git.monstr.eu Git - linux-2.6-microblaze.git/log

Merge tag 'fuse-update-6.16' of git://git./linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi:

- Remove tmp page copying in writeback path (Joanne).

   This removes ~300 lines and with that a lot of complexity related to
   avoiding reclaim related deadlock. The old mechanism is replaced with
   a mapping flag that tells the MM not to block reclaim waiting for
   writeback to complete. The MM parts have been reviewed/acked by
   respective maintainers.

- Convert more code to handle large folios (Joanne). This still just
   adds the code to deal with large folios and does not enable them yet.

- Allow invalidating all cached lookups atomically (Luis Henriques).
   This feature is useful for CernVMFS, which currently does this
   iteratively.

- Align write prefaulting in fuse with generic one (Dave Hansen)

- Fix race causing invalid data to be cached when setting attributes on
   different nodes of a distributed fs (Guang Yuan Wu)

- Update documentation for passthrough (Chen Linxuan)

- Add fdinfo about the device number associated with an opened
   /dev/fuse instance (Chen Linxuan)

- Increase readdir buffer size (Miklos). This depends on a patch to VFS
   readdir code that was already merged through Christians tree.

- Optimize io-uring request expiration (Joanne)

- Misc cleanups

* tag 'fuse-update-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (25 commits)
  fuse: increase readdir buffer size
  readdir: supply dir_context.count as readdir buffer size hint
  fuse: don't allow signals to interrupt getdents copying
  fuse: support large folios for writeback
  fuse: support large folios for readahead
  fuse: support large folios for queued writes
  fuse: support large folios for stores
  fuse: support large folios for symlinks
  fuse: support large folios for folio reads
  fuse: support large folios for writethrough writes
  fuse: refactor fuse_fill_write_pages()
  fuse: support large folios for retrieves
  fuse: support copying large folios
  fs: fuse: add dev id to /dev/fuse fdinfo
  docs: filesystems: add fuse-passthrough.rst
  MAINTAINERS: update filter of FUSE documentation
  fuse: fix race between concurrent setattrs from multiple nodes
  fuse: remove tmp folio for writebacks and internal rb tree
  mm: skip folio reclaim in legacy memcg contexts for deadlockable mappings
  fuse: optimize over-io-uring request expiration check
  ...

Merge tag 'vfs-6.16-rc1.netfs' of git://git./linux/kernel/git/vfs/vfs

Pull netfs updates from Christian Brauner:

- The main API document has been extensively updated/rewritten

- Fix an oops in write-retry due to mis-resetting the I/O iterator

- Fix the recording of transferred bytes for short DIO reads

- Fix a request's work item to not require a reference, thereby
   avoiding the need to get rid of it in BH/IRQ context

- Fix waiting and waking to be consistent about the waitqueue used

- Remove NETFS_SREQ_SEEK_DATA_READ, NETFS_INVALID_WRITE,
   NETFS_ICTX_WRITETHROUGH, NETFS_READ_HOLE_CLEAR,
   NETFS_RREQ_DONT_UNLOCK_FOLIOS, and NETFS_RREQ_BLOCKED

- Reorder structs to eliminate holes

- Remove netfs_io_request::ractl

- Only provide proc_link field if CONFIG_PROC_FS=y

- Remove folio_queue::marks3

- Fix undifferentiation of DIO reads from unbuffered reads

* tag 'vfs-6.16-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  netfs: Fix undifferentiation of DIO reads from unbuffered reads
  netfs: Fix wait/wake to be consistent about the waitqueue used
  netfs: Fix the request's work item to not require a ref
  netfs: Fix setting of transferred bytes with short DIO reads
  netfs: Fix oops in write-retry from mis-resetting the subreq iterator
  fs/netfs: remove unused flag NETFS_RREQ_BLOCKED
  fs/netfs: remove unused flag NETFS_RREQ_DONT_UNLOCK_FOLIOS
  folio_queue: remove unused field `marks3`
  fs/netfs: declare field `proc_link` only if CONFIG_PROC_FS=y
  fs/netfs: remove `netfs_io_request.ractl`
  fs/netfs: reorder struct fields to eliminate holes
  fs/netfs: remove unused enum choice NETFS_READ_HOLE_CLEAR
  fs/netfs: remove unused flag NETFS_ICTX_WRITETHROUGH
  fs/netfs: remove unused source NETFS_INVALID_WRITE
  fs/netfs: remove unused flag NETFS_SREQ_SEEK_DATA_READ

Merge tag 'vfs-6.16-rc2.fixes' of git://git./linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

- Fix the AT_HANDLE_CONNECTABLE option so filesystems that don't know
   how to decode a connected non-dir dentry fail the request

- Use repr(transparent) to ensure identical layout between the C and
   Rust implementation of struct file

- Add a missing xas_pause() into the dax code employing
   wait_entry_unlocked_exclusive()

- Fix FOP_DONTCACHE which we disabled for v6.15.

   A folio could get redirtied and/or scheduled for writeback after the
   initial dropbehind test. Change the test accordingly to handle these
   cases so we can re-enable FOP_DONTCACHE again

* tag 'vfs-6.16-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  exportfs: require ->fh_to_parent() to encode connectable file handles
  rust: file: improve safety comments
  rust: file: mark `LocalFile` as `repr(transparent)`
  fs/dax: Fix "don't skip locked entries when scanning entries"
  iomap: don't lose folio dropbehind state for overwrites
  mm/filemap: unify dropbehind flag testing and clearing
  mm/filemap: unify read/write dropbehind naming
  Revert "Disable FOP_DONTCACHE for now due to bugs"
  mm/filemap: use filemap_end_dropbehind() for read invalidation
  mm/filemap: gate dropbehind invalidate on folio !dirty && !writeback

Merge tag 'for-linus' of git://git./virt/kvm/kvm

Pull more kvm updates from Paolo Bonzini:
  Generic:

   - Clean up locking of all vCPUs for a VM by using the *_nest_lock()
     family of functions, and move duplicated code to virt/kvm/. kernel/
     patches acked by Peter Zijlstra

   - Add MGLRU support to the access tracking perf test

  ARM fixes:

   - Make the irqbypass hooks resilient to changes in the GSI<->MSI
     routing, avoiding behind stale vLPI mappings being left behind. The
     fix is to resolve the VGIC IRQ using the host IRQ (which is stable)
     and nuking the vLPI mapping upon a routing change

   - Close another VGIC race where vCPU creation races with VGIC
     creation, leading to in-flight vCPUs entering the kernel w/o
     private IRQs allocated

   - Fix a build issue triggered by the recently added workaround for
     Ampere's AC04_CPU_23 erratum

   - Correctly sign-extend the VA when emulating a TLBI instruction
     potentially targeting a VNCR mapping

   - Avoid dereferencing a NULL pointer in the VGIC debug code, which
     can happen if the device doesn't have any mapping yet

  s390:

   - Fix interaction between some filesystems and Secure Execution

   - Some cleanups and refactorings, preparing for an upcoming big
     series

  x86:

   - Wait for target vCPU to ack KVM_REQ_UPDATE_PROTECTED_GUEST_STATE
     to fix a race between AP destroy and VMRUN

   - Decrypt and dump the VMSA in dump_vmcb() if debugging enabled for
     the VM

   - Refine and harden handling of spurious faults

   - Add support for ALLOWED_SEV_FEATURES

   - Add #VMGEXIT to the set of handlers special cased for
     CONFIG_RETPOLINE=y

   - Treat DEBUGCTL[5:2] as reserved to pave the way for virtualizing
     features that utilize those bits

   - Don't account temporary allocations in sev_send_update_data()

   - Add support for KVM_CAP_X86_BUS_LOCK_EXIT on SVM, via Bus Lock
     Threshold

   - Unify virtualization of IBRS on nested VM-Exit, and cross-vCPU
     IBPB, between SVM and VMX

   - Advertise support to userspace for WRMSRNS and PREFETCHI

   - Rescan I/O APIC routes after handling EOI that needed to be
     intercepted due to the old/previous routing, but not the
     new/current routing

   - Add a module param to control and enumerate support for device
     posted interrupts

   - Fix a potential overflow with nested virt on Intel systems running
     32-bit kernels

   - Flush shadow VMCSes on emergency reboot

   - Add support for SNP to the various SEV selftests

   - Add a selftest to verify fastops instructions via forced emulation

   - Refine and optimize KVM's software processing of the posted
     interrupt bitmap, and share the harvesting code between KVM and the
     kernel's Posted MSI handler"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (93 commits)
  rtmutex_api: provide correct extern functions
  KVM: arm64: vgic-debug: Avoid dereferencing NULL ITE pointer
  KVM: arm64: vgic-init: Plug vCPU vs. VGIC creation race
  KVM: arm64: Unmap vLPIs affected by changes to GSI routing information
  KVM: arm64: Resolve vLPI by host IRQ in vgic_v4_unset_forwarding()
  KVM: arm64: Protect vLPI translation with vgic_irq::irq_lock
  KVM: arm64: Use lock guard in vgic_v4_set_forwarding()
  KVM: arm64: Mask out non-VA bits from TLBI VA* on VNCR invalidation
  arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue
  KVM: s390: Simplify and move pv code
  KVM: s390: Refactor and split some gmap helpers
  KVM: s390: Remove unneeded srcu lock
  s390: Remove unneeded includes
  s390/uv: Improve splitting of large folios that cannot be split while dirty
  s390/uv: Always return 0 from s390_wiggle_split_folio() if successful
  s390/uv: Don't return 0 from make_hva_secure() if the operation was not successful
  rust: add helper for mutex_trylock
  RISC-V: KVM: use kvm_trylock_all_vcpus when locking all vCPUs
  KVM: arm64: use kvm_trylock_all_vcpus when locking all vCPUs
  x86: KVM: SVM: use kvm_lock_all_vcpus instead of a custom implementation
  ...

Merge tag 'm68knommu-for-v6.16' of git://git./linux/kernel/git/gerg/m68knommu

Pull m68knommu updates from Greg Ungerer:

- use new gpio line value settings

- use strscpy() more

* tag 'm68knommu-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68k: Replace memcpy() + manual NUL-termination with strscpy()
  m68k/kernel: replace strncpy() with strscpy()
  m68k: coldfire: gpio: use new line value setter callbacks

Merge tag 'input-for-v6.16-rc0' of git://git./linux/kernel/git/dtor/input

Pull input updates from Dmitry Torokhov:

- support for game controllers requiring delayed initialization
   packets, such as ByoWave Proteus, in xpad driver

- a change to atkbd driver to not reset the keyboard on Loongson
   devices

- tweaks to gpio-keys and matrix_keypad drivers

- fixes to documentation for Amiga joysticks

- a fix to ims-pcu driver to better handle malformed firmware

* tag 'input-for-v6.16-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ims-pcu - check record size in ims_pcu_flash_firmware()
  Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
  Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
  Input: amijoy - make headings compliant w/ guidelines in documentation
  Input: amijoy - fix grammar in documentation
  Input: amijoy - fix Amiga 4-joystick adapter pinout in documentation
  Input: amijoy - fix broken table formatting in documentation
  Input: atkbd - do not reset keyboard by default on Loongson
  Input: xpad - send LED and auth done packets to all Xbox One controllers
  Input: xpad - add the ByoWave Proteus controller
  Input: xpad - allow delaying init packets
  MAINTAINERS: update dlg,da72??.txt to yaml
  dt-bindings: input: convert dlg,da7280.txt to dt-schema
  dt-bindings: input: touchscreen: edt-ft5x06: use unevaluatedProperties
  Input: snvs_pwrkey - support power-off-time-sec
  dt-bindings: crypto: fsl,sec-v4.0-mon: Add "power-off-time-sec"
  Input: matrix_keypad - detect change during scan
  Input: matrix_keypad - add function for reading row state

Merge tag 'mtd/for-6.16' of git://git./linux/kernel/git/mtd/linux

Pull MTD updates from Miquel Raynal:
"A big core MTD change is the introduction of a new class to always
  register a master device. This is a problem that has been there
  forever: the "master" device was not always present depending on a
  number of heuristics such as the presence of fixed partitions and the
  absence of a Kconfig symbol to force its presence. This was a problem
  for runtime PM operations which might not have the "master" device
  available in all situation.

  The SPI NAND subsystem has seen the introduction of DTR operations
  (the equivalent of DDR transfers), which involved quite a few
  preparation patches for clarifying macro names.

  In the raw NAND subsystem, the brcmnand driver has been "fixed" for
  old legacy SoCs with an update of the ->exec_op() hook, there has been
  the introduction of a new controller driver named Loongson-1, and the
  Qualcomm driver has received quite a few misc fixes as well as a new
  compatible.

  Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP
  table fixups for Macronix MX25L3255E have been merged.

  Aside from this, there is the usual load of misc improvement, fixes,
  and yaml conversion"

* tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (42 commits)
  mtd: rawnand: brcmnand: legacy exec_op implementation
  mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
  mtd: nand: brcmnand: fix NAND timeout when accessing eMMC
  mtd: nand: sunxi: Add randomizer configuration before randomizer enable
  mtd: spinand: esmt: fix id code for F50D1G41LB
  mtd: rawnand: brcmnand: remove unused parameters
  mtd: core: always create master device
  mtd: rawnand: loongson1: Fix inconsistent refcounting in ls1x_nand_chip_init()
  mtd: rawnand: loongson1: Fix error code in ls1x_nand_dma_transfer()
  mtd: rawnand: qcom: Fix read len for onfi param page
  mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
  mtd: rawnand: qcom: Pass 18 bit offset from NANDc base to BAM base
  dt-bindings: mtd: qcom,nandc: Document the SDX75 NAND controller
  mtd: bcm47xxnflash: Add error handling for bcm47xxnflash_ops_bcm4706_ctl_cmd()
  mtd: rawnand: Use non-hybrid PCI devres API
  mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
  mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips
  mtd: spinand: winbond: Add octal support
  mtd: spinand: winbond: Add support for W35N01JW in single mode
  mtd: spinand: winbond: Rename DTR variants
  ...

