sensor_temp_vrme)
+ #define SENSOR_TEMP_VRMW BIT(ec_sensor_temp_vrmw)
+@@ -279,6 +282,8 @@ static const struct ec_sensor_info sensors_family_amd_600[] = {
+ 		EC_SENSOR("VRM", hwmon_temp, 1, 0x00, 0x33),
+ 	[ec_sensor_temp_t_sensor] =
+ 		EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x36),
++	[ec_sensor_temp_t_sensor_alt1] =
++		EC_SENSOR("T_Sensor", hwmon_temp, 1, 0x00, 0x37),
+ 	[ec_sensor_fan_cpu_opt] =
+ 		EC_SENSOR("CPU_Opt", hwmon_fan, 2, 0x00, 0xb0),
+ 	[ec_sensor_temp_water_in] =
+@@ -509,7 +514,7 @@ static const struct ec_board_info board_info_prime_x570_pro = {
+ static const struct ec_board_info board_info_prime_x670e_pro_wifi = {
+ 	.sensors = SENSOR_TEMP_CPU | SENSOR_TEMP_CPU_PACKAGE |
+ 		SENSOR_TEMP_MB | SENSOR_TEMP_VRM |
+-		SENSOR_TEMP_T_SENSOR | SENSOR_FAN_CPU_OPT,
++		SENSOR_TEMP_T_SENSOR_ALT1 | SENSOR_FAN_CPU_OPT,
+ 	.mutex_path = ACPI_GLOBAL_LOCK_PSEUDO_PATH,
+ 	.family = family_amd_600_series,
+ };
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch b/queue-6.19/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
new file mode 100644
index 0000000..ff0ba46
--- /dev/null
+++ b/queue-6.19/hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch

@@ -0,0 +1,35 @@
+From c33192b96de63b4f98ae1d5436a3ba78938ccf3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:53 +0000
+Subject: hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit a9d2fbd3ad0e6ac588386e699beeccfe7516755f ]
+
+ltc4286.c uses PMBus core symbols exported in the PMBUS namespace,
+such as pmbus_do_probe(), but does not declare MODULE_IMPORT_NS("PMBUS").
+
+Add the missing namespace import to avoid modpost warnings.
+
+Fixes: 0c459759ca97 ("hwmon: (pmbus) Add ltc4286 driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-5-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/ltc4286.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/hwmon/pmbus/ltc4286.c b/drivers/hwmon/pmbus/ltc4286.c
+index aabd0bcdfeee3..8715d380784a0 100644
+--- a/drivers/hwmon/pmbus/ltc4286.c
++++ b/drivers/hwmon/pmbus/ltc4286.c
+@@ -173,3 +173,4 @@ module_i2c_driver(ltc4286_driver);
+ MODULE_AUTHOR("Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>");
+ MODULE_DESCRIPTION("PMBUS driver for LTC4286 and compatibles");
+ MODULE_LICENSE("GPL");
++MODULE_IMPORT_NS("PMBUS");
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-6.19/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..ee3e515
--- /dev/null
+++ b/queue-6.19/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From 2d665645e09bc8540e060fcaffd970fee695ef01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 89928d38831b6..86c79156a46b9 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%4phN\n", extn->name);
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-6.19/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..489842e
--- /dev/null
+++ b/queue-6.19/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From cf5f58f1dd14b783eb039318a581d41ed590b0f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index 6a4a978eca7e8..24c1f961c7668 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch b/queue-6.19/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
new file mode 100644
index 0000000..221e454
--- /dev/null
+++ b/queue-6.19/hwmon-tps53679-fix-array-access-with-zero-length-blo.patch

@@ -0,0 +1,50 @@
+From 2b3aecff763491e1368efbdff15f30f0e8f755f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:40 +0000
+Subject: hwmon: (tps53679) Fix array access with zero-length block read
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 0e211f6aaa6a00fd0ee0c1eea5498f168c6725e6 ]
+
+i2c_smbus_read_block_data() can return 0, indicating a zero-length
+read. When this happens, tps53679_identify_chip() accesses buf[ret - 1]
+which is buf[-1], reading one byte before the buffer on the stack.
+
+Fix by changing the check from "ret < 0" to "ret <= 0", treating a
+zero-length read as an error (-EIO), which prevents the out-of-bounds
+array access.
+
+Also fix a typo in the adjacent comment: "if present" instead of
+duplicate "if".
+
+Fixes: 75ca1e5875fe ("hwmon: (pmbus/tps53679) Add support for TPS53685")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-2-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index ca2bfa25eb04c..3bca543817a60 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -103,10 +103,10 @@ static int tps53679_identify_chip(struct i2c_client *client,
+ 	}
+ 
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+-	if (ret < 0)
+-		return ret;
++	if (ret <= 0)
++		return ret < 0 ? ret : -EIO;
+ 
+-	/* Adjust length if null terminator if present */
++	/* Adjust length if null terminator is present */
+ 	buf_len = (buf[ret - 1] != '\x00' ? ret : ret - 1);
+ 
+ 	id_len = strlen(id);
+-- 
+2.53.0
+

diff --git a/queue-6.19/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-6.19/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..ab012af
--- /dev/null
+++ b/queue-6.19/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From 0f9159a358380a2e18f5d4e08a9daff2582f05f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 3bca543817a60..249974c13aa39 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -175,8 +175,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch b/queue-6.19/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
new file mode 100644
index 0000000..60c20be
--- /dev/null
+++ b/queue-6.19/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch

@@ -0,0 +1,43 @@
+From 4aa4e645b99bf86dc8e70fe46ed2156954cc8bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 303bc308f80a8..c96fec2ebb3e7 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG	0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG	0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG	0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG			0x34
+ #define BNO055_CALIB_STAT_REG		0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+-- 
+2.53.0
+

diff --git a/queue-6.19/interconnect-qcom-sm8450-fix-null-pointer-dereferenc.patch b/queue-6.19/interconnect-qcom-sm8450-fix-null-pointer-dereferenc.patch
new file mode 100644
index 0000000..5b798be
--- /dev/null
+++ b/queue-6.19/interconnect-qcom-sm8450-fix-null-pointer-dereferenc.patch