Merge tag 'rpmsg-v6.16' of git://git./linux/kernel/git/remoteproc/linux

Pull rpmsg updates from Bjorn Andersson:

- Remove some dead and unused code from core and virtio modules

- Improve the error messages from the Qualcomm SMD driver and
   initialize an uninitialized variable in the send path

* tag 'rpmsg-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
  rpmsg: qcom_smd: Improve error handling for qcom_smd_parse_edge
  rpmsg: Remove unused method pointers *send_offchannel
  rpmsg: virtio: Remove uncallable offchannel functions
  rpmsg: core: Remove deadcode

Merge tag 'rproc-v6.16' of git://git./linux/kernel/git/remoteproc/linux

Pull remoteproc updates from Bjorn Andersson:

- Fix resource cleanup in the remoteproc attach error handling code
   paths

- Refactor the various TI K3 drivers to extract and reuse common code
   between them

- Add support in the i.MX remoteproc driver for determining from the
   firmware if Linux should wait on a "firmware ready" signal at startup

- Improve the Xilinx R5F power down mechanism to handle use cases where
   this is shared with other entities in the system

* tag 'rproc-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (46 commits)
  remoteproc: k3: Refactor release_tsp() functions into common driver
  remoteproc: k3: Refactor reserved_mem_init() functions into common driver
  remoteproc: k3: Refactor mem_release() functions into common driver
  remoteproc: k3: Refactor of_get_memories() functions into common driver
  remoteproc: k3: Refactor .da_to_va rproc ops into common driver
  remoteproc: k3: Refactor .get_loaded_rsc_table ops into common driver
  remoteproc: k3: Refactor .detach rproc ops into common driver
  remoteproc: k3: Refactor .attach rproc ops into common driver
  remoteproc: k3: Refactor .stop rproc ops into common driver
  remoteproc: k3: Refactor .start rproc ops into common driver
  remoteproc: k3: Refactor .unprepare rproc ops into common driver
  remoteproc: k3: Refactor .prepare rproc ops into common driver
  remoteproc: k3-dsp: Assert local reset during .prepare callback
  remoteproc: k3-dsp: Don't override rproc ops in IPC-only mode
  remoteproc: k3: Refactor rproc_request_mbox() implementations into common driver
  remoteproc: k3-m4: Ping the mbox while acquiring the channel
  remoteproc: k3: Refactor rproc_release() implementation into common driver
  remoteproc: k3-m4: Introduce central function to release rproc from reset
  remoteproc: k3-dsp: Correct Reset deassert logic for devices w/o lresets
  remoteproc: k3: Refactor rproc_reset() implementation into common driver
  ...

Merge tag 'mailbox-v6.16' of git://git./linux/kernel/git/jassibrar/mailbox

Pull mailbox updates from Jassi Brar:
"Core:
   - misc cleanup

  sophgo:
   - add driver for CV18XX series

  qcom:
   - add SM7150 APCS compatible
   - apcs: added separate clock node

  imx:
   - fix tx doorbell send

  microchip:
   - misc compile option fix

  mediatek:
   - Refine GCE_GCTL_VALUE setting"

* tag 'mailbox-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  mailbox: qcom-apcs-ipc: Assign OF node to clock controller child device
  dt-bindings: mailbox: qcom,apcs: Add separate node for clock-controller
  dt-bindings: mailbox: qcom: Add the SM7150 APCS compatible
  mailbox: sophgo: add mailbox driver for CV18XX series SoC
  dt-bindings: mailbox: add Sophgo CV18XX series SoC
  mailbox: Use guard/scoped_guard for spinlock
  mailbox: Use guard/scoped_guard for con_mutex
  mailbox: Remove devm_mbox_controller_unregister
  mailbox: Propagate correct error return value
  mailbox: Not protect module_put with spin_lock_irqsave
  mailbox: Use dev_err when there is error
  mailbox: mtk-cmdq: Refine GCE_GCTL_VALUE setting
  mailbox: imx: Fix TXDB_V2 sending
  mailbox: mchp-ipc-sbi: Fix COMPILE_TEST build error

Merge tag 'nand/for-6.16' into mtd/next

The SPI NAND subsystem has seen the introduction of DTR operations (the
equivalent of DDR transfers), which involved quite a few preparation
patches for clarifying macro names.

In the raw NAND subsystem, the brcmnand driver has been "fixed" for old
legacy SoCs with an update of the ->exec_op() hook, there has been the
introduction of a new controller driver named Loongson-1, and the
Qualcomm driver has received quite a few misc fixes as well as a new
compatible.

Aside from this, there is the usual load of misc improvement and fixes.

Merge tag 'spi-nor/for-6.16' into mtd/next

SPI NOR changes for 6.16

Notable changes:

- Cleanup some Macronix flash entries.

- Add SFDP table fixups for Macronix MX25L3255E.

Merge tag 'kvmarm-fixes-6.16-1' of https://git./linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 6.16, take #1

- Make the irqbypass hooks resilient to changes in the GSI<->MSI
  routing, avoiding behind stale vLPI mappings being left behind. The
  fix is to resolve the VGIC IRQ using the host IRQ (which is stable)
  and nuking the vLPI mapping upon a routing change.

- Close another VGIC race where vCPU creation races with VGIC
  creation, leading to in-flight vCPUs entering the kernel w/o private
  IRQs allocated.

- Fix a build issue triggered by the recently added workaround for
  Ampere's AC04_CPU_23 erratum.

- Correctly sign-extend the VA when emulating a TLBI instruction
  potentially targeting a VNCR mapping.

- Avoid dereferencing a NULL pointer in the VGIC debug code, which can
  happen if the device doesn't have any mapping yet.

rtmutex_api: provide correct extern functions

Commit fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock")
changed the set of functions that mutex.c defines when CONFIG_DEBUG_LOCK_ALLOC
is set.

- it removed the "extern" declaration of mutex_lock_killable_nested from
  include/linux/mutex.h, and replaced it with a macro since it could be
  treated as a special case of _mutex_lock_killable.  It also removed a
  definition of the function in kernel/locking/mutex.c.

- likewise, it replaced mutex_trylock() with the more generic
  mutex_trylock_nest_lock() and replaced mutex_trylock() with a macro.

However, it left the old definitions in place in kernel/locking/rtmutex_api.c,
which causes failures when building with CONFIG_RT_MUTEXES=y.  Bring over
the changes.

Fixes: fb49f07ba1d9 ("locking/mutex: implement mutex_lock_killable_nest_lock")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge branch 'next' into for-linus

Prepare input updates for 6.16 merge window.

Merge tag 'hardening-v6.16-rc1-fix1-take2' of git://git./linux/kernel/git/kees/linux

Pull hardening fixes from Kees Cook:

- randstruct: gcc-plugin: Fix attribute addition with GCC 15

- ubsan: integer-overflow: depend on BROKEN to keep this out of CI

- overflow: Introduce __DEFINE_FLEX for having no initializer

- wifi: iwlwifi: mld: Work around Clang loop unrolling bug

[ Take two after a jump scare due to some repo rewriting by 'b4' - Linus ]

* tag 'hardening-v6.16-rc1-fix1-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  randstruct: gcc-plugin: Fix attribute addition
  overflow: Introduce __DEFINE_FLEX for having no initializer
  ubsan: integer-overflow: depend on BROKEN to keep this out of CI
  wifi: iwlwifi: mld: Work around Clang loop unrolling bug

Merge tag 'linux-watchdog-6.16-rc1' of git://linux-watchdog.org/linux-watchdog

Pull watchdog updates from Wim Van Sebroeck:

- Add watchdog timer for the NXP S32 platform

- Add driver for Intel OC WDT

- Add exynos990-wdt

- Various other fixes and improvements

* tag 'linux-watchdog-6.16-rc1' of git://www.linux-watchdog.org/linux-watchdog: (22 commits)
  watchdog: iTCO_wdt: Update the heartbeat value after clamping timeout
  watchdog: Add driver for Intel OC WDT
  watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFT
  watchdog: iTCO: Drop driver-internal locking
  watchdog: apple: set max_hw_heartbeat_ms instead of max_timeout
  watchdog: qcom: introduce the device data for IPQ5424 watchdog device
  dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) support
  watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe()
  watchdog: s3c2410_wdt: Add exynos990-wdt compatible data
  dt-bindings: watchdog: samsung-wdt: Add exynos990-wdt compatible
  dt-bindings: watchdog: Add rk3562 compatible
  dt-bindings: watchdog: fsl,scu-wdt: Document imx8qm
  watchdog: Add the Watchdog Timer for the NXP S32 platform
  dt-bindings: watchdog: Add NXP Software Watchdog Timer
  watchdog: Correct kerneldoc warnings
  watchdog: stm32: Fix wakeup source leaks on device unbind
  watchdog: Do not enable by default during compile testing
  watchdog: cros-ec: Avoid -Wflex-array-member-not-at-end warning
  watchdog: da9052_wdt: respect TWDMIN
  watchdog: da9052_wdt: do not disable wdt during probe
  ...

Merge tag 'i3c/for-6.16' of git://git./linux/kernel/git/i3c/linux

Pull i3c updates from Alexandre Belloni:
"There is not much this this, mostly fixes around interrupt and IBI
  handling:

   - mipi-i3c-hci: interrupt handling fixes

   - svc: i.MX94 and i.MX95 support, IBI handling fixes"

* tag 'i3c/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
  i3c: controllers do not need to depend on I3C
  i3c: master: svc: switch to bulk clk API for flexible clock support
  dt-bindings: i3c: silvaco,i3c-master: add i.MX94 and i.MX95 I3C
  i3c: master: svc: skip address resend on repeat START
  i3c: master: svc: Emit STOP asap in the IBI transaction
  i3c: master: svc: Receive IBI requests in interrupt context
  i3c: mipi-i3c-hci: Move unexpected INTR_STATUS print before IO handler
  i3c: mipi-i3c-hci: Change name of INTR_STATUS bit 11
  i3c: mipi-i3c-hci: Clear INTR_STATUS unconditionally
  i3c: mipi-i3c-hci: Fix handling status of i3c_hci_irq_handler()
  i3c: mipi-i3c-hci: Allow only relevant INTR_STATUS bit updates

Merge tag 'edac_urgent_for_v6.16_rc1' of git://git./linux/kernel/git/ras/ras

Pull EDAC fix from Borislav Petkov:
"Limit a register write width in altera_edac to avoid hw errors"

* tag 'edac_urgent_for_v6.16_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
EDAC/altera: Use correct write width with the INTTEST register

Merge tag 'for-linus' of https://github.com/openrisc/linux

Pull OpenRISC updates from Stafford Horne:
"Just a few documentation updates from the community:

   - Device tree documentation conversion from txt to yaml

   - Documentation addition to help users getting started with initramfs
     on OpenRISC

* tag 'for-linus' of https://github.com/openrisc/linux:
  dt-bindings: interrupt-controller: Convert openrisc,ompic to DT schema
  dt-bindings: interrupt-controller: Convert opencores,or1k-pic to DT schema
  Documentation:openrisc: Add build instructions with initramfs

Merge tag 'parisc-for-6.16-rc1' of git://git./linux/kernel/git/deller/parisc-linux

Pull parisc updates from Helge Deller:
"Fix building with gcc-15, formatting fix on unaligned warnings and
  replace __ASSEMBLY__ with __ASSEMBLER__ in headers"

* tag 'parisc-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc/unaligned: Fix hex output to show 8 hex chars
  parisc: fix building with gcc-15
  parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers
  parisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers

randstruct: gcc-plugin: Fix attribute addition

Based on changes in the 2021 public version of the randstruct
out-of-tree GCC plugin[1], more carefully update the attributes on
resulting decls, to avoid tripping checks in GCC 15's
comptypes_check_enum_int() when it has been configured with
"--enable-checking=misc":

arch/arm64/kernel/kexec_image.c:132:14: internal compiler error: in comptypes_check_enum_int, at c/c-typeck.cc:1519
132 | const struct kexec_file_ops kexec_image_ops = {
| ^~~~~~~~~~~~~~
internal_error(char const*, ...), at gcc/gcc/diagnostic-global-context.cc:517
fancy_abort(char const*, int, char const*), at gcc/gcc/diagnostic.cc:1803
comptypes_check_enum_int(tree_node*, tree_node*, bool*), at gcc/gcc/c/c-typeck.cc:1519
...

Link: https://archive.org/download/grsecurity/grsecurity-3.1-5.10.41-202105280954.patch.gz
Reported-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
Closes: https://github.com/KSPP/linux/issues/367
Closes: https://lore.kernel.org/lkml/20250530000646.104457-1-thiago.bauermann@linaro.org/
Reported-by: Ingo Saitz <ingo@hannover.ccc.de>
Closes: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104745
Fixes: 313dd1b62921 ("gcc-plugins: Add the randstruct plugin")
Tested-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
Link: https://lore.kernel.org/r/20250530221824.work.623-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>

overflow: Introduce __DEFINE_FLEX for having no initializer

While not yet in the tree, there is a proposed patch[1] that was
depending on the prior behavior of _DEFINE_FLEX, which did not have an
explicit initializer. Provide this via __DEFINE_FLEX now, which can also
have attributes applied (e.g. __uninitialized).

Examples of the resulting initializer behaviors can be seen here:
https://godbolt.org/z/P7Go8Tr33

Link: https://lore.kernel.org/netdev/20250520205920.2134829-9-anthony.l.nguyen@intel.com
Fixes: 47e36ed78406 ("overflow: Fix direct struct member initialization in _DEFINE_FLEX()")
Signed-off-by: Kees Cook <kees@kernel.org>

watchdog: iTCO_wdt: Update the heartbeat value after clamping timeout

When executing "modprobe iTCO_wdt heartbeat=700", the user-specified
'heartbeat' parameter exceeds the valid range, the driver clamps the
timeout to default 30s but fails to update the logged 'heartbeat' value,
resulting in misleading log output:

iTCO_wdt iTCO_wdt: timeout value out of range, using 30
iTCO_wdt iTCO_wdt: initialized. heartbeat=700 sec (nowayout=0)

After validating the range, update the 'heartbeat' value with the clamped
timeout value to ensure that log messages accurately reflect the actual
runtime parameters.

Signed-off-by: Ziyan Fu <fuzy5@lenovo.com>
Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Link: https://lore.kernel.org/r/20250429102533.11886-1-13281011316@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: Add driver for Intel OC WDT

Add a driver for the Intel Over-Clocking Watchdog found in Intel
Platform Controller (PCH) chipsets. This watchdog is controlled
via a simple single-register interface and would otherwise be
standard except for the presence of a LOCK bit that can only be
set once per power cycle, needing extra handling around it.

Signed-off-by: Diogo Ivo <diogo.ivo@siemens.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250317-ivo-intel_oc_wdt-v3-1-32c396f4eefd@siemens.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: arm_smc_wdt: get wdt status through SMCWD_GET_TIMELEFT

The optional SMCWD_GET_TIMELEFT command can be used to detect if
the watchdog has already been started.
See the implementation in OP-TEE secure OS [1].

At probe time, check if the watchdog is already started and then
set WDOG_HW_RUNNING in the watchdog status. This will cause the
watchdog framework to ping the watchdog until a userspace watchdog
daemon takes over the control.

Link: https://github.com/OP-TEE/optee_os/commit/a7f2d4bd8632
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250520085952.210723-1-antonio.borneo@foss.st.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: iTCO: Drop driver-internal locking

The locking code in the iTCO watchdog driver has been carried along from
before the watchdog core existed. The watchdog core protects calls into
drivers since commit f4e9c82f64b5 ("watchdog: Add Locking support"),
making driver-internal locking unnecessary. Drop it.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Link: https://lore.kernel.org/r/20250517160936.3231017-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: apple: set max_hw_heartbeat_ms instead of max_timeout

The hardware only supports timeouts slightly below 3mins, but by using
max_hw_heartbeat_ms we can let the kernel take care of supporting larger
timeouts than that requested from userspace.

Switching to max_hw_heartbeat_ms also means our set_timeout function now
needs to configure the hardware to the minimum of either the requested
timeout (in seconds) or the maximum supported by the user (in seconds).

Signed-off-by: Florian Klink <flokli@flokli.de>
Reviewed-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Link: https://lore.kernel.org/r/20250506142621.11428-2-flokli@flokli.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: qcom: introduce the device data for IPQ5424 watchdog device

To retrieve the restart reason from IMEM, certain device specific data
like IMEM compatible to lookup, location of IMEM to read, etc should be
defined. To achieve that, introduce the separate device data for IPQ5424
and add the required details subsequently.

Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250502-wdt_reset_reason-v3-3-b2dc7ace38ca@oss.qualcomm.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

dt-bindings: watchdog: renesas,wdt: Document RZ/V2N (R9A09G056) support

Document support for the watchdog IP found on the Renesas RZ/V2N
(R9A09G056) SoC. The watchdog IP is identical to that on RZ/V2H(P),
so `renesas,r9a09g057-wdt` will be used as a fallback compatible,
enabling reuse of the existing driver without changes.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250502120054.47323-1-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_se30_wdt_probe()

devm_ioremap() returns NULL on error. Currently, lenovo_se30_wdt_probe()
does not check for this case, which results in a NULL pointer
dereference.

Add NULL check after devm_ioremap() to prevent this issue.

Fixes: c284153a2c55 ("watchdog: lenovo_se30_wdt: Watchdog driver for Lenovo SE30 platform")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250424071648.89016-1-bsdhenrymartin@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

watchdog: s3c2410_wdt: Add exynos990-wdt compatible data

The Exynos990 has two watchdog clusters - cl0 and cl2. Add new
driver data for these two clusters, making it possible to use the
watchdog timer on this SoC.

Signed-off-by: Igor Belwon <igor.belwon@mentallysanemainliners.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250420-wdt-resends-april-v1-2-f58639673959@mentallysanemainliners.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

dt-bindings: watchdog: samsung-wdt: Add exynos990-wdt compatible

Add a dt-binding compatible for the Exynos990 Watchdog timer.
This watchdog is compatible with the GS101/Exynos850 design, as
such it requires the cluster-index and syscon-phandle properties
to be present. It also contains a cl2 cluster, as such the
cluster-index property has been expanded.

Signed-off-by: Igor Belwon <igor.belwon@mentallysanemainliners.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20250420-wdt-resends-april-v1-1-f58639673959@mentallysanemainliners.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>

Merge tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git./linux/kernel/git/akpm/mm

Pull non-MM updates from Andrew Morton:

- "hung_task: extend blocking task stacktrace dump to semaphore" from
   Lance Yang enhances the hung task detector.

   The detector presently dumps the blocking tasks's stack when it is
   blocked on a mutex. Lance's series extends this to semaphores

- "nilfs2: improve sanity checks in dirty state propagation" from
   Wentao Liang addresses a couple of minor flaws in nilfs2

- "scripts/gdb: Fixes related to lx_per_cpu()" from Illia Ostapyshyn
   fixes a couple of issues in the gdb scripts

- "Support kdump with LUKS encryption by reusing LUKS volume keys" from
   Coiby Xu addresses a usability problem with kdump.

   When the dump device is LUKS-encrypted, the kdump kernel may not have
   the keys to the encrypted filesystem. A full writeup of this is in
   the series [0/N] cover letter

- "sysfs: add counters for lockups and stalls" from Max Kellermann adds
   /sys/kernel/hardlockup_count and /sys/kernel/hardlockup_count and
   /sys/kernel/rcu_stall_count

- "fork: Page operation cleanups in the fork code" from Pasha Tatashin
   implements a number of code cleanups in fork.c

- "scripts/gdb/symbols: determine KASLR offset on s390 during early
   boot" from Ilya Leoshkevich fixes some s390 issues in the gdb
   scripts

* tag 'mm-nonmm-stable-2025-05-31-15-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (67 commits)
  llist: make llist_add_batch() a static inline
  delayacct: remove redundant code and adjust indentation
  squashfs: add optional full compressed block caching
  crash_dump, nvme: select CONFIGFS_FS as built-in
  scripts/gdb/symbols: determine KASLR offset on s390 during early boot
  scripts/gdb/symbols: factor out pagination_off()
  scripts/gdb/symbols: factor out get_vmlinux()
  kernel/panic.c: format kernel-doc comments
  mailmap: update and consolidate Casey Connolly's name and email
  nilfs2: remove wbc->for_reclaim handling
  fork: define a local GFP_VMAP_STACK
  fork: check charging success before zeroing stack
  fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code
  fork: clean-up ifdef logic around stack allocation
  kernel/rcu/tree_stall: add /sys/kernel/rcu_stall_count
  kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count
  x86/crash: make the page that stores the dm crypt keys inaccessible
  x86/crash: pass dm crypt keys to kdump kernel
  Revert "x86/mm: Remove unused __set_memory_prot()"
  crash_dump: retrieve dm crypt keys in kdump kernel
  ...

Merge tag 'mm-stable-2025-05-31-14-50' of git://git./linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

- "Add folio_mk_pte()" from Matthew Wilcox simplifies the act of
   creating a pte which addresses the first page in a folio and reduces
   the amount of plumbing which architecture must implement to provide
   this.

- "Misc folio patches for 6.16" from Matthew Wilcox is a shower of
   largely unrelated folio infrastructure changes which clean things up
   and better prepare us for future work.

- "memory,x86,acpi: hotplug memory alignment advisement" from Gregory
   Price adds early-init code to prevent x86 from leaving physical
   memory unused when physical address regions are not aligned to memory
   block size.

- "mm/compaction: allow more aggressive proactive compaction" from
   Michal Clapinski provides some tuning of the (sadly, hard-coded (more
   sadly, not auto-tuned)) thresholds for our invokation of proactive
   compaction. In a simple test case, the reduction of a guest VM's
   memory consumption was dramatic.

- "Minor cleanups and improvements to swap freeing code" from Kemeng
   Shi provides some code cleaups and a small efficiency improvement to
   this part of our swap handling code.

- "ptrace: introduce PTRACE_SET_SYSCALL_INFO API" from Dmitry Levin
   adds the ability for a ptracer to modify syscalls arguments. At this
   time we can alter only "system call information that are used by
   strace system call tampering, namely, syscall number, syscall
   arguments, and syscall return value.

   This series should have been incorporated into mm.git's "non-MM"
   branch, but I goofed.

- "fs/proc: extend the PAGEMAP_SCAN ioctl to report guard regions" from
   Andrei Vagin extends the info returned by the PAGEMAP_SCAN ioctl
   against /proc/pid/pagemap. This permits CRIU to more efficiently get
   at the info about guard regions.

- "Fix parameter passed to page_mapcount_is_type()" from Gavin Shan
   implements that fix. No runtime effect is expected because
   validate_page_before_insert() happens to fix up this error.

- "kernel/events/uprobes: uprobe_write_opcode() rewrite" from David
   Hildenbrand basically brings uprobe text poking into the current
   decade. Remove a bunch of hand-rolled implementation in favor of
   using more current facilities.

- "mm/ptdump: Drop assumption that pxd_val() is u64" from Anshuman
   Khandual provides enhancements and generalizations to the pte dumping
   code. This might be needed when 128-bit Page Table Descriptors are
   enabled for ARM.

- "Always call constructor for kernel page tables" from Kevin Brodsky
   ensures that the ctor/dtor is always called for kernel pgtables, as
   it already is for user pgtables.

   This permits the addition of more functionality such as "insert hooks
   to protect page tables". This change does result in various
   architectures performing unnecesary work, but this is fixed up where
   it is anticipated to occur.

- "Rust support for mm_struct, vm_area_struct, and mmap" from Alice
   Ryhl adds plumbing to permit Rust access to core MM structures.

- "fix incorrectly disallowed anonymous VMA merges" from Lorenzo
   Stoakes takes advantage of some VMA merging opportunities which we've
   been missing for 15 years.

- "mm/madvise: batch tlb flushes for MADV_DONTNEED and MADV_FREE" from
   SeongJae Park optimizes process_madvise()'s TLB flushing.

   Instead of flushing each address range in the provided iovec, we
   batch the flushing across all the iovec entries. The syscall's cost
   was approximately halved with a microbenchmark which was designed to
   load this particular operation.

- "Track node vacancy to reduce worst case allocation counts" from
   Sidhartha Kumar makes the maple tree smarter about its node
   preallocation.

   stress-ng mmap performance increased by single-digit percentages and
   the amount of unnecessarily preallocated memory was dramaticelly
   reduced.

- "mm/gup: Minor fix, cleanup and improvements" from Baoquan He removes
   a few unnecessary things which Baoquan noted when reading the code.

- ""Enhance sysfs handling for memory hotplug in weighted interleave"
   from Rakie Kim "enhances the weighted interleave policy in the memory
   management subsystem by improving sysfs handling, fixing memory
   leaks, and introducing dynamic sysfs updates for memory hotplug
   support". Fixes things on error paths which we are unlikely to hit.

- "mm/damon: auto-tune DAMOS for NUMA setups including tiered memory"
   from SeongJae Park introduces new DAMOS quota goal metrics which
   eliminate the manual tuning which is required when utilizing DAMON
   for memory tiering.

- "mm/vmalloc.c: code cleanup and improvements" from Baoquan He
   provides cleanups and small efficiency improvements which Baoquan
   found via code inspection.

- "vmscan: enforce mems_effective during demotion" from Gregory Price
   changes reclaim to respect cpuset.mems_effective during demotion when
   possible. because presently, reclaim explicitly ignores
   cpuset.mems_effective when demoting, which may cause the cpuset
   settings to violated.

   This is useful for isolating workloads on a multi-tenant system from
   certain classes of memory more consistently.

- "Clean up split_huge_pmd_locked() and remove unnecessary folio
   pointers" from Gavin Guo provides minor cleanups and efficiency gains
   in in the huge page splitting and migrating code.

- "Use kmem_cache for memcg alloc" from Huan Yang creates a slab cache
   for `struct mem_cgroup', yielding improved memory utilization.

- "add max arg to swappiness in memory.reclaim and lru_gen" from
   Zhongkun He adds a new "max" argument to the "swappiness=" argument
   for memory.reclaim MGLRU's lru_gen.

   This directs proactive reclaim to reclaim from only anon folios
   rather than file-backed folios.

- "kexec: introduce Kexec HandOver (KHO)" from Mike Rapoport is the
   first step on the path to permitting the kernel to maintain existing
   VMs while replacing the host kernel via file-based kexec. At this
   time only memblock's reserve_mem is preserved.

- "mm: Introduce for_each_valid_pfn()" from David Woodhouse provides
   and uses a smarter way of looping over a pfn range. By skipping
   ranges of invalid pfns.

- "sched/numa: Skip VMA scanning on memory pinned to one NUMA node via
   cpuset.mems" from Libo Chen removes a lot of pointless VMA scanning
   when a task is pinned a single NUMA mode.

   Dramatic performance benefits were seen in some real world cases.

- "JFS: Implement migrate_folio for jfs_metapage_aops" from Shivank
   Garg addresses a warning which occurs during memory compaction when
   using JFS.

- "move all VMA allocation, freeing and duplication logic to mm" from
   Lorenzo Stoakes moves some VMA code from kernel/fork.c into the more
   appropriate mm/vma.c.

- "mm, swap: clean up swap cache mapping helper" from Kairui Song
   provides code consolidation and cleanups related to the folio_index()
   function.

- "mm/gup: Cleanup memfd_pin_folios()" from Vishal Moola does that.

- "memcg: Fix test_memcg_min/low test failures" from Waiman Long
   addresses some bogus failures which are being reported by the
   test_memcontrol selftest.

- "eliminate mmap() retry merge, add .mmap_prepare hook" from Lorenzo
   Stoakes commences the deprecation of file_operations.mmap() in favor
   of the new file_operations.mmap_prepare().

   The latter is more restrictive and prevents drivers from messing with
   things in ways which, amongst other problems, may defeat VMA merging.

- "memcg: decouple memcg and objcg stocks"" from Shakeel Butt decouples
   the per-cpu memcg charge cache from the objcg's one.

   This is a step along the way to making memcg and objcg charging
   NMI-safe, which is a BPF requirement.

- "mm/damon: minor fixups and improvements for code, tests, and
   documents" from SeongJae Park is yet another batch of miscellaneous
   DAMON changes. Fix and improve minor problems in code, tests and
   documents.

- "memcg: make memcg stats irq safe" from Shakeel Butt converts memcg
   stats to be irq safe. Another step along the way to making memcg
   charging and stats updates NMI-safe, a BPF requirement.

- "Let unmap_hugepage_range() and several related functions take folio
   instead of page" from Fan Ni provides folio conversions in the
   hugetlb code.

* tag 'mm-stable-2025-05-31-14-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (285 commits)
  mm: pcp: increase pcp->free_count threshold to trigger free_high
  mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range()
  mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page
  mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page
  mm/hugetlb: pass folio instead of page to unmap_ref_private()
  memcg: objcg stock trylock without irq disabling
  memcg: no stock lock for cpu hot-unplug
  memcg: make __mod_memcg_lruvec_state re-entrant safe against irqs
  memcg: make count_memcg_events re-entrant safe against irqs
  memcg: make mod_memcg_state re-entrant safe against irqs
  memcg: move preempt disable to callers of memcg_rstat_updated
  memcg: memcg_rstat_updated re-entrant safe against irqs
  mm: khugepaged: decouple SHMEM and file folios' collapse
  selftests/eventfd: correct test name and improve messages
  alloc_tag: check mem_profiling_support in alloc_tag_init
  Docs/damon: update titles and brief introductions to explain DAMOS
  selftests/damon/_damon_sysfs: read tried regions directories in order
  mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()
  mm/damon/paddr: remove unused variable, folio_list, in damon_pa_stat()
  mm/damon/sysfs-schemes: fix wrong comment on damons_sysfs_quota_goal_metric_strs
  ...