@@ -0,0 +1,72 @@
+From e9a63377a00c083dc9ce5a0e50c7d3c5269c4cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Mar 2026 03:29:33 +0200
+Subject: interconnect: qcom: sm8450: Fix NULL pointer dereference in
+ icc_link_nodes()
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit dbbd550d7c8d90d3af9fe8a12a9caff077ddb8e3 ]
+
+The change to dynamic IDs for SM8450 platform interconnects left two links
+unconverted, fix it to avoid the NULL pointer dereference in runtime,
+when a pointer to a destination interconnect is not valid:
+
+    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
+    <...>
+    Call trace:
+      icc_link_nodes+0x3c/0x100 (P)
+      qcom_icc_rpmh_probe+0x1b4/0x528
+      platform_probe+0x64/0xc0
+      really_probe+0xc4/0x2a8
+      __driver_probe_device+0x80/0x140
+      driver_probe_device+0x48/0x170
+      __device_attach_driver+0xc0/0x148
+      bus_for_each_drv+0x88/0xf0
+      __device_attach+0xb0/0x1c0
+      device_initial_probe+0x58/0x68
+      bus_probe_device+0x40/0xb8
+      deferred_probe_work_func+0x90/0xd0
+      process_one_work+0x15c/0x3c0
+      worker_thread+0x2e8/0x400
+      kthread+0x150/0x208
+      ret_from_fork+0x10/0x20
+     Code: 900310f4 911d6294 91008280 94176078 (f94002a0)
+     ---[ end trace 0000000000000000 ]---
+     Kernel panic - not syncing: Oops: Fatal exception
+
+Fixes: 51513bec806f ("interconnect: qcom: sm8450: convert to dynamic IDs")
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://msgid.link/20260314012933.350644-1-vladimir.zapolskiy@linaro.org
+Signed-off-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/interconnect/qcom/sm8450.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/interconnect/qcom/sm8450.c b/drivers/interconnect/qcom/sm8450.c
+index 669a638bf3efc..c88327d200acc 100644
+--- a/drivers/interconnect/qcom/sm8450.c
++++ b/drivers/interconnect/qcom/sm8450.c
+@@ -800,7 +800,7 @@ static struct qcom_icc_node qhs_compute_cfg = {
+ 	.channels = 1,
+ 	.buswidth = 4,
+ 	.num_links = 1,
+-	.link_nodes = { MASTER_CDSP_NOC_CFG },
++	.link_nodes = { &qhm_nsp_noc_config },
+ };
+ 
+ static struct qcom_icc_node qhs_cpr_cx = {
+@@ -874,7 +874,7 @@ static struct qcom_icc_node qhs_lpass_cfg = {
+ 	.channels = 1,
+ 	.buswidth = 4,
+ 	.num_links = 1,
+-	.link_nodes = { MASTER_CNOC_LPASS_AG_NOC },
++	.link_nodes = { &qhm_config_noc },
+ };
+ 
+ static struct qcom_icc_node qhs_mss_cfg = {
+-- 
+2.53.0
+

diff --git a/queue-6.19/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch b/queue-6.19/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
new file mode 100644
index 0000000..847b234
--- /dev/null
+++ b/queue-6.19/io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch

@@ -0,0 +1,60 @@
+From 649515ee6e2727b027afdc1d98dd2d819365280d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 00:49:36 +0800
+Subject: io_uring/rsrc: reject zero-length fixed buffer import
+
+From: Qi Tang <tpluszz77@gmail.com>
+
+[ Upstream commit 111a12b422a8cfa93deabaef26fec48237163214 ]
+
+validate_fixed_range() admits buf_addr at the exact end of the
+registered region when len is zero, because the check uses strict
+greater-than (buf_end > imu->ubuf + imu->len).  io_import_fixed()
+then computes offset == imu->len, which causes the bvec skip logic
+to advance past the last bio_vec entry and read bv_offset from
+out-of-bounds slab memory.
+
+Return early from io_import_fixed() when len is zero.  A zero-length
+import has no data to transfer and should not walk the bvec array
+at all.
+
+  BUG: KASAN: slab-out-of-bounds in io_import_reg_buf+0x697/0x7f0
+  Read of size 4 at addr ffff888002bcc254 by task poc/103
+  Call Trace:
+   io_import_reg_buf+0x697/0x7f0
+   io_write_fixed+0xd9/0x250
+   __io_issue_sqe+0xad/0x710
+   io_issue_sqe+0x7d/0x1100
+   io_submit_sqes+0x86a/0x23c0
+   __do_sys_io_uring_enter+0xa98/0x1590
+  Allocated by task 103:
+  The buggy address is located 12 bytes to the right of
+   allocated 584-byte region [ffff888002bcc000, ffff888002bcc248)
+
+Fixes: 8622b20f23ed ("io_uring: add validate_fixed_range() for validate fixed buffer")
+Signed-off-by: Qi Tang <tpluszz77@gmail.com>
+Link: https://patch.msgid.link/20260329164936.240871-1-tpluszz77@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rsrc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
+index 41c89f5c616da..81446f9649ae9 100644
+--- a/io_uring/rsrc.c
++++ b/io_uring/rsrc.c
+@@ -1084,6 +1084,10 @@ static int io_import_fixed(int ddir, struct iov_iter *iter,
+ 		return ret;
+ 	if (!(imu->dir & (1 << ddir)))
+ 		return -EFAULT;
++	if (unlikely(!len)) {
++		iov_iter_bvec(iter, ddir, NULL, 0, 0);
++		return 0;
++	}
+ 
+ 	offset = buf_addr - imu->ubuf;
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/irqchip-riscv-aplic-restrict-genpd-notifier-to-devic.patch b/queue-6.19/irqchip-riscv-aplic-restrict-genpd-notifier-to-devic.patch
new file mode 100644
index 0000000..be3dbf9
--- /dev/null
+++ b/queue-6.19/irqchip-riscv-aplic-restrict-genpd-notifier-to-devic.patch

@@ -0,0 +1,61 @@
+From ecc42e7a617c37b42d674a32d19417caef93a0e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Mar 2026 09:30:29 +0800
+Subject: irqchip/riscv-aplic: Restrict genpd notifier to device tree only
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jessica Liu <liu.xuemei1@zte.com.cn>
+
+[ Upstream commit af416cd9b3fb9d17ac7f4cfa12d1ea83dfd0e4be ]
+
+On ACPI systems, the aplic's pm_domain is set to acpi_general_pm_domain,
+which provides its own power management callbacks (e.g., runtime_suspend
+via acpi_subsys_runtime_suspend).
+
+aplic_pm_add() unconditionally calls dev_pm_genpd_add_notifier() when
+dev->pm_domain is non‑NULL, leading to a comparison between runtime_suspend
+and genpd_runtime_suspend. This results in the following errors when ACPI
+is enabled:
+
+  riscv-aplic RSCV0002:00: failed to create APLIC context
+  riscv-aplic RSCV0002:00: error -ENODEV: failed to setup APLIC in MSI mode
+
+Fix this by checking for dev->of_node before adding or removing the genpd
+notifier, ensuring it is only used for device tree based systems.
+
+Fixes: 95a8ddde3660 ("irqchip/riscv-aplic: Preserve APLIC states across suspend/resume")
+Signed-off-by: Jessica Liu <liu.xuemei1@zte.com.cn>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Link: https://patch.msgid.link/20260331093029749vRpdH-0qoEqjS0Wnn9M4x@zte.com.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-aplic-main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-riscv-aplic-main.c b/drivers/irqchip/irq-riscv-aplic-main.c
+index 9f53979b69625..d9afb6ae98cf5 100644
+--- a/drivers/irqchip/irq-riscv-aplic-main.c
++++ b/drivers/irqchip/irq-riscv-aplic-main.c
+@@ -150,7 +150,7 @@ static void aplic_pm_remove(void *data)
+ 	struct device *dev = priv->dev;
+ 
+ 	list_del(&priv->head);
+-	if (dev->pm_domain)
++	if (dev->pm_domain && dev->of_node)
+ 		dev_pm_genpd_remove_notifier(dev);
+ }
+ 
+@@ -165,7 +165,7 @@ static int aplic_pm_add(struct device *dev, struct aplic_priv *priv)
+ 
+ 	priv->saved_hw_regs.srcs = srcs;
+ 	list_add(&priv->head, &aplics);
+-	if (dev->pm_domain) {
++	if (dev->pm_domain && dev->of_node) {
+ 		priv->genpd_nb.notifier_call = aplic_pm_notifier;
+ 		ret = dev_pm_genpd_add_notifier(dev, &priv->genpd_nb);
+ 		if (ret)
+-- 
+2.53.0
+