Merge tag 'fbdev-for-6.16-rc1' of git://git./linux/kernel/git/deller/linux-fbdev

Pull fbdev updates from Helge Deller:
"Many small but important fixes for special cases in the fbdev, fbcon
  and vgacon code which were found with Syzkaller, Svace and other tools
  by various people and teams (e.g. Linux Verification Center).

  Some smaller code cleanups in the nvidiafb, arkfb, atyfb and viafb
  drivers and two spelling fixes"

* tag 'fbdev-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
  fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
  fbdev: sstfb.rst: Fix spelling mistake
  fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
  fbcon: Make sure modelist not set on unregistered console
  vgacon: Add check for vc_origin address range in vgacon_scroll()
  fbdev: arkfb: Cast ics5342_init() allocation type
  fbdev: nvidiafb: Correct const string length in nvidiafb_setup()
  fbdev: atyfb: Remove unused PCI vendor ID
  fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM
  fbdev: via: use new GPIO line value setter callbacks

selftests/filesystems: Fix build of anon_inode_test

The newly added anon_inode_test test fails to build due to attempting to
include a nonexisting overlayfs/wrapper.h:

  anon_inode_test.c:10:10: fatal error: overlayfs/wrappers.h: No such file or directory
     10 | #include "overlayfs/wrappers.h"
        |          ^~~~~~~~~~~~~~~~~~~~~~

This is due to 0bd92b9fe538 ("selftests/filesystems: move wrapper.h out
of overlayfs subdir") which was added in the vfs-6.16.selftests branch
which was based on -rc5 and did not contain the newly added test so once
things were merged into mainline the build started failing - both parent
commits are fine.

Fixes: 3e406741b1989 ("Merge tag 'vfs-6.16-rc1.selftests' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs")
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge tag 'gcc-minimum-version-6.16' of git://git./linux/kernel/git/arnd/asm-generic

Pull compiler version requirement update from Arnd Bergmann:
"Require gcc-8 and binutils-2.30

  x86 already uses gcc-8 as the minimum version, this changes all other
  architectures to the same version. gcc-8 is used is Debian 10 and Red
  Hat Enterprise Linux 8, both of which are still supported, and
  binutils 2.30 is the oldest corresponding version on those.

  Ubuntu Pro 18.04 and SUSE Linux Enterprise Server 15 both use gcc-7 as
  the system compiler but additionally include toolchains that remain
  supported.

  With the new minimum toolchain versions, a number of workarounds for
  older versions can be dropped, in particular on x86_64 and arm64.
  Importantly, the updated compiler version allows removing two of the
  five remaining gcc plugins, as support for sancov and structeak
  features is already included in modern compiler versions.

  I tried collecting the known changes that are possible based on the
  new toolchain version, but expect that more cleanups will be possible.

  Since this touches multiple architectures, I merged the patches
  through the asm-generic tree."

* tag 'gcc-minimum-version-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  Makefile.kcov: apply needed compiler option unconditionally in CFLAGS_KCOV
  Documentation: update binutils-2.30 version reference
  gcc-plugins: remove SANCOV gcc plugin
  Kbuild: remove structleak gcc plugin
  arm64: drop binutils version checks
  raid6: skip avx512 checks
  kbuild: require gcc-8 and binutils-2.30

Merge tag 'soc-newsoc-6.16' of git://git./linux/kernel/git/soc/soc

Pull sophgo SoC devicetree updates from Arnd Bergmann:
"The Sophgo SG2044 SoC is their second generation server chip with 64
  cores, following the SG2042.

  In addition, there are minor updates for the cv180x SoCs"

* tag 'soc-newsoc-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  riscv: dts: sophgo: switch precise compatible for existed clock device for CV18XX
  riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10
  dt-bindings: riscv: sophgo: Add SG2044 compatible string
  dt-bindings: interrupt-controller: Add Sophgo SG2044 PLIC
  dt-bindings: interrupt-controller: Add Sophgo SG2044 CLINT mswi
  riscv: dts: sopgho: use SOC_PERIPHERAL_IRQ to calculate interrupt number
  riscv: dts: sophgo: rename header file cv18xx.dtsi to cv180x.dtsi
  riscv: dts: sophgo: Move riscv cpu definition to a separate file
  riscv: dts: sophgo: Move all soc specific device into soc dtsi file
  riscv: sophgo: dts: Add spi controller for SG2042
  riscv: dts: sophgo: sg2042: add pinctrl support

Merge tag 'soc-dt-6.16' of git://git./linux/kernel/git/soc/soc

Pull SoC devicetree updates from Arnd Bergmann:
"There are 11 newly supported SoCs, but these are all either new
  variants of existing designs, or straight reuses of the existing chip
  in a new package:

   - RK3562 is a new chip based on the old Cortex-A53 core, apparently a
     low-cost version of the Cortex-A55 based RK3568/RK3566.

   - NXP i.MX94 is a minor variation of i.MX93/i.MX95 with a different
     set of on-chip peripherals.

   - Renesas RZ/V2N (R9A09G056) is a new member of the larger RZ/V2
     family

   - Amlogic S6/S7/S7D

   - Samsung Exynos7870 is an older chip similar to Exynos7885

   - WonderMedia wm8950 is a minor variation on the wm8850 chip

   - Amlogic s805y is almost idential to s805x

   - Allwinner A523 is similar to A527 and T527

   - Qualcomm MSM8926 is a variant of MSM8226

   - Qualcomm Snapdragon X1P42100 is related to R1E80100

  There are also 65 boards, including reference designs for the chips
  above, this includes

   - 12 new boards based on TI K3 series chips, most of them from
     Toradex

   - 10 devices using Rockchips RK35xx and PX30 chips

   - 2 phones and 2 laptops based on Qualcomm Snapdragon designs

   - 10 NXP i.MX8/i.MX9 boards, mostly for embedded/industrial uses

   - 3 Samsung Galaxy phones based on Exynos7870

   - 5 Allwinner based boards using a variety of ARMv8 chips

   - 9 32-bit machines, each based on a different SoC family

  Aside from the new hardware, there is the usual set of cleanups and
  newly added hardware support on existing machines, for a total of 965
  devicetree changesets"

* tag 'soc-dt-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (956 commits)
  MAINTAINERS, mailmap: update Sven Peter's email address
  arm64: dts: renesas: rzg3e-smarc-som: Reduce I2C2 clock frequency
  arm64: dts: nuvoton: Add pinctrl
  ARM: dts: samsung: sp5v210-aries: Align wifi node name with bindings
  arm64: dts: blaize-blzp1600: Enable GPIO support
  dt-bindings: clock: socfpga: convert to yaml
  arm64: dts: rockchip: move rk3562 pinctrl node outside the soc node
  arm64: dts: rockchip: fix rk3562 pcie unit addresses
  arm64: dts: rockchip: move rk3528 pinctrl node outside the soc node
  arm64: dts: rockchip: remove a double-empty line from rk3576 core dtsi
  arm64: dts: rockchip: move rk3576 pinctrl node outside the soc node
  arm64: dts: rockchip: fix rk3576 pcie unit addresses
  arm64: dts: rockchip: Drop assigned-clock* from cpu nodes on rk3588
  arm64: dts: rockchip: Add missing SFC power-domains to rk3576
  Revert "arm64: dts: mediatek: mt8390-genio-common: Add firmware-name for scp0"
  arm64: dts: mediatek: mt8188: Address binding warnings for MDP3 nodes
  arm64: dts: mt6359: Rename RTC node to match binding expectations
  arm64: dts: mt8365-evk: Add goodix touchscreen support
  arm64: dts: mediatek: mt8188: Add missing #reset-cells property
  arm64: dts: airoha: en7581: Add PCIe nodes to EN7581 SoC evaluation board
  ...

Merge tag 'soc-defconfig-6.16' of git://git./linux/kernel/git/soc/soc

Pull SoC defconfig updates from Arnd Bergmann:
"The usual defconfig updates enable configuration options for drivers
  that got added. A few SoC specific options are enabled in Kconfig
  files instead, in place of the defconfig files"

* tag 'soc-defconfig-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  arm64: defconfig: enable ACPM protocol and Exynos mailbox
  arm64: defconfig: Enable configs for MediaTek Genio EVK boards
  arm64: defconfig: mediatek: enable PHY drivers
  arm64: defconfig: Enable Rockchip SAI and ES8328
  arm64: defconfig: Add Toradex Embedded Controller config
  arm64: defconfig: Enable TPIC2810 GPIO expander
  riscv: defconfig: spacemit: enable clock controller driver for SpacemiT K1
  arm64: defconfig: Enable TMP102 as module
  arm64: defconfig: Enable hwspinlock and eQEP for K3
  arm64: defconfig: Add CDNS_DSI and CDNS_PHY config
  riscv: defconfig: spacemit: enable gpio support for K1 SoC
  arm64: defconfig: Enable IPQ5424 RDP466 base configs
  riscv: Enable PM_GENERIC_DOMAINS for T-Head SoCs

Merge tag 'soc-arm-6.16' of git://git./linux/kernel/git/soc/soc

Pull ARM SoC updates from Arnd Bergmann:
"The main update in size is the removal of the TI DaVinci DA830 SoC
  support. DA830 is similar to DA850, which remain supported, but only
  the reference board was ever supported, and we removed that one 3
  years ago as it had never been converted to devicetree.

  There are some other cleanups for OMAP4 and a few boards using old
  GPIO interfaces"

* tag 'soc-arm-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  ARM: s3c: stop including gpio.h
  ARM: dts: davinci: da850-evm: Increase fifo threshold
  ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
  ARM: broadcom: MAINTAINERS: Cover bcm2712 files
  bus: ti-sysc: PRUSS OCP configuration
  ARM: davinci: remove support for da830
  ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
  ARM: omap2plus_defconfig: enable I2C devices of GTA04
  ARM: s3c/gpio: use new line value setter callbacks
  ARM: scoop/gpio: use new line value setter callbacks
  ARM: sa1100/gpio: use new line value setter callbacks
  ARM: orion/gpio: use new line value setter callbacks

Merge tag 'soc-drivers-6.16' of git://git./linux/kernel/git/soc/soc

Pull SoC driver updates from Arnd Bergmann:
"Updates are across the usual driver subsystems with SoC specific
  drivers:

   - added soc specicific drivers for sophgo cv1800 and sg2044, qualcomm
     sm8750, and amlogic c3 and s4 chips.

   - cache controller updates for sifive chips, plus binding changes for
     other cache descriptions.

   - memory controller drivers for mediatek mt6893, stm32 and cleanups
     for a few more drivers

   - reset controller drivers for T-Head TH1502, Sophgo sg2044 and
     Renesas RZ/V2H(P)

   - SCMI firmware updates to better deal with buggy firmware, plus
     better support for Qualcomm X1E and NXP i.MX specific interfaces

   - a new platform driver for the crypto firmware on Cznic Turris
     Omnia/MOX

   - cleanups for the TEE firmware subsystem and amdtee driver

   - minor updates and fixes for freescale/nxp, qualcomm, google,
     aspeed, wondermedia, ti, nxp, renesas, hisilicon, mediatek,
     broadcom and samsung SoCs"

* tag 'soc-drivers-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (133 commits)
  soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
  soc: aspeed: lpc: Fix impossible judgment condition
  ARM: aspeed: Don't select SRAM
  docs: firmware: qcom_scm: Fix kernel-doc warning
  soc: fsl: qe: Consolidate chained IRQ handler install/remove
  firmware: qcom: scm: Allow QSEECOM for HP EliteBook Ultra G1q
  dt-bindings: mfd: qcom,tcsr: Add compatible for ipq5018
  dt-bindings: cache: add QiLai compatible to ax45mp
  memory: stm32_omm: Fix error handling in stm32_omm_disable_child()
  dt-bindings: cache: Convert marvell,tauros2-cache to DT schema
  dt-bindings: cache: Convert marvell,{feroceon,kirkwood}-cache to DT schema
  soc: samsung: exynos-pmu: enable CPU hotplug support for gs101
  MAINTAINERS: Add google,gs101-pmu-intr-gen.yaml binding file
  dt-bindings: soc: samsung: exynos-pmu: gs101: add google,pmu-intr-gen phandle
  dt-bindings: soc: google: Add gs101-pmu-intr-gen binding documentation
  bus: fsl-mc: Use strscpy() instead of strscpy_pad()
  soc: fsl: qbman: Remove const from portal->cgrs allocation type
  bus: fsl_mc: Fix driver_managed_dma check
  bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
  bus: fsl-mc: drop useless cleanup
  ...

parisc/unaligned: Fix hex output to show 8 hex chars

Change back printk format to 0x%08lx instead of %#08lx, since the latter
does not seem to reliably format the value to 8 hex chars.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org # v5.18+
Fixes: e5e9e7f222e5b ("parisc/unaligned: Enhance user-space visible output")

Revert "iommu: make inclusion of arm/arm-smmu-v3 directory conditional"

This reverts commit e436576b0231542f6f233279f0972989232575a8.

That commit is very broken, and seems to have missed the fact that
CONFIG_ARM_SMMU_V3 is not just a yes-or-no thing, but also can be
modular.

So it caused build errors on arm64 allmodconfig setups:

  ERROR: modpost: "arm_smmu_make_cdtable_ste" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined!
  ERROR: modpost: "arm_smmu_make_s2_domain_ste" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined!
  ERROR: modpost: "arm_smmu_make_s1_cd" [drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.ko] undefined!
  ...

(and six more symbols just the same).

Link: https://lore.kernel.org/all/CAHk-=wh4qRwm7AQ8sBmQj7qECzgAhj4r73RtCDfmHo5SdcN0Jw@mail.gmail.com/
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Rolf Eike Beer <eb@emlix.com>
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

If fb_add_videomode() in fb_set_var() fails to allocate memory for
fb_videomode, later it may lead to a null-ptr dereference in
fb_videomode_to_var(), as the fb_info is registered while not having the
mode in modelist that is expected to be there, i.e. the one that is
described in fb_info->var.

================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901
Call Trace:
display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929
fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071
resize_screen drivers/tty/vt/vt.c:1176 [inline]
vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263
fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720
fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776
do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128
fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203
vfs_ioctl fs/ioctl.c:48 [inline]
__do_sys_ioctl fs/ioctl.c:753 [inline]
__se_sys_ioctl fs/ioctl.c:739 [inline]
__x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
================================================================

The reason is that fb_info->var is being modified in fb_set_var(), and
then fb_videomode_to_var() is called. If it fails to add the mode to
fb_info->modelist, fb_set_var() returns error, but does not restore the
old value of fb_info->var. Restore fb_info->var on failure the same way
it is done earlier in the function.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var

If fb_add_videomode() in do_register_framebuffer() fails to allocate
memory for fb_videomode, it will later lead to a null-ptr dereference in
fb_videomode_to_var(), as the fb_info is registered while not having the
mode in modelist that is expected to be there, i.e. the one that is
described in fb_info->var.

================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 30371 Comm: syz-executor.1 Not tainted 5.10.226-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:fb_videomode_to_var+0x24/0x610 drivers/video/fbdev/core/modedb.c:901
Call Trace:
display_to_var+0x3a/0x7c0 drivers/video/fbdev/core/fbcon.c:929
fbcon_resize+0x3e2/0x8f0 drivers/video/fbdev/core/fbcon.c:2071
resize_screen drivers/tty/vt/vt.c:1176 [inline]
vc_do_resize+0x53a/0x1170 drivers/tty/vt/vt.c:1263
fbcon_modechanged+0x3ac/0x6e0 drivers/video/fbdev/core/fbcon.c:2720
fbcon_update_vcs+0x43/0x60 drivers/video/fbdev/core/fbcon.c:2776
do_fb_ioctl+0x6d2/0x740 drivers/video/fbdev/core/fbmem.c:1128
fb_ioctl+0xe7/0x150 drivers/video/fbdev/core/fbmem.c:1203
vfs_ioctl fs/ioctl.c:48 [inline]
__do_sys_ioctl fs/ioctl.c:753 [inline]
__se_sys_ioctl fs/ioctl.c:739 [inline]
__x64_sys_ioctl+0x19a/0x210 fs/ioctl.c:739
do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
================================================================

Even though fbcon_init() checks beforehand if fb_match_mode() in
var_to_display() fails, it can not prevent the panic because fbcon_init()
does not return error code. Considering this and the comment in the code
about fb_match_mode() returning NULL - "This should not happen" - it is
better to prevent registering the fb_info if its mode was not set
successfully. Also move fb_add_videomode() closer to the beginning of
do_register_framebuffer() to avoid having to do the cleanup on fail.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: sstfb.rst: Fix spelling mistake

Fix spelling: "tweeks" to "tweaks"

Signed-off-by: Rujra Bhatt <braker.noob.kernel@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,
cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's
then passed to fb_cvt_hperiod(), where it's used as a divider -- division
by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to
avoid such overflow...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: 96fe6a2109db ("[PATCH] fbdev: Add VESA Coordinated Video Timings (CVT) support")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Helge Deller <deller@gmx.de>

fbcon: Make sure modelist not set on unregistered console

It looks like attempting to write to the "store_modes" sysfs node will
run afoul of unregistered consoles:

UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28
index -1 is out of range for type 'fb_info *[32]'
...
fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122
fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048
fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673
store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113
dev_attr_store+0x55/0x80 drivers/base/core.c:2439

static struct fb_info *fbcon_registered_fb[FB_MAX];
...
static signed char con2fb_map[MAX_NR_CONSOLES];
...
static struct fb_info *fbcon_info_from_console(int console)
...
return fbcon_registered_fb[con2fb_map[console]];

If con2fb_map contains a -1 things go wrong here. Instead, return NULL,
as callers of fbcon_info_from_console() are trying to compare against
existing "info" pointers, so error handling should kick in correctly.

Reported-by: syzbot+a7d4444e7b6e743572f7@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/
Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>

vgacon: Add check for vc_origin address range in vgacon_scroll()

Our in-house Syzkaller reported the following BUG (twice), which we
believed was the same issue with [1]:

==================================================================
BUG: KASAN: slab-out-of-bounds in vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740
Read of size 2 at addr ffff88800f5bef60 by task syz.7.2620/12393
...
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106
print_address_description.constprop.0+0x6b/0x3d0 mm/kasan/report.c:364
print_report+0xba/0x280 mm/kasan/report.c:475
kasan_report+0xa9/0xe0 mm/kasan/report.c:588
vcs_scr_readw+0xc2/0xd0 drivers/tty/vt/vt.c:4740
vcs_write_buf_noattr drivers/tty/vt/vc_screen.c:493 [inline]
vcs_write+0x586/0x840 drivers/tty/vt/vc_screen.c:690
vfs_write+0x219/0x960 fs/read_write.c:584
ksys_write+0x12e/0x260 fs/read_write.c:639
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x78/0xe2
...
</TASK>

Allocated by task 5614:
kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:201 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0x62/0x140 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:721 [inline]
vc_do_resize+0x235/0xf40 drivers/tty/vt/vt.c:1193
vgacon_adjust_height+0x2d4/0x350 drivers/video/console/vgacon.c:1007
vgacon_font_set+0x1f7/0x240 drivers/video/console/vgacon.c:1031
con_font_set drivers/tty/vt/vt.c:4628 [inline]
con_font_op+0x4da/0xa20 drivers/tty/vt/vt.c:4675
vt_k_ioctl+0xa10/0xb30 drivers/tty/vt/vt_ioctl.c:474
vt_ioctl+0x14c/0x1870 drivers/tty/vt/vt_ioctl.c:752
tty_ioctl+0x655/0x1510 drivers/tty/tty_io.c:2779
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x78/0xe2

Last potentially related work creation:
kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492
__call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713
netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802
__sock_release+0xb5/0x270 net/socket.c:663
sock_close+0x1e/0x30 net/socket.c:1425
__fput+0x408/0xab0 fs/file_table.c:384
__fput_sync+0x4c/0x60 fs/file_table.c:465
__do_sys_close fs/open.c:1580 [inline]
__se_sys_close+0x68/0xd0 fs/open.c:1565
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x78/0xe2

Second to last potentially related work creation:
kasan_save_stack+0x20/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0x94/0xa0 mm/kasan/generic.c:492
__call_rcu_common.constprop.0+0xc3/0xa10 kernel/rcu/tree.c:2713
netlink_release+0x620/0xc20 net/netlink/af_netlink.c:802
__sock_release+0xb5/0x270 net/socket.c:663
sock_close+0x1e/0x30 net/socket.c:1425
__fput+0x408/0xab0 fs/file_table.c:384
task_work_run+0x154/0x240 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:45 [inline]
do_exit+0x8e5/0x1320 kernel/exit.c:874
do_group_exit+0xcd/0x280 kernel/exit.c:1023
get_signal+0x1675/0x1850 kernel/signal.c:2905
arch_do_signal_or_restart+0x80/0x3b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x1b3/0x1e0 kernel/entry/common.c:218
do_syscall_64+0x66/0x110 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x78/0xe2

The buggy address belongs to the object at ffff88800f5be000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 2656 bytes to the right of
allocated 1280-byte region [ffff88800f5be000, ffff88800f5be500)

...

Memory state around the buggy address:
ffff88800f5bee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800f5bef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88800f5bef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800f5bf000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

By analyzing the vmcore, we found that vc->vc_origin was somehow placed
one line prior to vc->vc_screenbuf when vc was in KD_TEXT mode, and
further writings to /dev/vcs caused out-of-bounds reads (and writes
right after) in vcs_write_buf_noattr().

Our further experiments show that in most cases, vc->vc_origin equals to
vga_vram_base when the console is in KD_TEXT mode, and it's around
vc->vc_screenbuf for the KD_GRAPHICS mode. But via triggerring a
TIOCL_SETVESABLANK ioctl beforehand, we can make vc->vc_origin be around
vc->vc_screenbuf while the console is in KD_TEXT mode, and then by
writing the special 'ESC M' control sequence to the tty certain times
(depends on the value of `vc->state.y - vc->vc_top`), we can eventually
move vc->vc_origin prior to vc->vc_screenbuf. Here's the PoC, tested on
QEMU:

```
int main() {
const int RI_NUM = 10; // should be greater than `vc->state.y - vc->vc_top`
int tty_fd, vcs_fd;
const char *tty_path = "/dev/tty0";
const char *vcs_path = "/dev/vcs";
const char escape_seq[] = "\x1bM"; // ESC + M
const char trigger_seq[] = "Let's trigger an OOB write.";
struct vt_sizes vt_size = { 70, 2 };
int blank = TIOCL_BLANKSCREEN;

tty_fd = open(tty_path, O_RDWR);

char vesa_mode[] = { TIOCL_SETVESABLANK, 1 };
ioctl(tty_fd, TIOCLINUX, vesa_mode);

ioctl(tty_fd, TIOCLINUX, &blank);
ioctl(tty_fd, VT_RESIZE, &vt_size);

for (int i = 0; i < RI_NUM; ++i)
write(tty_fd, escape_seq, sizeof(escape_seq) - 1);

vcs_fd = open(vcs_path, O_RDWR);
write(vcs_fd, trigger_seq, sizeof(trigger_seq));

close(vcs_fd);
close(tty_fd);
return 0;
}
```

To solve this problem, add an address range validation check in
vgacon_scroll(), ensuring vc->vc_origin never precedes vc_screenbuf.

Reported-by: syzbot+9c09fda97a1a65ea859b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9c09fda97a1a65ea859b [1]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Co-developed-by: Yi Yang <yiyang13@huawei.com>
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: arkfb: Cast ics5342_init() allocation type

In preparation for making the kmalloc family of allocators type aware,
we need to make sure that the returned type from the allocation matches
the type of the variable being assigned. (Before, the allocator would
always return "void *", which can be implicitly cast to any pointer type.)

The assigned type is "struct dac_info *" but the returned type will be
"struct ics5342_info *", which has a larger allocation size. This is
by design, as struct ics5342_info contains struct dac_info as its first
member.
(patch slightly modified by Helge Deller)

Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: nvidiafb: Correct const string length in nvidiafb_setup()

The actual length of const string "noaccel" is 7, but the strncmp()
branch in nvidiafb_setup() wrongly hard codes it as 6.

Fix by using actual length 7 as argument of the strncmp().

Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: atyfb: Remove unused PCI vendor ID

The custom definition of PCI vendor ID in video/mach64.h is unused.
Remove it. Note, that the proper one is available in pci_ids.h.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: carminefb: Fix spelling mistake of CARMINE_TOTAL_DIPLAY_MEM

There is a spelling mistake in macro CARMINE_TOTAL_DIPLAY_MEM. Fix it.

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>

fbdev: via: use new GPIO line value setter callbacks

struct gpio_chip now has callbacks for setting line values that return
an integer, allowing to indicate failures. Convert the driver to using
them.

Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>

Merge tag 'trace-ringbuffer-v6.16' of git://git./linux/kernel/git/trace/linux-trace

Pull ring-buffer updates from Steven Rostedt:

- Allow the persistent ring buffer to be memory mapped

   In the last merge window there was issues with the implementation of
   mapping the persistent ring buffer because it was assumed that the
   persistent memory was just physical memory without being part of the
   kernel virtual address space. But this was incorrect and the
   persistent ring buffer can be mapped the same way as the allocated
   ring buffer is mapped.

   The metadata for the persistent ring buffer is different than the
   normal ring buffer and the organization of mapping it to user space
   is a little different. Make the updates needed to the meta data to
   allow the persistent ring buffer to be mapped to user space.

- Fix cpus_read_lock() with buffer->mutex and cpu_buffer->mapping_lock

   Mapping the ring buffer to user space uses the
   cpu_buffer->mapping_lock. The buffer->mutex can be taken when the
   mapping_lock is held, giving the locking order of:
   cpu_buffer->mapping_lock -->> buffer->mutex. But there also exists
   the ordering:

       buffer->mutex -->> cpus_read_lock()
       mm->mmap_lock -->> cpu_buffer->mapping_lock
       cpus_read_lock() -->> mm->mmap_lock

   causing a circular chain of:

       cpu_buffer->mapping_lock -> buffer->mutex -->> cpus_read_lock() -->>
          mm->mmap_lock -->> cpu_buffer->mapping_lock

   By moving the cpus_read_lock() outside the buffer->mutex where:
   cpus_read_lock() -->> buffer->mutex, breaks the deadlock chain.

- Do not trigger WARN_ON() for commit overrun

   When the ring buffer is user space mapped and there's a "commit
   overrun" (where an interrupt preempted an event, and then added so
   many events it filled the buffer having to drop events when it hit
   the preempted event) a WARN_ON() was triggered if this was read via a
   memory mapped buffer.

   This is due to "missed events" being non zero when the reader page
   ended up with the commit page. The idea was, if the writer is on the
   reader page, there's only one page that has been written to and there
   should be no missed events.

   But if a commit overrun is done where the writer is off the commit
   page and looped around to the commit page causing missed events, it
   is possible that the reader page is the commit page with missed
   events.

   Instead of triggering a WARN_ON() when the reader page is the commit
   page with missed events, trigger it when the reader page is the
   tail_page with missed events. That's because the writer is always on
   the tail_page if an event was interrupted (which holds the commit
   event) and continues off the commit page.

- Reset the persistent buffer if it is fully consumed

   On boot up, if the user fully consumes the last boot buffer of the
   persistent buffer, if it reboots without enabling it, there will
   still be events in the buffer which can cause confusion. Instead,
   reset the buffer when it is fully consumed, so that the data is not
   read again.

- Clean up some goto out jumps

   There's a few cases that the code jumps to the "out:" label that
   simply returns a value. There used to be more work done at those
   labels but now that they simply return a value use a return instead
   of jumping to a label.

- Use guard() to simplify some of the code

   Add guard() around some locking instead of jumping to a label to do
   the unlocking.

- Use free() to simplify some of the code

   Use free(kfree) on variables that will get freed on error and use
   return_ptr() to return the variable when its not freed. There's one
   instance where free(kfree) simplifies the code on a temp variable
   that was allocated just for the function use.

* tag 'trace-ringbuffer-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Simplify functions with __free(kfree) to free allocations
  ring-buffer: Make ring_buffer_{un}map() simpler with guard(mutex)
  ring-buffer: Simplify ring_buffer_read_page() with guard()
  ring-buffer: Simplify reset_disabled_cpu_buffer() with use of guard()
  ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()
  ring-buffer: Removed unnecessary if() goto out where out is the next line
  tracing: Reset last-boot buffers when reading out all cpu buffers
  ring-buffer: Allow reserve_mem persistent ring buffers to be mmapped
  ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
  ring-buffer: Move cpus_read_lock() outside of buffer->mutex

Merge tag 'microblaze-v6.16' of git://git.monstr.eu/linux-2.6-microblaze

Pull microblaze update from Michal Simek:

- Small OF update

* tag 'microblaze-v6.16' of git://git.monstr.eu/linux-2.6-microblaze:
microblaze: Use of_property_present() for non-boolean properties

Input: ims-pcu - check record size in ims_pcu_flash_firmware()

The "len" variable comes from the firmware and we generally do
trust firmware, but it's always better to double check. If the "len"
is too large it could result in memory corruption when we do
"memcpy(fragment->data, rec->data, len);"

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/131fd1ae92c828ee9f4fa2de03d8c210ae1f3524.1748463049.git.dan.carpenter@linaro.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()

gpio_keys_irq_isr() and gpio_keys_irq_timer() access the same resources.
There could be a concurrent access if a GPIO interrupt occurs in parallel
of a HR timer interrupt.