diff --git a/queue-6.19/mips-ralink-update-cpu-clock-index.patch b/queue-6.19/mips-ralink-update-cpu-clock-index.patch
new file mode 100644
index 0000000..7960406
--- /dev/null
+++ b/queue-6.19/mips-ralink-update-cpu-clock-index.patch

@@ -0,0 +1,49 @@
+From c880f59374bf6ac78acc1ccf49a28dfac7bd404d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ 	switch (ralink_soc) {
+ 	case RT2880_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt2880-sysc";
+ 	case RT3883_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3883-sysc";
+ 	case RT305X_SOC_RT3050:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3050-sysc";
+ 	case RT305X_SOC_RT3052:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3052-sysc";
+ 	case RT305X_SOC_RT3350:
+ 		*idx = 1;
+-- 
+2.53.0
+

diff --git a/queue-6.19/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch b/queue-6.19/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
new file mode 100644
index 0000000..06021a4
--- /dev/null
+++ b/queue-6.19/perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch

@@ -0,0 +1,46 @@
+From 5b6bfac703f41c991d0e600814a7cb7b1e7db88b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Mar 2026 12:43:05 -0700
+Subject: perf/x86: Fix potential bad container_of in intel_pmu_hw_config
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit dbde07f06226438cd2cf1179745fa1bec5d8914a ]
+
+Auto counter reload may have a group of events with software events
+present within it. The software event PMU isn't the x86_hybrid_pmu and
+a container_of operation in intel_pmu_set_acr_caused_constr (via the
+hybrid helper) could cause out of bound memory reads. Avoid this by
+guarding the call to intel_pmu_set_acr_caused_constr with an
+is_x86_event check.
+
+Fixes: ec980e4facef ("perf/x86/intel: Support auto counter reload")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Thomas Falcon <thomas.falcon@intel.com>
+Link: https://patch.msgid.link/20260312194305.1834035-1-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index 20f078ceb51da..bebaac1dbaeb3 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4594,8 +4594,10 @@ static int intel_pmu_hw_config(struct perf_event *event)
+ 		intel_pmu_set_acr_caused_constr(leader, idx++, cause_mask);
+ 
+ 		if (leader->nr_siblings) {
+-			for_each_sibling_event(sibling, leader)
+-				intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++			for_each_sibling_event(sibling, leader) {
++				if (is_x86_event(sibling))
++					intel_pmu_set_acr_caused_constr(sibling, idx++, cause_mask);
++			}
+ 		}
+ 
+ 		if (leader != event)
+-- 
+2.53.0
+

diff --git a/queue-6.19/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-6.19/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..7f83394
--- /dev/null
+++ b/queue-6.19/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From 70e8ae24d49533fc9c2f37a95323beefc1b1cc03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 15fec5d1e6dec..0bf629204c76a 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch b/queue-6.19/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
new file mode 100644
index 0000000..d053fed
--- /dev/null
+++ b/queue-6.19/riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch

@@ -0,0 +1,44 @@
+From 7d44c0151156d9b65442dde2c893f09d294f035d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 00:00:22 +0800
+Subject: riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
+
+From: Zishun Yi <vulab@iscas.ac.cn>
+
+[ Upstream commit 3033b2b1e3949274f33a140e2a97571b5a307298 ]
+
+In set_tagged_addr_ctrl(), when PR_TAGGED_ADDR_ENABLE is not set, pmlen
+is correctly set to 0, but it forgets to reset pmm. This results in the
+CPU pmm state not corresponding to the software pmlen state.
+
+Fix this by resetting pmm along with pmlen.
+
+Fixes: 2e1743085887 ("riscv: Add support for the tagged address ABI")
+Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
+Reviewed-by: Samuel Holland <samuel.holland@sifive.com>
+Link: https://patch.msgid.link/20260322160022.21908-1-vulab@iscas.ac.cn
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/process.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 31a392993cb45..b5188dc74727d 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -324,8 +324,10 @@ long set_tagged_addr_ctrl(struct task_struct *task, unsigned long arg)
+ 	if (arg & PR_TAGGED_ADDR_ENABLE && (tagged_addr_disabled || !pmlen))
+ 		return -EINVAL;
+ 
+-	if (!(arg & PR_TAGGED_ADDR_ENABLE))
++	if (!(arg & PR_TAGGED_ADDR_ENABLE)) {
+ 		pmlen = PMLEN_0;
++		pmm = ENVCFG_PMM_PMLEN_0;
++	}
+ 
+ 	if (mmap_write_lock_killable(mm))
+ 		return -EINTR;
+-- 
+2.53.0
+

diff --git a/queue-6.19/sched-debug-fix-avg_vruntime-usage.patch b/queue-6.19/sched-debug-fix-avg_vruntime-usage.patch
new file mode 100644
index 0000000..fba7f4b
--- /dev/null
+++ b/queue-6.19/sched-debug-fix-avg_vruntime-usage.patch

@@ -0,0 +1,63 @@
+From 4afc6d3204066f838704619459d1cad2315b8480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:21 +0200
+Subject: sched/debug: Fix avg_vruntime() usage
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit e08d007f9d813616ce7093600bc4fdb9c9d81d89 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The commit in question changes avg_vruntime() from a function that is
+a pure reader, to a function that updates variables. This turns an
+unlocked sched/debug usage of this function from a minor mistake into
+a data corruptor.
+
+Fixes: af4cf40470c2 ("sched/fair: Add cfs_rq::avg_vruntime")
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.196370805@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/debug.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
+index 93f009e1076d8..3504ec9bd7307 100644
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -798,6 +798,7 @@ static void print_rq(struct seq_file *m, struct rq *rq, int rq_cpu)
+ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ {
+ 	s64 left_vruntime = -1, zero_vruntime, right_vruntime = -1, left_deadline = -1, spread;
++	u64 avruntime;
+ 	struct sched_entity *last, *first, *root;
+ 	struct rq *rq = cpu_rq(cpu);
+ 	unsigned long flags;
+@@ -821,6 +822,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ 	if (last)
+ 		right_vruntime = last->vruntime;
+ 	zero_vruntime = cfs_rq->zero_vruntime;
++	avruntime = avg_vruntime(cfs_rq);
+ 	raw_spin_rq_unlock_irqrestore(rq, flags);
+ 
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "left_deadline",
+@@ -830,7 +832,7 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "zero_vruntime",
+ 			SPLIT_NS(zero_vruntime));
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "avg_vruntime",
+-			SPLIT_NS(avg_vruntime(cfs_rq)));
++			SPLIT_NS(avruntime));
+ 	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "right_vruntime",
+ 			SPLIT_NS(right_vruntime));
+ 	spread = right_vruntime - left_vruntime;
+-- 
+2.53.0
+

diff --git a/queue-6.19/sched-fair-fix-zero_vruntime-tracking-fix.patch b/queue-6.19/sched-fair-fix-zero_vruntime-tracking-fix.patch
new file mode 100644
index 0000000..3633954
--- /dev/null
+++ b/queue-6.19/sched-fair-fix-zero_vruntime-tracking-fix.patch

@@ -0,0 +1,103 @@
+From 56840127a764d1b5d45b1abac2ff495612031b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Apr 2026 15:20:20 +0200
+Subject: sched/fair: Fix zero_vruntime tracking fix
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 1319ea57529e131822bab56bf417c8edc2db9ae8 ]
+
+John reported that stress-ng-yield could make his machine unhappy and
+managed to bisect it to commit b3d99f43c72b ("sched/fair: Fix
+zero_vruntime tracking").
+
+The combination of yield and that commit was specific enough to
+hypothesize the following scenario:
+
+Suppose we have 2 runnable tasks, both doing yield. Then one will be
+eligible and one will not be, because the average position must be in
+between these two entities.
+
+Therefore, the runnable task will be eligible, and be promoted a full
+slice (all the tasks do is yield after all). This causes it to jump over
+the other task and now the other task is eligible and current is no
+longer. So we schedule.
+
+Since we are runnable, there is no {de,en}queue. All we have is the
+__{en,de}queue_entity() from {put_prev,set_next}_task(). But per the
+fingered commit, those two no longer move zero_vruntime.
+
+All that moves zero_vruntime are tick and full {de,en}queue.
+
+This means, that if the two tasks playing leapfrog can reach the
+critical speed to reach the overflow point inside one tick's worth of
+time, we're up a creek.
+
+Additionally, when multiple cgroups are involved, there is no guarantee
+the tick will in fact hit every cgroup in a timely manner. Statistically
+speaking it will, but that same statistics does not rule out the
+possibility of one cgroup not getting a tick for a significant amount of
+time -- however unlikely.
+
+Therefore, just like with the yield() case, force an update at the end
+of every slice. This ensures the update is never more than a single
+slice behind and the whole thing is within 2 lag bounds as per the
+comment on entity_key().
+
+Fixes: b3d99f43c72b ("sched/fair: Fix zero_vruntime tracking")
+Reported-by: John Stultz <jstultz@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Tested-by: K Prateek Nayak <kprateek.nayak@amd.com>
+Tested-by: John Stultz <jstultz@google.com>
+Link: https://patch.msgid.link/20260401132355.081530332@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index a8e766eaca1f9..2625a78c03001 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -707,7 +707,7 @@ void update_zero_vruntime(struct cfs_rq *cfs_rq, s64 delta)
+  * Called in:
+  *  - place_entity()      -- before enqueue
+  *  - update_entity_lag() -- before dequeue
+- *  - entity_tick()
++ *  - update_deadline()   -- slice expiration
+  *
+  * This means it is one entry 'behind' but that puts it close enough to where
+  * the bound on entity_key() is at most two lag bounds.
+@@ -1131,6 +1131,7 @@ static bool update_deadline(struct cfs_rq *cfs_rq, struct sched_entity *se)
+ 	 * EEVDF: vd_i = ve_i + r_i / w_i
+ 	 */
+ 	se->deadline = se->vruntime + calc_delta_fair(se->slice, se);
++	avg_vruntime(cfs_rq);
+ 
+ 	/*
+ 	 * The task has consumed its request, reschedule.
+@@ -5636,11 +5637,6 @@ entity_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr, int queued)
+ 	update_load_avg(cfs_rq, curr, UPDATE_TG);
+ 	update_cfs_group(curr);
+ 
+-	/*
+-	 * Pulls along cfs_rq::zero_vruntime.
+-	 */
+-	avg_vruntime(cfs_rq);
+-
+ #ifdef CONFIG_SCHED_HRTICK
+ 	/*
+ 	 * queued ticks are scheduled to match the slice, so don't bother
+@@ -9166,7 +9162,7 @@ static void yield_task_fair(struct rq *rq)
+ 	 */
+ 	if (entity_eligible(cfs_rq, se)) {
+ 		se->vruntime = se->deadline;
+-		se->deadline += calc_delta_fair(se->slice, se);
++		update_deadline(cfs_rq, se);
+ 	}
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/series b/queue-6.19/series
index 910c05e..91719cf 100644
--- a/queue-6.19/series
+++ b/queue-6.19/series

@@ -125,3 +125,36 @@
 bpf-reject-sleepable-kprobe_multi-programs-at-attach.patch
 bpf-fix-incorrect-pruning-due-to-atomic-fetch-precis.patch
 revert-drm-fix-use-after-free-on-framebuffers-and-property-blobs-when-calling-drm_dev_unplug.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+gpiolib-clear-requested-flag-if-line-is-invalid.patch
+interconnect-qcom-sm8450-fix-null-pointer-dereferenc.patch
+gpio-shared-call-gpio_chip-of_xlate-if-set.patch
+gpio-shared-handle-pins-shared-by-child-nodes-of-dev.patch
+gpio-qixis-fpga-fix-error-handling-for-devm_regmap_i.patch
+drm-bridge-fix-refcount-shown-via-debugfs-for-encode.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+io_uring-rsrc-reject-zero-length-fixed-buffer-import.patch
+hwmon-tps53679-fix-array-access-with-zero-length-blo.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+hwmon-ltc4286-add-missing-module_import_ns-pmbus.patch
+gpio-shared-shorten-the-critical-section-in-gpiochip.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
+spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
+drm-xe-xe_pagefault-disallow-writes-to-read-only-vma.patch
+drm-xe-pxp-clean-up-termination-status-on-failure.patch
+drm-xe-pxp-remove-incorrect-handling-of-impossible-s.patch
+drm-xe-pxp-clear-restart-flag-in-pxp_start-after-jum.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+irqchip-riscv-aplic-restrict-genpd-notifier-to-devic.patch
+drm-sysfb-fix-efidrm-error-handling-and-memory-type-.patch
+hwmon-asus-ec-sensors-fix-t_sensor-for-prime-x670e-p.patch
+mips-ralink-update-cpu-clock-index.patch
+sched-fair-fix-zero_vruntime-tracking-fix.patch
+sched-debug-fix-avg_vruntime-usage.patch
+perf-x86-fix-potential-bad-container_of-in-intel_pmu.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch
+riscv-reset-pmm-when-pr_tagged_addr_enable-is-not-se.patch
+acpi-rimt-add-dependency-between-iommu-and-devices.patch