Guard back those resources with a spinlock.

Fixes: 019002f20cb5 ("Input: gpio-keys - use hrtimer for release timer")
Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Link: https://lore.kernel.org/r/20250528-gpio_keys_preempt_rt-v2-2-3fc55a9c3619@foss.st.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in
hard irq context, but the input_event() takes a spin_lock, which isn't
allowed there as it is converted to a rt_spin_lock().

[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0
...
[ 4054.290195]  __might_resched+0x13c/0x1f4
[ 4054.290209]  rt_spin_lock+0x54/0x11c
[ 4054.290219]  input_event+0x48/0x80
[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78
[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438
[ 4054.290257]  hrtimer_interrupt+0xe4/0x240
[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44
[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c
[ 4054.290297]  handle_irq_desc+0x40/0x58
[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28
[ 4054.290316]  gic_handle_irq+0x44/0xcc

Considering the gpio_keys_irq_isr() can run in any context, e.g. it can
be threaded, it seems there's no point in requesting the timer isr to
run in hard irq context.

Relax the hrtimer not to use the hard context.

Fixes: 019002f20cb5 ("Input: gpio-keys - use hrtimer for release timer")
Suggested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
Link: https://lore.kernel.org/r/20250528-gpio_keys_preempt_rt-v2-1-3fc55a9c3619@foss.st.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Merge tag 'pull-automount' of git://git./linux/kernel/git/viro/vfs

Pull automount updates from Al Viro:
"Automount wart removal

  A bunch of odd boilerplate gone from instances - the reason for
  those was the need to protect the yet-to-be-attched mount from
  mark_mounts_for_expiry() deciding to take it out.

  But that's easy to detect and take care of in mark_mounts_for_expiry()
  itself; no need to have every instance simulate mount being busy by
  grabbing an extra reference to it, with finish_automount() undoing
  that once it attaches that mount.

  Should've done it that way from the very beginning... This is a
  flagday change, thankfully there are very few instances.

  vfs_submount() is gone - its sole remaining user (trace_automount)
  had been switched to saner primitives"

* tag 'pull-automount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  kill vfs_submount()
  saner calling conventions for ->d_automount()

Input: amijoy - make headings compliant w/ guidelines in documentation

Make heading adornments compliant with the guidelines to improve
organisation of the page.

Signed-off-by: George Anthony Vernon <contact@gvernon.com>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20250526135957.180254-5-contact@gvernon.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: amijoy - fix grammar in documentation

Make small grammar fixes to Amiga joystick documentation.

Signed-off-by: George Anthony Vernon <contact@gvernon.com>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20250526135957.180254-4-contact@gvernon.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: amijoy - fix Amiga 4-joystick adapter pinout in documentation

Pinout incorrectly duplicated pin 18, correct this.

Signed-off-by: George Anthony Vernon <contact@gvernon.com>
Link: https://lore.kernel.org/r/20250526135957.180254-3-contact@gvernon.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: amijoy - fix broken table formatting in documentation

Missing '+' led to unintended spanning cell. Correct this.

Signed-off-by: George Anthony Vernon <contact@gvernon.com>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20250526135957.180254-2-contact@gvernon.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Merge tag 'pull-ufs' of git://git./linux/kernel/git/viro/vfs

Pull UFS updates from Al Viro:
"The bulk of this is Eric's conversion of UFS to new mount API, with a
  bit of cleanups from me. I hoped to get stricter sanity checks on
  superblock flags into that pile, but... next cycle, hopefully"

* tag 'pull-ufs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ufs: convert ufs to the new mount API
  ufs: reject multiple conflicting -o ufstype=... on mount
  ufs: split ->s_mount_opt - don't mix flavour and on-error

Merge tag 'pull-fixes' of git://git./linux/kernel/git/viro/vfs

Pull mount propagation fix from Al Viro:
"6.15 allowed mount propagation to destinations in detached trees;
  unfortunately, that breaks existing userland, so the old behaviour
  needs to be restored.

  It's not exactly a revert - the original behaviour had a bug, where
  existence of detached tree might disrupt propagation between locations
  not in detached trees. Thankfully, userland did not depend upon that
  bug, so we want to keep the fix"

* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  Don't propagate mounts into detached trees

Merge tag 'efi-next-for-v6.16' of git://git./linux/kernel/git/efi/efi

Pull EFI updates from Ard Biesheuvel:
"Not a lot going on in the EFI tree this cycle. The only thing that
  stands out is the new support for SBAT metadata, which was a bit
  contentious when it was first proposed, because in the initial
  incarnation, it would have required us to maintain a revocation index,
  and bump it each time a vulnerability affecting UEFI secure boot got
  fixed. This was shot down for obvious reasons.

  This time, only the changes needed to emit the SBAT section into the
  PE/COFF image are being carried upstream, and it is up to the distros
  to decide what to put in there when creating and signing the build.

  This only has the EFI zboot bits (which the distros will be using for
  arm64); the x86 bzImage changes should be arriving next cycle,
  presumably via the -tip tree.

  Summary:

   - Add support for emitting a .sbat section into the EFI zboot image,
     so that downstreams can easily include revocation metadata in the
     signed EFI images

   - Align PE symbolic constant names with other projects

   - Bug fix for the efi_test module

   - Log the physical address and size of the EFI memory map when
     failing to map it

   - A kerneldoc fix for the EFI stub code"

* tag 'efi-next-for-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  include: pe.h: Fix PE definitions
  efi/efi_test: Fix missing pending status update in getwakeuptime
  efi: zboot specific mechanism for embedding SBAT section
  efi/libstub: Describe missing 'out' parameter in efi_load_initrd
  efi: Improve logging around memmap init

Merge tag 'acpi-6.16-rc1-2' of git://git./linux/kernel/git/rafael/linux-pm

Pull ACPI fixes from Rafael Wysocki:
"These address issues introduced by recent ACPI changes merged
  previously:

   - Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior
     changed incorrectly by a recent update (Ahmed Salem)

   - Make a new static checker warning in the recently introduced ACPI
     MRRM table parser go away (Dan Carpenter)

   - Fix ACPI table referece leak in error path of einj_probe() (Dan
     Carpenter)"

* tag 'acpi-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy()
  ACPI: MRRM: Silence error code static checker warning
  ACPI: APEI: EINJ: Clean up on error in einj_probe()

Merge tag 'pm-6.16-rc1-2' of git://git./linux/kernel/git/rafael/linux-pm

Pull more power management updates from Rafael Wysocki:
"These revert an x86 commit that introduced a nasty power regression on
  some systems, fix PSCI cpuidle driver and ACPI cpufreq driver
  regressions, add Rust abstractions for cpufreq, OPP, clk, and
  cpumasks, add a Rust-based cpufreq-dt driver, and do a minor SCMI
  cpufreq driver cleanup:

   - Revert an x86 commit that went into 6.15 and caused idle power,
     including power in suspend-to-idle, to rise rather dramatically on
     systems booting with "nosmt" in the kernel command line (Rafael
     Wysocki)

   - Prevent freeing an uninitialized pointer in error path of
     dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter)

   - Use KHz as the nominal_freq units in get_max_boost_ratio() in the
     ACPI cpufreq driver (iGautham Shenoy)

   - Add Rust abstractions for CPUFreq framework (Viresh Kumar)

   - Add Rust abstractions for OPP framework (Viresh Kumar)

   - Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh
     Kumar)

   - Clean up the SCMI cpufreq driver somewhat (Mike Tipton)"

* tag 'pm-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (21 commits)
  Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()"
  acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
  rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test
  cpuidle: psci: Fix uninitialized variable in dt_idle_state_present()
  rust: opp: Make the doctest example depend on CONFIG_OF
  cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
  cpufreq: Add Rust-based cpufreq-dt driver
  rust: opp: Extend OPP abstractions with cpufreq support
  rust: cpufreq: Extend abstractions for driver registration
  rust: cpufreq: Extend abstractions for policy and driver ops
  rust: cpufreq: Add initial abstractions for cpufreq framework
  rust: opp: Add abstractions for the configuration options
  rust: opp: Add abstractions for the OPP table
  rust: opp: Add initial abstractions for OPP framework
  rust: cpu: Add from_cpu()
  rust: macros: enable use of hyphens in module names
  rust: clk: Add initial abstractions
  rust: clk: Add helpers for Rust code
  MAINTAINERS: Add entry for Rust cpumask API
  rust: cpumask: Add initial abstractions
  ...

Merge branch 'pm-cpuidle'

Fix an issue in the PSCI cpuidle driver introduced recently and a nasty
x86 power regression introduced in 6.15:

- Prevent freeing an uninitialized pointer in error path of
   dt_idle_state_present() in the PSCI cpuidle driver (Dan Carpenter).

- Revert an x86 commit that went into 6.15 and caused idle power,
   including power in suspend-to-idle, to rise rather dramatically on
   systems booting with "nosmt" in the kernel command line (Rafael Wysocki).

* pm-cpuidle:
  Revert "x86/smp: Eliminate mwait_play_dead_cpuid_hint()"
  cpuidle: psci: Fix uninitialized variable in dt_idle_state_present()

Merge branch 'pm-cpufreq'

Merge Rust support for cpufreq and OPP, a new Rust-based cpufreq-dt
driver, an SCMI cpufreq driver cleanup, and an ACPI cpufreq driver
regression fix:

- Add Rust abstractions for CPUFreq framework (Viresh Kumar).

- Add Rust abstractions for OPP framework (Viresh Kumar).

- Add basic Rust abstractions for Clk and Cpumask frameworks (Viresh
   Kumar).

- Clean up the SCMI cpufreq driver somewhat (Mike Tipton).

- Use KHz as the nominal_freq units in get_max_boost_ratio() in the
   ACPI cpufreq driver (iGautham Shenoy).

* pm-cpufreq:
  acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
  rust: opp: Move `cfg(CONFIG_OF)` attribute to the top of doc test
  rust: opp: Make the doctest example depend on CONFIG_OF
  cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
  cpufreq: Add Rust-based cpufreq-dt driver
  rust: opp: Extend OPP abstractions with cpufreq support
  rust: cpufreq: Extend abstractions for driver registration
  rust: cpufreq: Extend abstractions for policy and driver ops
  rust: cpufreq: Add initial abstractions for cpufreq framework
  rust: opp: Add abstractions for the configuration options
  rust: opp: Add abstractions for the OPP table
  rust: opp: Add initial abstractions for OPP framework
  rust: cpu: Add from_cpu()
  rust: macros: enable use of hyphens in module names
  rust: clk: Add initial abstractions
  rust: clk: Add helpers for Rust code
  MAINTAINERS: Add entry for Rust cpumask API
  rust: cpumask: Add initial abstractions
  rust: cpumask: Add few more helpers

Merge branches 'acpica', 'acpi-tables' and 'acpi-apei'

Merge fixes for issues introduced by recent ACPI changes merged
previously:

- Unbreak acpi_ut_safe_strncpy() by restoring its previous behavior
   changed incorrectly by a recent update (Ahmed Salem).

- Make a new static checker warning in the recently introduced ACPI
   MRRM table parser go away (Dan Carpenter).

- Fix ACPI table referece leak in error path of einj_probe() (Dan
   Carpenter).

* acpica:
  ACPICA: Switch back to using strncpy() in acpi_ut_safe_strncpy()

* acpi-tables:
  ACPI: MRRM: Silence error code static checker warning

* acpi-apei:
  ACPI: APEI: EINJ: Clean up on error in einj_probe()

Merge tag 'iommu-updates-v6.16' of git://git./linux/kernel/git/iommu/linux

Pull iommu updates from Joerg Roedel:
"Core:
   - Introduction of iommu-pages infrastructure to consolitate
     page-table allocation code among hardware drivers. This is
     ground-work for more generalization in the future
   - Remove IOMMU_DEV_FEAT_SVA and IOMMU_DEV_FEAT_IOPF feature flags
   - Convert virtio-iommu to domain_alloc_paging()
   - KConfig cleanups
   - Some small fixes for possible overflows and race conditions

  Intel VT-d driver:
   - Restore WO permissions on second-level paging entries
   - Use ida to manage domain id
   - Miscellaneous cleanups

  AMD-Vi:
   - Make sure notifiers finish running before module unload
   - Add support for HTRangeIgnore feature
   - Allow matching ACPI HID devices without matching UIDs

  ARM-SMMU:
   - SMMUv2:
      - Recognise the compatible string for SAR2130P MDSS in the
        Qualcomm driver, as this device requires an identity domain
      - Fix Adreno stall handling so that GPU debugging is more robust
        and doesn't e.g. result in deadlock
   - SMMUv3:
      - Fix ->attach_dev() error reporting for unrecognised domains
   - IO-pgtable:
      - Allow clients (notably, drivers that process requests from
        userspace) to silence warnings when mapping an already-mapped
        IOVA

  S390:
   - Add support for additional table regions

  Mediatek:
   - Add support for MT6893 MM IOMMU

  And some smaller fixes and improvements in various other drivers"

* tag 'iommu-updates-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (75 commits)
  iommu/vt-d: Restore context entry setup order for aliased devices
  iommu/mediatek: Fix compatible typo for mediatek,mt6893-iommu-mm
  iommu/arm-smmu-qcom: Make set_stall work when the device is on
  iommu/arm-smmu: Move handing of RESUME to the context fault handler
  iommu/arm-smmu-qcom: Enable threaded IRQ for Adreno SMMUv2/MMU500
  iommu/io-pgtable-arm: Add quirk to quiet WARN_ON()
  iommu: Clear the freelist after iommu_put_pages_list()
  iommu/vt-d: Change dmar_ats_supported() to return boolean
  iommu/vt-d: Eliminate pci_physfn() in dmar_find_matched_satc_unit()
  iommu/vt-d: Replace spin_lock with mutex to protect domain ida
  iommu/vt-d: Use ida to manage domain id
  iommu/vt-d: Restore WO permissions on second-level paging entries
  iommu/amd: Allow matching ACPI HID devices without matching UIDs
  iommu: make inclusion of arm/arm-smmu-v3 directory conditional
  iommu: make inclusion of riscv directory conditional
  iommu: make inclusion of amd directory conditional
  iommu: make inclusion of intel directory conditional
  iommu: remove duplicate selection of DMAR_TABLE
  iommu/fsl_pamu: remove trailing space after \n
  iommu/arm-smmu-qcom: Add SAR2130P MDSS compatible
  ...