diff --git a/queue-6.19/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch b/queue-6.19/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch
new file mode 100644
index 0000000..dfbf5b0
--- /dev/null
+++ b/queue-6.19/spi-amlogic-spifc-a4-unregister-ecc-engine-on-probe-.patch

@@ -0,0 +1,58 @@
+From 0b18d2fad6d68d1832c30e382f24c11aec9c17e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2026 22:28:45 +0800
+Subject: spi: amlogic: spifc-a4: unregister ECC engine on probe failure and
+ remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f ]
+
+aml_sfc_probe() registers the on-host NAND ECC engine, but teardown was
+missing from both probe unwind and remove-time cleanup. Add a devm cleanup
+action after successful registration so
+nand_ecc_unregister_on_host_hw_engine() runs automatically on probe
+failures and during device removal.
+
+Fixes: 4670db6f32e9 ("spi: amlogic: add driver for Amlogic SPI Flash Controller")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Link: https://patch.msgid.link/20260322-spifc-a4-v1-1-2dc5ebcbe0a9@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-amlogic-spifc-a4.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/spi/spi-amlogic-spifc-a4.c b/drivers/spi/spi-amlogic-spifc-a4.c
+index b2589fe2425cc..3393e1f305709 100644
+--- a/drivers/spi/spi-amlogic-spifc-a4.c
++++ b/drivers/spi/spi-amlogic-spifc-a4.c
+@@ -1066,6 +1066,13 @@ static const struct nand_ecc_engine_ops aml_sfc_ecc_engine_ops = {
+ 	.finish_io_req = aml_sfc_ecc_finish_io_req,
+ };
+ 
++static void aml_sfc_unregister_ecc_engine(void *data)
++{
++	struct nand_ecc_engine *eng = data;
++
++	nand_ecc_unregister_on_host_hw_engine(eng);
++}
++
+ static int aml_sfc_clk_init(struct aml_sfc *sfc)
+ {
+ 	sfc->gate_clk = devm_clk_get_enabled(sfc->dev, "gate");
+@@ -1149,6 +1156,11 @@ static int aml_sfc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return dev_err_probe(&pdev->dev, ret, "failed to register Aml host ecc engine.\n");
+ 
++	ret = devm_add_action_or_reset(dev, aml_sfc_unregister_ecc_engine,
++				       &sfc->ecc_eng);
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to add ECC unregister action\n");
++
+ 	ret = of_property_read_u32(np, "amlogic,rx-adj", &val);
+ 	if (!ret)
+ 		sfc->rx_adj = val;
+-- 
+2.53.0
+

diff --git a/queue-6.19/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch b/queue-6.19/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch
new file mode 100644
index 0000000..43b632a
--- /dev/null
+++ b/queue-6.19/spi-stm32-ospi-fix-reset-control-leak-on-probe-error.patch

@@ -0,0 +1,49 @@
+From 89f52c6c52e70e57ef4811140749b7f44067ba2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 00:07:06 +0800
+Subject: spi: stm32-ospi: Fix reset control leak on probe error
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 5a570c8d6e55689253f6fcc4a198c56cca7e39d6 ]
+
+When spi_register_controller() fails after reset_control_acquire()
+succeeds, the reset control is never released. This causes a resource
+leak in the error path.
+
+Add the missing reset_control_release() call in the error path.
+
+Fixes: cf2c3eceb757 ("spi: stm32-ospi: Make usage of reset_control_acquire/release() API")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-stm32-ospi-v1-1-142122466412@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index 5fa27de89210a..2988ff288ff02 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -939,13 +939,15 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ 	if (ret) {
+ 		/* Disable ospi */
+ 		writel_relaxed(0, ospi->regs_base + OSPI_CR);
+-		goto err_pm_resume;
++		goto err_reset_control;
+ 	}
+ 
+ 	pm_runtime_put_autosuspend(ospi->dev);
+ 
+ 	return 0;
+ 
++err_reset_control:
++	reset_control_release(ospi->rstc);
+ err_pm_resume:
+ 	pm_runtime_put_sync_suspend(ospi->dev);
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.19/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch b/queue-6.19/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch
new file mode 100644
index 0000000..be1c03b
--- /dev/null
+++ b/queue-6.19/spi-stm32-ospi-fix-resource-leak-in-remove-callback.patch

@@ -0,0 +1,45 @@
+From 61206127b0c9877de828b21346e6718b0126dcb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 19:14:05 +0800
+Subject: spi: stm32-ospi: Fix resource leak in remove() callback
+
+From: Felix Gu <ustc.gu@gmail.com>
+
+[ Upstream commit 73cd1f97946ae3796544448ff12c07f399bb2881 ]
+
+The remove() callback returned early if pm_runtime_resume_and_get()
+failed, skipping the cleanup of spi controller and other resources.
+
+Remove the early return so cleanup completes regardless of PM resume
+result.
+
+Fixes: 79b8a705e26c ("spi: stm32: Add OSPI driver")
+Signed-off-by: Felix Gu <ustc.gu@gmail.com>
+Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
+Link: https://patch.msgid.link/20260329-ospi-v1-1-cc8cf1c82c4a@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-stm32-ospi.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-stm32-ospi.c b/drivers/spi/spi-stm32-ospi.c
+index f36fd36da2692..5fa27de89210a 100644
+--- a/drivers/spi/spi-stm32-ospi.c
++++ b/drivers/spi/spi-stm32-ospi.c
+@@ -963,11 +963,8 @@ static int stm32_ospi_probe(struct platform_device *pdev)
+ static void stm32_ospi_remove(struct platform_device *pdev)
+ {
+ 	struct stm32_ospi *ospi = platform_get_drvdata(pdev);
+-	int ret;
+ 
+-	ret = pm_runtime_resume_and_get(ospi->dev);
+-	if (ret < 0)
+-		return;
++	pm_runtime_resume_and_get(ospi->dev);
+ 
+ 	spi_unregister_controller(ospi->ctrl);
+ 	/* Disable ospi */
+-- 
+2.53.0
+

diff --git a/queue-6.6/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch b/queue-6.6/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
new file mode 100644
index 0000000..c9edb17
--- /dev/null
+++ b/queue-6.6/accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch

@@ -0,0 +1,111 @@
+From 80ccb07a05d84290d427c5bf3e83a7d1f94b3385 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Feb 2026 13:34:14 +0100
+Subject: accel/qaic: Handle DBC deactivation if the owner went away
+
+From: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+
+[ Upstream commit 2feec5ae5df785658924ab6bd91280dc3926507c ]
+
+When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
+transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
+this by calling decode_deactivate() to release the resources allocated for
+that DBC. Since that handling is done in the qaic_manage_ioctl() context,
+if the user goes away before receiving and handling the deactivation, the
+host will be out-of-sync with the DBCs available for use, and the DBC
+resources will not be freed unless the device is removed. If another user
+loads and requests to activate a network, then the device assigns the same
+DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
+leading the user process to hang.
+
+As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
+that are received after the user has gone away.
+
+Fixes: 129776ac2e38 ("accel/qaic: Add control path")
+Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
+Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
+Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260205123415.3870898-1-youssef.abdulrahman@oss.qualcomm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/qaic/qaic_control.c | 47 +++++++++++++++++++++++++++++--
+ 1 file changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c
+index 08b78f5678532..de8b17e2b29e1 100644
+--- a/drivers/accel/qaic/qaic_control.c
++++ b/drivers/accel/qaic/qaic_control.c
+@@ -910,7 +910,7 @@ static int decode_deactivate(struct qaic_device *qdev, void *trans, u32 *msg_len
+ 		 */
+ 		return -ENODEV;
+ 
+-	if (status) {
++	if (usr && status) {
+ 		/*
+ 		 * Releasing resources failed on the device side, which puts
+ 		 * us in a bind since they may still be in use, so enable the
+@@ -1104,6 +1104,9 @@ static void *msg_xfer(struct qaic_device *qdev, struct wrapper_list *wrappers, u
+ 	mutex_lock(&qdev->cntl_mutex);
+ 	if (!list_empty(&elem.list))
+ 		list_del(&elem.list);
++	/* resp_worker() processed the response but the wait was interrupted */
++	else if (ret == -ERESTARTSYS)
++		ret = 0;
+ 	if (!ret && !elem.buf)
+ 		ret = -ETIMEDOUT;
+ 	else if (ret > 0 && !elem.buf)
+@@ -1414,9 +1417,49 @@ static void resp_worker(struct work_struct *work)
+ 	}
+ 	mutex_unlock(&qdev->cntl_mutex);
+ 
+-	if (!found)
++	if (!found) {
++		/*
++		 * The user might have gone away at this point without waiting
++		 * for QAIC_TRANS_DEACTIVATE_FROM_DEV transaction coming from
++		 * the device. If this is not handled correctly, the host will
++		 * not know that the DBC[n] has been freed on the device.
++		 * Due to this failure in synchronization between the device and
++		 * the host, if another user requests to activate a network, and
++		 * the device assigns DBC[n] again, save_dbc_buf() will hang,
++		 * waiting for dbc[n]->in_use to be set to false, which will not
++		 * happen unless the qaic_dev_reset_clean_local_state() gets
++		 * called by resetting the device (or re-inserting the module).
++		 *
++		 * As a solution, we look for QAIC_TRANS_DEACTIVATE_FROM_DEV
++		 * transactions in the message before disposing of it, then
++		 * handle releasing the DBC resources.
++		 *
++		 * Since the user has gone away, if the device could not
++		 * deactivate the network (status != 0), there is no way to
++		 * enable and reassign the DBC to the user. We can put trust in
++		 * the device that it will release all the active DBCs in
++		 * response to the QAIC_TRANS_TERMINATE_TO_DEV transaction,
++		 * otherwise, the user can issue an soc_reset to the device.
++		 */
++		u32 msg_count = le32_to_cpu(msg->hdr.count);
++		u32 msg_len = le32_to_cpu(msg->hdr.len);
++		u32 len = 0;
++		int j;
++
++		for (j = 0; j < msg_count && len < msg_len; ++j) {
++			struct wire_trans_hdr *trans_hdr;
++
++			trans_hdr = (struct wire_trans_hdr *)(msg->data + len);
++			if (le32_to_cpu(trans_hdr->type) == QAIC_TRANS_DEACTIVATE_FROM_DEV) {
++				if (decode_deactivate(qdev, trans_hdr, &len, NULL))
++					len += le32_to_cpu(trans_hdr->len);
++			} else {
++				len += le32_to_cpu(trans_hdr->len);
++			}
++		}
+ 		/* request must have timed out, drop packet */
+ 		kfree(msg);
++	}
+ 
+ 	kfree(resp);
+ }
+-- 
+2.53.0
+

diff --git a/queue-6.6/dt-bindings-gpio-fix-microchip-interrupt-cells.patch b/queue-6.6/dt-bindings-gpio-fix-microchip-interrupt-cells.patch
new file mode 100644
index 0000000..2775122
--- /dev/null
+++ b/queue-6.6/dt-bindings-gpio-fix-microchip-interrupt-cells.patch

@@ -0,0 +1,47 @@
+From 18492ccffc3af861c46a574666f98aedaeba18a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 17:02:34 +0000
+Subject: dt-bindings: gpio: fix microchip #interrupt-cells
+
+From: Jamie Gibbons <jamie.gibbons@microchip.com>
+
+[ Upstream commit 6b5ef8c88854b343b733b574ea8754c9dab61f41 ]
+
+The GPIO controller on PolarFire SoC supports more than one type of
+interrupt and needs two interrupt cells.
+
+Fixes: 735806d8a68e9 ("dt-bindings: gpio: add bindings for microchip mpfs gpio")
+Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://patch.msgid.link/20260326-wise-gumdrop-49217723a72a@spud
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/gpio/microchip,mpfs-gpio.yaml         | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+index d481e78958a74..2c7355e9547a1 100644
+--- a/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
++++ b/Documentation/devicetree/bindings/gpio/microchip,mpfs-gpio.yaml
+@@ -33,7 +33,7 @@ properties:
+     const: 2
+ 
+   "#interrupt-cells":
+-    const: 1
++    const: 2
+ 
+   ngpios:
+     description:
+@@ -84,7 +84,7 @@ examples:
+         gpio-controller;
+         #gpio-cells = <2>;
+         interrupt-controller;
+-        #interrupt-cells = <1>;
++        #interrupt-cells = <2>;
+         interrupts = <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+                      <53>, <53>, <53>, <53>,
+-- 
+2.53.0
+

diff --git a/queue-6.6/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch b/queue-6.6/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
new file mode 100644
index 0000000..779745c
--- /dev/null
+++ b/queue-6.6/hwmon-occ-fix-missing-newline-in-occ_show_extended.patch