Merge tag 'for-linus' of git://git./linux/kernel/git/rdma/rdma

Pull rdma updates from Jason Gunthorpe:
"Usual collection of driver fixes:

   - Small bug fixes and cleansup in hfi, hns, rxe, mlx5, mana siw

   - Further ODP functionality in rxe

   - Remote access MRs in mana, along with more page sizes

   - Improve CM scalability with a rwlock around the agent

   - More trace points for hns

   - ODP hmm conversion to the new two step dma API

   - Support the ethernet HW device in mana as well as the RNIC

   - Cleanups:
       - Use secs_to_jiffies() when appropriate
       - Use ERR_CAST() instead of naked casts
       - Don't use %pK in printk
       - Unusued functions removed
       - Allocation type matching"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (57 commits)
  RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
  RDMA/bnxt_re: Support extended stats for Thor2 VF
  RDMA/hns: Fix endian issue in trace events
  RDMA/mlx5: Avoid flexible array warning
  IB/cm: Remove dead code and adjust naming
  RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices
  RDMA/rxe: Break endless pagefault loop for RO pages
  RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc
  RDMA/bnxt_re: Fix missing error handling for tx_queue
  RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output
  RDMA/mlx5: Add support for 200Gbps per lane speeds
  RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage
  RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  net: mana: Add support for auxiliary device servicing events
  RDMA/mana_ib: unify mana_ib functions to support any gdma device
  RDMA/mana_ib: Add support of mana_ib for RNIC and ETH nic
  net: mana: Probe rdma device in mana driver
  RDMA/siw: replace redundant ternary operator with just rv
  RDMA/umem: Separate implicit ODP initialization from explicit ODP
  RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage
  ...

Merge tag 'i2c-for-6.16-rc1' of git://git./linux/kernel/git/wsa/linux

Pull i2c updates from Wolfram Sang:
"Core updates:
   - move towards using the 'fwnode' handle instead of 'of_node'
     (meaning 'of_node' even gets removed from i2c_board_info)
   - add support for Write Disable-aware SPD eeproms
   - minor stuff (use new helpers, typo fixes)

  i2c-atr (address translator) updates:
   - support per-channel alias pools
   - added support for dynamic address translation (also adds FPC202
     driver as its user)
   - add 'static' and 'passthrough' flags

  Cleanups and refactorings
   - Many drivers switched to dev_err_probe()
   - Generic cleanups applied to designware, iproc, ismt, mlxbf,
     npcm7xx, qcom-geni, pasemi, and thunderx
   - davinci: declare I2C mangling support among I2C features
   - designware: clean up DTS handling
   - designware: fix PM runtime on driver unregister
   - imx: improve error logging during probe
   - lpc2k: improve checks in probe error path
   - xgene-slimpro: improve PCC shared memory handling
   - pasemi: improve error handling in reset, smbus clear, timeouts
   - tegra: validate buffer length during transfers
   - wmt: convert binding to YAML format

  Improvements and extended support:
   - microchip-core: add SMBus support
   - mlxbf: add support for repeated start in block transfers
   - mlxbf: improve timer configuration
   - npcm: attempt clock toggle recovery before failing init
   - octeon: add support for block mode operations
   - pasemi: add support for unjam device feature
   - riic: add support for bus recovery

  New device support:
   - MediaTek Dimensity 1200 (MT6893)
   - Sophgo SG2044
   - Renesas RZ/V2N (R9A09G056)
   - Rockchip RK3528
   - AMD ISP (new driver)"

* tag 'i2c-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (89 commits)
  i2c: Use str_read_write() helper
  i2c: mlxbf: avoid 64-bit division
  i2c: viai2c-wmt: Replace dev_err() with dev_err_probe() in probe function
  i2c: designware: Don't warn about missing get_clk_rate_khz
  i2c: designware: Invoke runtime suspend on quick slave re-registration
  i2c-mlxbf: Improve I2C bus timing configuration
  i2c-mlxbf: Add repeated start condition support
  i2c: xgene-slimpro: Replace dev_err() with dev_err_probe() in probe function
  dt-bindings: i2c: i2c-wmt: Convert to YAML
  i2c: microchip-corei2c: add smbus support
  i2c: mlxbf: Allow build with COMPILE_TEST
  i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISP
  i2c: atr: add passthrough flag
  i2c: atr: add static flag
  i2c: atr: allow replacing mappings in attach_addr()
  i2c: atr: deduplicate logic in attach_addr()
  i2c: atr: do not create mapping in detach_addr()
  i2c: atr: split up i2c_atr_get_mapping_by_addr()
  i2c: atr: find_mapping() -> get_mapping()
  i2c: atr: Fix lockdep for nested ATRs
  ...

Merge tag 'pinctrl-v6.16-1' of git://git./linux/kernel/git/linusw/linux-pinctrl

Pull pin control updates from Linus Walleij:
"An especially linear and sparse improvement and new drivers release.
  Nothing exciting. The biggest change in Bartosz changes to make
  gpiochip set/get calls return error codes (something we should have
  fixed ages ago but is now finally getting fixed.)

  Core changes:

   - Add the devres devm_pinctrl_register_mappings() call that can
     register some pin control machine mappings and have them go away
     with the associated device

  New drivers:

   - Support for the Mediatek MT6893 and MT8196 SoCs

   - Support for the Renesas RZ/V2N SoC

   - Support for the NXP Freescale i.MX943 SoC

  Improvements:

   - Per-SoC suspend/resume callbacks in the Samsung drivers

   - Set all pins as input (High-Z) at probe in the MCP23S08 driver

   - Switch most GPIO chips to use the setters/getters with a return
     value

   - EGPIO support in the Qualcomm QCM2290 driver

   - Fix up the number of available GPIO lines in Qualcomm QCS8300 and
     QCS615"

* tag 'pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (82 commits)
  pinctrl: freescale: Add support for imx943 pinctrl
  pinctrl: core: add devm_pinctrl_register_mappings()
  pinctrl: remove extern specifier for functions in machine.h
  pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
  pinctrl: freescale: Enable driver if platform is enabled.
  pinctrl: freescale: Depend imx-scu driver on OF
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
  pinctrl: armada-37xx: propagate error from armada_37xx_gpio_direction_output()
  pinctrl: armada-37xx: set GPIO output value before setting direction
  pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
  pinctrl: meson: Drop unused aml_pctl_find_group_by_name()
  pinctrl: at91: Fix possible out-of-boundary access
  pinctrl: add stubs for OF-specific pinconf functions
  pinctrl: qcom: correct the ngpios entry for QCS8300
  pinctrl: qcom: correct the ngpios entry for QCS615
  dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs8300
  dt-bindings: pinctrl: qcom: correct gpio-ranges in examples for qcs615
  ...

Merge tag 'clk-for-linus' of git://git./linux/kernel/git/clk/linux

Pull clk updates from Stephen Boyd:
"This has been a semi-quiet cycle. The core framework remains unchanged
  this time around.

  In terms of shiny new code though, we have support for the SpacemiT K1
  SoC, Sophgo SG2044, and T-HEAD TH1520 VO clk drivers joining the usual
  silicon players like Qualcomm, Samsung, Allwinner, and Renesas.

  Surprisingly, the Qualcomm pile was smaller than usual but that is
  likely because they put one SoC support inside a driver for a
  different SoC that is very similar.

  Other than all those new clk drivers there are the usual clk data
  updates to fix parents, frequency tables, and add missing clks along
  with some Kconfig changes to make compile testing simpler and even
  more DT binding conversions to boot.

  The exciting part is still the new SoC support like SpacemiT and
  Sophgo support though, which really dominate the diffstat because they
  introduce a whole new silicon vendor clk driver.

  New Drivers:
   - Camera clock controller driver for Qualcomm QCS8300
   - DE (display engine) 3.3 clocks on Allwinner H616
   - Samsung ExynosAutov920 CPU cluster CL0, CL1 and CL2 clock controllers
   - Video Output (VO) subsystem clk controller in the T-HEAD TH1520 SoC
   - Clock driver for Sophgo SG2044
   - Clock driver for SpacemiT K1 SoC
   - Renesas RZ/V2N (R9A09G056) SoC clk driver

  Updates:
   - Correct data in various SoC clk drivers
   - Allow clkaN to be optional in the Qualcomm RPMh clock controller
     driver if command db doesn't define it
   - Change Kconfig options to not enable by default during compile
     testing
   - Add missing clks in various SoC clk drivers
   - Remove some duplicate clk DT bindings and convert some more to
     YAML"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (93 commits)
  clk: qcom: gcc-x1e80100: Set FORCE MEM CORE for UFS clocks
  clk: qcom: gcc: Set FORCE_MEM_CORE_ON for gcc_ufs_axi_clk for 8650/8750
  clk: qcom: rpmh: make clkaN optional
  clk: qcom: Add support for Camera Clock Controller on QCS8300
  clk: rockchip: rk3528: add slab.h header include
  clk: rockchip: rk3576: add missing slab.h include
  clk: meson: Do not enable by default during compile testing
  clk: meson-g12a: add missing fclk_div2 to spicc
  clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
  clk: rockchip: rename gate-grf clk file
  clk: rockchip: rename branch_muxgrf to branch_grf_mux
  clk: sunxi-ng: ccu: add Display Engine 3.3 (DE33) support
  dt-bindings: allwinner: add H616 DE33 clock binding
  clk: samsung: correct clock summary for hsi1 block
  dt-bindings: clock: add SM6350 QCOM video clock bindings
  clk: rockchip: Pass NULL as reg pointer when registering GRF MMC clocks
  clk: sunxi-ng: h616: Add LVDS reset for LCD TCON
  dt-bindings: clock: sun50i-h616-ccu: Add LVDS reset
  clk: rockchip: rk3036: mark ddrphy as critical
  clk: rockchip: rk3036: fix implementation of usb480m clock mux
  ...

Merge tag 'f2fs-for-6.16-rc1' of git://git./linux/kernel/git/jaegeuk/f2fs

Pull f2fs updates from Jaegeuk Kim:
"In this round, Matthew converted most of page operations to using
  folio. Beyond the work, we've applied some performance tunings such as
  GC and linear lookup, in addition to enhancing fault injection and
  sanity checks.

  Enhancements:
   - large number of folio conversions
   - add a control to turn on/off the linear lookup for performance
   - tune GC logics for zoned block device
   - improve fault injection and sanity checks

  Bug fixes:
   - handle error cases of memory donation
   - fix to correct check conditions in f2fs_cross_rename
   - fix to skip f2fs_balance_fs() if checkpoint is disabled
   - don't over-report free space or inodes in statvfs
   - prevent the current section from being selected as a victim during GC
   - fix to calculate first_zoned_segno correctly
   - fix to avoid inconsistence between SIT and SSA for zoned block device

  As usual, there are several debugging patches and clean-ups as well"

* tag 'f2fs-for-6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (195 commits)
  f2fs: fix to correct check conditions in f2fs_cross_rename
  f2fs: use d_inode(dentry) cleanup dentry->d_inode
  f2fs: fix to skip f2fs_balance_fs() if checkpoint is disabled
  f2fs: clean up to check bi_status w/ BLK_STS_OK
  f2fs: introduce is_{meta,node}_folio
  f2fs: add ckpt_valid_blocks to the section entry
  f2fs: add a method for calculating the remaining blocks in the current segment in LFS mode.
  f2fs: introduce FAULT_VMALLOC
  f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
  f2fs: add f2fs_bug_on() in f2fs_quota_read()
  f2fs: add f2fs_bug_on() to detect potential bug
  f2fs: remove unused sbi argument from checksum functions
  f2fs: fix 32-bits hexademical number in fault injection doc
  f2fs: don't over-report free space or inodes in statvfs
  f2fs: return bool from __write_node_folio
  f2fs: simplify return value handling in f2fs_fsync_node_pages
  f2fs: always unlock the page in f2fs_write_single_data_page
  f2fs: remove wbc->for_reclaim handling
  f2fs: return bool from __f2fs_write_meta_folio
  f2fs: fix to return correct error number in f2fs_sync_node_pages()
  ...

KVM: arm64: vgic-debug: Avoid dereferencing NULL ITE pointer

Dan reports that iterating over a device ITEs can legitimately lead
to a NULL pointer, and that the NULL check is placed *after* the
pointer has already been dereferenced.

Hoist the pointer check as early as possible and be done with it.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: 30deb51a677b ("KVM: arm64: vgic-its: Add debugfs interface to expose ITS tables")
Link: https://lore.kernel.org/r/aDBylI1YnjPatAbr@stanley.mountain
Cc: Jing Zhang <jingzhangos@google.com>
Link: https://lore.kernel.org/r/20250530091647.1152489-1-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: vgic-init: Plug vCPU vs. VGIC creation race

syzkaller has found another ugly race in the VGIC, this time dealing
with VGIC creation. Since kvm_vgic_create() doesn't sufficiently protect
against in-flight vCPU creations, it is possible to get a vCPU into the
kernel w/ an in-kernel VGIC but no allocation of private IRQs:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000d20
  Mem abort info:
    ESR = 0x0000000096000046
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x06: level 2 translation fault
  Data abort info:
    ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000
    CM = 0, WnR = 1, TnD = 0, TagAccess = 0
    GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
  user pgtable: 4k pages, 48-bit VAs, pgdp=0000000103e4f000
  [0000000000000d20] pgd=0800000102e1c403, p4d=0800000102e1c403, pud=0800000101146403, pmd=0000000000000000
  Internal error: Oops: 0000000096000046 [#1] PREEMPT SMP
  CPU: 9 UID: 0 PID: 246 Comm: test Not tainted 6.14.0-rc6-00097-g0c90821f5db8 #16
  Hardware name: linux,dummy-virt (DT)
  pstate: 814020c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
  pc : _raw_spin_lock_irqsave+0x34/0x8c
  lr : kvm_vgic_set_owner+0x54/0xa4
  sp : ffff80008086ba20
  x29: ffff80008086ba20 x28: ffff0000c19b5640 x27: 0000000000000000
  x26: 0000000000000000 x25: ffff0000c4879bd0 x24: 000000000000001e
  x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000c487af80
  x20: ffff0000c487af18 x19: 0000000000000000 x18: 0000001afadd5a8b
  x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
  x14: ffff0000c19b56c0 x13: 0030c9adf9d9889e x12: ffffc263710e1908
  x11: 0000001afb0d74f2 x10: e0966b840b373664 x9 : ec806bf7d6a57cd5
  x8 : ffff80008086b980 x7 : 0000000000000001 x6 : 0000000000000001
  x5 : 0000000080800054 x4 : 4ec4ec4ec4ec4ec5 x3 : 0000000000000000
  x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000d20
  Call trace:
   _raw_spin_lock_irqsave+0x34/0x8c (P)
   kvm_vgic_set_owner+0x54/0xa4
   kvm_timer_enable+0xf4/0x274
   kvm_arch_vcpu_run_pid_change+0xe0/0x380
   kvm_vcpu_ioctl+0x93c/0x9e0
   __arm64_sys_ioctl+0xb4/0xec
   invoke_syscall+0x48/0x110
   el0_svc_common.constprop.0+0x40/0xe0
   do_el0_svc+0x1c/0x28
   el0_svc+0x30/0xd0
   el0t_64_sync_handler+0x10c/0x138
   el0t_64_sync+0x198/0x19c
   Code: b9000841 d503201f 52800001 52800022 (88e17c02)
   ---[ end trace 0000000000000000 ]---

Plug the race by explicitly checking for an in-progress vCPU creation
and failing kvm_vgic_create() when that's the case. Add some comments to
document all the things kvm_vgic_create() is trying to guard against
too.