@@ -0,0 +1,42 @@
+From 02e88facbd71d136f516f9206a3ba5bc8a16a4a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Mar 2026 22:45:29 +0000
+Subject: hwmon: (occ) Fix missing newline in occ_show_extended()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit 09773978879ecf71a7990fe9a28ce4eb92bce645 ]
+
+In occ_show_extended() case 0, when the EXTN_FLAG_SENSOR_ID flag
+is set, the sysfs_emit format string "%u" is missing the trailing
+newline that the sysfs ABI expects. The else branch correctly uses
+"%4phN\n", and all other show functions in this file include the
+trailing newline.
+
+Add the missing "\n" for consistency and correct sysfs output.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260326224510.294619-3-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 755926fa0bf7d..c6a78436e9bba 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -725,7 +725,7 @@ static ssize_t occ_show_extended(struct device *dev,
+ 	switch (sattr->nr) {
+ 	case 0:
+ 		if (extn->flags & EXTN_FLAG_SENSOR_ID) {
+-			rc = sysfs_emit(buf, "%u",
++			rc = sysfs_emit(buf, "%u\n",
+ 					get_unaligned_be32(&extn->sensor_id));
+ 		} else {
+ 			rc = sysfs_emit(buf, "%4phN\n", extn->name);
+-- 
+2.53.0
+

diff --git a/queue-6.6/hwmon-pxe1610-check-return-value-of-page-select-writ.patch b/queue-6.6/hwmon-pxe1610-check-return-value-of-page-select-writ.patch
new file mode 100644
index 0000000..10b76b8
--- /dev/null
+++ b/queue-6.6/hwmon-pxe1610-check-return-value-of-page-select-writ.patch

@@ -0,0 +1,45 @@
+From 841f0fee499b119fef725406d35b9f14003ee99f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Mar 2026 17:09:48 +0000
+Subject: hwmon: (pxe1610) Check return value of page-select write in probe
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ccf70c41e562b29d1c05d1bbf53391785e09c6fb ]
+
+pxe1610_probe() writes PMBUS_PAGE to select page 0 but does not check
+the return value. If the write fails, subsequent register reads operate
+on an indeterminate page, leading to silent misconfiguration.
+
+Check the return value and propagate the error using dev_err_probe(),
+which also handles -EPROBE_DEFER correctly without log spam.
+
+Fixes: 344757bac526 ("hwmon: (pmbus) Add Infineon PXE1610 VR driver")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260329170925.34581-4-sanman.pradhan@hpe.com
+[groeck: Fix "Fixes" SHA]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/pxe1610.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/pxe1610.c b/drivers/hwmon/pmbus/pxe1610.c
+index e2790a682dc80..d37e389b50d76 100644
+--- a/drivers/hwmon/pmbus/pxe1610.c
++++ b/drivers/hwmon/pmbus/pxe1610.c
+@@ -104,7 +104,10 @@ static int pxe1610_probe(struct i2c_client *client)
+ 	 * By default this device doesn't boot to page 0, so set page 0
+ 	 * to access all pmbus registers.
+ 	 */
+-	i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	ret = i2c_smbus_write_byte_data(client, PMBUS_PAGE, 0);
++	if (ret < 0)
++		return dev_err_probe(&client->dev, ret,
++				     "Failed to set page 0\n");
+ 
+ 	/* Read Manufacturer id */
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_MFR_ID, buf);
+-- 
+2.53.0
+

diff --git a/queue-6.6/hwmon-tps53679-fix-device-id-comparison-and-printing.patch b/queue-6.6/hwmon-tps53679-fix-device-id-comparison-and-printing.patch
new file mode 100644
index 0000000..a91adf2
--- /dev/null
+++ b/queue-6.6/hwmon-tps53679-fix-device-id-comparison-and-printing.patch

@@ -0,0 +1,51 @@
+From 2587c99709bc4d8dcd2df1238ff48eb9569f0c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Mar 2026 15:56:40 +0000
+Subject: hwmon: (tps53679) Fix device ID comparison and printing in
+ tps53676_identify()
+
+From: Sanman Pradhan <psanman@juniper.net>
+
+[ Upstream commit ca34ee6d0307a0b4e52c870dfc1bb8a3c3eb956e ]
+
+tps53676_identify() uses strncmp() to compare the device ID buffer
+against a byte sequence containing embedded non-printable bytes
+(\x53\x67\x60). strncmp() is semantically wrong for binary data
+comparison; use memcmp() instead.
+
+Additionally, the buffer from i2c_smbus_read_block_data() is not
+NUL-terminated, so printing it with "%s" in the error path is
+undefined behavior and may read past the buffer. Use "%*ph" to
+hex-dump the actual bytes returned.
+
+Per the datasheet, the expected device ID is the 6-byte sequence
+54 49 53 67 60 00 ("TI\x53\x67\x60\x00"), so compare all 6 bytes
+including the trailing NUL.
+
+Fixes: cb3d37b59012 ("hwmon: (pmbus/tps53679) Add support for TI TPS53676")
+Signed-off-by: Sanman Pradhan <psanman@juniper.net>
+Link: https://lore.kernel.org/r/20260330155618.77403-1-sanman.pradhan@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 5c9466244d70d..ecc1be33b3b1b 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -156,8 +156,8 @@ static int tps53676_identify(struct i2c_client *client,
+ 	ret = i2c_smbus_read_block_data(client, PMBUS_IC_DEVICE_ID, buf);
+ 	if (ret < 0)
+ 		return ret;
+-	if (strncmp("TI\x53\x67\x60", buf, 5)) {
+-		dev_err(&client->dev, "Unexpected device ID: %s\n", buf);
++	if (ret != 6 || memcmp(buf, "TI\x53\x67\x60\x00", 6)) {
++		dev_err(&client->dev, "Unexpected device ID: %*ph\n", ret, buf);
+ 		return -ENODEV;
+ 	}
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.6/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch b/queue-6.6/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
new file mode 100644
index 0000000..25b7852
--- /dev/null
+++ b/queue-6.6/iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch

@@ -0,0 +1,43 @@
+From 8df24b489ed4a17f5effc935e7289cc84b403d28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Feb 2026 16:33:54 -0600
+Subject: iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit 773ef9f95385bae52dcb7fd129fefba3a71a04db ]
+
+Fix an off-by-one error in the BNO055_SCAN_CH_COUNT macro. The count
+is derived by taking the difference of the last and first register
+addresses, dividing by the size of each channel (2 bytes). It needs to
+also add 1 to account for the fact that the count is inclusive of both
+the first and last channels.
+
+Thanks to the aligned_s64 timestamp field, there was already extra
+padding in the buffer, so there were no runtime issues caused by this
+bug.
+
+Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/bno055/bno055.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
+index 98f17c29da69b..7b58b418b8a8b 100644
+--- a/drivers/iio/imu/bno055/bno055.c
++++ b/drivers/iio/imu/bno055/bno055.c
+@@ -64,7 +64,7 @@
+ #define BNO055_GRAVITY_DATA_X_LSB_REG	0x2E
+ #define BNO055_GRAVITY_DATA_Y_LSB_REG	0x30
+ #define BNO055_GRAVITY_DATA_Z_LSB_REG	0x32
+-#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2)
++#define BNO055_SCAN_CH_COUNT ((BNO055_GRAVITY_DATA_Z_LSB_REG - BNO055_ACC_DATA_X_LSB_REG) / 2 + 1)
+ #define BNO055_TEMP_REG			0x34
+ #define BNO055_CALIB_STAT_REG		0x35
+ #define BNO055_CALIB_STAT_MAGN_SHIFT 0
+-- 
+2.53.0
+

diff --git a/queue-6.6/mips-ralink-update-cpu-clock-index.patch b/queue-6.6/mips-ralink-update-cpu-clock-index.patch
new file mode 100644
index 0000000..c639d05
--- /dev/null
+++ b/queue-6.6/mips-ralink-update-cpu-clock-index.patch

@@ -0,0 +1,49 @@
+From c4606cf655109c03d16514db0b22028109d17509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Feb 2026 10:22:50 +0800
+Subject: mips: ralink: update CPU clock index
+
+From: Shiji Yang <yangshiji66@outlook.com>
+
+[ Upstream commit 43985a62bab9d35e5e9af41118ce2f44c01b97d2 ]
+
+Update CPU clock index to match the clock driver changes.
+
+Fixes: d34db686a3d7 ("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs")
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Reviewed-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/ralink/clk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/ralink/clk.c b/arch/mips/ralink/clk.c
+index 9db73fcac522e..5c1eb46ef5d07 100644
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -21,16 +21,16 @@ static const char *clk_cpu(int *idx)
+ {
+ 	switch (ralink_soc) {
+ 	case RT2880_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt2880-sysc";
+ 	case RT3883_SOC:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3883-sysc";
+ 	case RT305X_SOC_RT3050:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3050-sysc";
+ 	case RT305X_SOC_RT3052:
+-		*idx = 0;
++		*idx = 1;
+ 		return "ralink,rt3052-sysc";
+ 	case RT305X_SOC_RT3350:
+ 		*idx = 1;
+-- 
+2.53.0
+

diff --git a/queue-6.6/riscv-kgdb-fix-several-debug-register-assignment-bug.patch b/queue-6.6/riscv-kgdb-fix-several-debug-register-assignment-bug.patch
new file mode 100644
index 0000000..3b51e11
--- /dev/null
+++ b/queue-6.6/riscv-kgdb-fix-several-debug-register-assignment-bug.patch

@@ -0,0 +1,58 @@
+From cefbfdf175deac28fa200d9cd0e3660396c5203b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Mar 2026 17:43:47 -0600
+Subject: riscv: kgdb: fix several debug register assignment bugs
+
+From: Paul Walmsley <pjw@kernel.org>
+
+[ Upstream commit 834911eb8eef2501485d819b4eabebadc25c3497 ]
+
+Fix several bugs in the RISC-V kgdb implementation:
+
+- The element of dbg_reg_def[] that is supposed to pertain to the S1
+  register embeds instead the struct pt_regs offset of the A1
+  register.  Fix this to use the S1 register offset in struct pt_regs.
+
+- The sleeping_thread_to_gdb_regs() function copies the value of the
+  S10 register into the gdb_regs[] array element meant for the S9
+  register, and copies the value of the S11 register into the array
+  element meant for the S10 register.  It also neglects to copy the
+  value of the S11 register.  Fix all of these issues.
+
+Fixes: fe89bd2be8667 ("riscv: Add KGDB support")
+Cc: Vincent Chen <vincent.chen@sifive.com>
+Link: https://patch.msgid.link/fde376f8-bcfd-bfe4-e467-07d8f7608d05@kernel.org
+Signed-off-by: Paul Walmsley <pjw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/kgdb.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/kgdb.c b/arch/riscv/kernel/kgdb.c
+index 9f3db3503dabd..edaab2aa16a3e 100644
+--- a/arch/riscv/kernel/kgdb.c
++++ b/arch/riscv/kernel/kgdb.c
+@@ -175,7 +175,7 @@ struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
+ 	{DBG_REG_T1, GDB_SIZEOF_REG, offsetof(struct pt_regs, t1)},
+ 	{DBG_REG_T2, GDB_SIZEOF_REG, offsetof(struct pt_regs, t2)},
+ 	{DBG_REG_FP, GDB_SIZEOF_REG, offsetof(struct pt_regs, s0)},
+-	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
++	{DBG_REG_S1, GDB_SIZEOF_REG, offsetof(struct pt_regs, s1)},
+ 	{DBG_REG_A0, GDB_SIZEOF_REG, offsetof(struct pt_regs, a0)},
+ 	{DBG_REG_A1, GDB_SIZEOF_REG, offsetof(struct pt_regs, a1)},
+ 	{DBG_REG_A2, GDB_SIZEOF_REG, offsetof(struct pt_regs, a2)},
+@@ -244,8 +244,9 @@ sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *task)
+ 	gdb_regs[DBG_REG_S6_OFF] = task->thread.s[6];
+ 	gdb_regs[DBG_REG_S7_OFF] = task->thread.s[7];
+ 	gdb_regs[DBG_REG_S8_OFF] = task->thread.s[8];
+-	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[10];
+-	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[11];
++	gdb_regs[DBG_REG_S9_OFF] = task->thread.s[9];
++	gdb_regs[DBG_REG_S10_OFF] = task->thread.s[10];
++	gdb_regs[DBG_REG_S11_OFF] = task->thread.s[11];
+ 	gdb_regs[DBG_REG_EPC_OFF] = task->thread.ra;
+ }
+ 
+-- 
+2.53.0
+

diff --git a/queue-6.6/series b/queue-6.6/series
index f54cbf9..061d76d 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series

@@ -62,3 +62,11 @@
 net-hsr-fix-vlan-add-unwind-on-slave-errors.patch
 ipv6-avoid-overflows-in-ip6_datagram_send_ctl.patch
 bpf-reject-direct-access-to-nullable-ptr_to_buf-poin.patch
+iio-imu-bno055-fix-bno055_scan_ch_count-off-by-one.patch
+accel-qaic-handle-dbc-deactivation-if-the-owner-went.patch
+hwmon-pxe1610-check-return-value-of-page-select-writ.patch
+dt-bindings-gpio-fix-microchip-interrupt-cells.patch
+hwmon-tps53679-fix-device-id-comparison-and-printing.patch
+hwmon-occ-fix-missing-newline-in-occ_show_extended.patch
+mips-ralink-update-cpu-clock-index.patch
+riscv-kgdb-fix-several-debug-register-assignment-bug.patch