Reported-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Tested-by: Alexander Potapenko <glider@google.com>
Link: https://lore.kernel.org/r/20250523194722.4066715-6-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: Unmap vLPIs affected by changes to GSI routing information

KVM's interrupt infrastructure is dodgy at best, allowing for some ugly
'off label' usage of the various UAPIs. In one example, userspace can
change the routing entry of a particular "GSI" after configuring
irqbypass with KVM_IRQFD. KVM/arm64 is oblivious to this, and winds up
preserving the stale translation in cases where vLPIs are configured.

Honor userspace's intentions and tear down the vLPI mapping if affected
by a "GSI" routing change. Make no attempt to reconstruct vLPIs if the
new target is an MSI and just fall back to software injection.

Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250523194722.4066715-5-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: Resolve vLPI by host IRQ in vgic_v4_unset_forwarding()

The virtual mapping and "GSI" routing of a particular vLPI is subject to
change in response to the guest / userspace. This can be pretty annoying
to deal with when KVM needs to track the physical state that's managed
for vLPI direct injection.

Make vgic_v4_unset_forwarding() resilient by using the host IRQ to
resolve the vgic IRQ. Since this uses the LPI xarray directly, finding
the ITS by doorbell address + grabbing it's its_lock is no longer
necessary. Note that matching the right ITS / ITE is already handled in
vgic_v4_set_forwarding(), and unless there's a bug in KVM's VGIC ITS
emulation the virtual mapping that should remain stable for the lifetime
of the vLPI mapping.

Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250523194722.4066715-4-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: Protect vLPI translation with vgic_irq::irq_lock

Though undocumented, KVM generally protects the translation of a vLPI
with the its_lock. While this makes perfectly good sense, as the ITS
itself contains the guest translation, an upcoming change will require
twiddling the vLPI mapping in an atomic context.

Switch to using the vIRQ's irq_lock to protect the translation. Use of
the its_lock in vgic_v4_unset_forwarding() is preserved for now as it
still needs to walk the ITS.

Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250523194722.4066715-3-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: Use lock guard in vgic_v4_set_forwarding()

The locking dance is about to get more interesting, switch the its_lock
over to a lock guard to make it a bit easier to handle.

Tested-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Link: https://lore.kernel.org/r/20250523194722.4066715-2-oliver.upton@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM: arm64: Mask out non-VA bits from TLBI VA* on VNCR invalidation

When handling a TLBI VA* instruction that potentially targets a
VNCR page mapping, we fail to mask out the top bits that contain
the ASID and TTL fields, hence potentially failing the VA check
in the TLB code.

An additional wrinkle is that we fail to sign extend the VA,
again leading to failed VA checks.

Fix both in one go by sign-extending the VA from bit 48, making
it comparable to the way we interpret VNCR_EL2.BADDR.

Fixes: 4ffa72ad8f37e ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2")
Link: https://lore.kernel.org/r/20250525175759.780891-1-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>

arm64: sysreg: Drag linux/kconfig.h to work around vdso build issue

Broonie reports that fed55f49fad18 ("arm64: errata: Work around
AmpereOne's erratum AC04_CPU_23") breaks one of the vdso selftests
(vdso_test_chacha) as it indirectly drags asm/sysreg.h.

It is rather unfortunate (and worrying) that userspace gets built
with non-UAPI headers. In any case, paper over the issue by dragging
linux/kconfig.h in asm/sysreg.h. It is the right thing to do, at
least from the kernel perspective.

Reported-by: Mark Brown <broonie@kernel.org>
Fixes: fed55f49fad18 ("arm64: errata: Work around AmpereOne's erratum AC04_CPU_23")
Link: https://lore.kernel.org/r/aDCDGZ-G-nCP3hJI@finisterre.sirena.org.uk
Cc: D Scott Phillips <scott@os.amperecomputing.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20250523170208.530818-1-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>

Merge tag 'renesas-dts-for-v6.16-tag5' of https://git./linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DTS updates for v6.16 (take five)

- Reduce I2C2 clock frequency on the RZ/G3E SMARC SoM.

* tag 'renesas-dts-for-v6.16-tag5' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
arm64: dts: renesas: rzg3e-smarc-som: Reduce I2C2 clock frequency

Link: https://lore.kernel.org/r/cover.1748355530.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

MAINTAINERS, mailmap: update Sven Peter's email address

Update my mail address to my new @kernel.org one and also add a mailmap
entry to make sure everything gets sent there for easier filtering.

Signed-off-by: Sven Peter <sven@kernel.org>
Link: https://lore.kernel.org/r/20250528221718.45204-1-sven@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

exportfs: require ->fh_to_parent() to encode connectable file handles

When user requests a connectable file handle explicitly with the
AT_HANDLE_CONNECTABLE flag, fail the request if filesystem (e.g. nfs)
does not know how to decode a connected non-dir dentry.

Fixes: c374196b2b9f ("fs: name_to_handle_at() support for "explicit connectable" file handles")
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Link: https://lore.kernel.org/20250525104731.1461704-1-amir73il@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>

Merge tag 'scsi-misc' of git://git./linux/kernel/git/jejb/scsi

Pull SCSI updates from James Bottomley:
"Updates to the usual drivers (smartpqi, ufs, lpfc, scsi_debug, target,
  hisi_sas) with the only substantive core change being the removal of
  the stream_status member from the scsi_stream_status_header (to get
  rid of flex array members)"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (77 commits)
  scsi: target: core: Constify struct target_opcode_descriptor
  scsi: target: core: Constify enabled() in struct target_opcode_descriptor
  scsi: hisi_sas: Fix warning detected by sparse
  scsi: mpt3sas: Fix _ctl_get_mpt_mctp_passthru_adapter() to return IOC pointer
  scsi: sg: Remove unnecessary NULL check before unregister_sysctl_table()
  scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
  scsi: ufs: qcom: dt-bindings: Document the SM8750 UFS Controller
  scsi: mvsas: Fix typos in SAS/SATA VSP register comments
  scsi: fnic: Replace memset() with eth_zero_addr()
  scsi: ufs: core: Support updating device command timeout
  scsi: ufs: core: Change hwq_id type and value
  scsi: ufs: core: Increase the UIC command timeout further
  scsi: zfcp: Simplify workqueue allocation
  scsi: ufs: core: Print error value as hex format in ufshcd_err_handler()
  scsi: sd: Remove the stream_status member from scsi_stream_status_header
  scsi: docs: Clean up some style in scsi_mid_low_api
  scsi: core: Remove unused scsi_dev_info_list_del_keyed()
  scsi: isci: Remove unused sci_remote_device_reset()
  scsi: scsi_debug: Reduce DEF_ATOMIC_WR_MAX_LENGTH
  scsi: smartpqi: Delete a stray tab in pqi_is_parity_write_stream()
  ...

Merge patch series "rust: file: mark `LocalFile` as `repr(transparent)`"

Mark files as repr(transparent) to ensure identical layout between C and Rust.

* patches from https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com:
rust: file: improve safety comments
rust: file: mark `LocalFile` as `repr(transparent)`

Link: https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>

rust: file: improve safety comments

Some of the safety comments in `LocalFile`'s methods incorrectly refer to
the `File` type instead of `LocalFile`, so fix them to use the correct
type.

Also add missing Markdown code spans around lifetimes in the safety
comments, i.e. change 'a to `'a`.

Link: https://github.com/Rust-for-Linux/linux/issues/1165
Signed-off-by: Pekka Ristola <pekkarr@protonmail.com>
Link: https://lore.kernel.org/20250527204636.12573-2-pekkarr@protonmail.com
Reviewed-by: Benno Lossin <lossin@kernel.org>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>

rust: file: mark `LocalFile` as `repr(transparent)`

Unsafe code in `LocalFile`'s methods assumes that the type has the same
layout as the inner `bindings::file`. This is not guaranteed by the default
struct representation in Rust, but requires specifying the `transparent`
representation.

The `File` struct (which also wraps `bindings::file`) is already marked as
`repr(transparent)`, so this change makes their layouts equivalent.

Fixes: 851849824bb5 ("rust: file: add Rust abstraction for `struct file`")
Closes: https://github.com/Rust-for-Linux/linux/issues/1165
Signed-off-by: Pekka Ristola <pekkarr@protonmail.com>
Link: https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.com
Reviewed-by: Benno Lossin <lossin@kernel.org>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>

fs/dax: Fix "don't skip locked entries when scanning entries"

Commit 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning
entries") introduced a new function, wait_entry_unlocked_exclusive(),
which waits for the current entry to become unlocked without advancing
the XArray iterator state.

Waiting for the entry to become unlocked requires dropping the XArray
lock. This requires calling xas_pause() prior to dropping the lock
which leaves the xas in a suitable state for the next iteration. However
this has the side-effect of advancing the xas state to the next index.
Normally this isn't an issue because xas_for_each() contains code to
detect this state and thus avoid advancing the index a second time on
the next loop iteration.

However both callers of and wait_entry_unlocked_exclusive() itself
subsequently use the xas state to reload the entry. As xas_pause()
updated the state to the next index this will cause the current entry
which is being waited on to be skipped. This caused the following
warning to fire intermittently when running xftest generic/068 on an XFS
filesystem with FS DAX enabled:

[   35.067397] ------------[ cut here ]------------
[   35.068229] WARNING: CPU: 21 PID: 1640 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xd8/0x1e0
[   35.069717] Modules linked in: nd_pmem dax_pmem nd_btt nd_e820 libnvdimm
[   35.071006] CPU: 21 UID: 0 PID: 1640 Comm: fstest Not tainted 6.15.0-rc7+ #77 PREEMPT(voluntary)
[   35.072613] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/204
[   35.074845] RIP: 0010:truncate_folio_batch_exceptionals+0xd8/0x1e0
[   35.075962] Code: a1 00 00 00 f6 47 0d 20 0f 84 97 00 00 00 4c 63 e8 41 39 c4 7f 0b eb 61 49 83 c5 01 45 39 ec 7e 58 42 f68
[   35.079522] RSP: 0018:ffffb04e426c7850 EFLAGS: 00010202
[   35.080359] RAX: 0000000000000000 RBX: ffff9d21e3481908 RCX: ffffb04e426c77f4
[   35.081477] RDX: ffffb04e426c79e8 RSI: ffffb04e426c79e0 RDI: ffff9d21e34816e8
[   35.082590] RBP: ffffb04e426c79e0 R08: 0000000000000001 R09: 0000000000000003
[   35.083733] R10: 0000000000000000 R11: 822b53c0f7a49868 R12: 000000000000001f
[   35.084850] R13: 0000000000000000 R14: ffffb04e426c78e8 R15: fffffffffffffffe
[   35.085953] FS:  00007f9134c87740(0000) GS:ffff9d22abba0000(0000) knlGS:0000000000000000
[   35.087346] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   35.088244] CR2: 00007f9134c86000 CR3: 000000040afff000 CR4: 00000000000006f0
[   35.089354] Call Trace:
[   35.089749]  <TASK>
[   35.090168]  truncate_inode_pages_range+0xfc/0x4d0
[   35.091078]  truncate_pagecache+0x47/0x60
[   35.091735]  xfs_setattr_size+0xc7/0x3e0
[   35.092648]  xfs_vn_setattr+0x1ea/0x270
[   35.093437]  notify_change+0x1f4/0x510
[   35.094219]  ? do_truncate+0x97/0xe0
[   35.094879]  do_truncate+0x97/0xe0
[   35.095640]  path_openat+0xabd/0xca0
[   35.096278]  do_filp_open+0xd7/0x190
[   35.096860]  do_sys_openat2+0x8a/0xe0
[   35.097459]  __x64_sys_openat+0x6d/0xa0
[   35.098076]  do_syscall_64+0xbb/0x1d0
[   35.098647]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   35.099444] RIP: 0033:0x7f9134d81fc1
[   35.100033] Code: 75 57 89 f0 25 00 00 41 00 3d 00 00 41 00 74 49 80 3d 2a 26 0e 00 00 74 6d 89 da 48 89 ee bf 9c ff ff ff5
[   35.102993] RSP: 002b:00007ffcd41e0d10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[   35.104263] RAX: ffffffffffffffda RBX: 0000000000000242 RCX: 00007f9134d81fc1
[   35.105452] RDX: 0000000000000242 RSI: 00007ffcd41e1200 RDI: 00000000ffffff9c
[   35.106663] RBP: 00007ffcd41e1200 R08: 0000000000000000 R09: 0000000000000064
[   35.107923] R10: 00000000000001a4 R11: 0000000000000202 R12: 0000000000000066
[   35.109112] R13: 0000000000100000 R14: 0000000000100000 R15: 0000000000000400
[   35.110357]  </TASK>
[   35.110769] irq event stamp: 8415587
[   35.111486] hardirqs last  enabled at (8415599): [<ffffffff8d74b562>] __up_console_sem+0x52/0x60
[   35.113067] hardirqs last disabled at (8415610): [<ffffffff8d74b547>] __up_console_sem+0x37/0x60
[   35.114575] softirqs last  enabled at (8415300): [<ffffffff8d6ac625>] handle_softirqs+0x315/0x3f0
[   35.115933] softirqs last disabled at (8415291): [<ffffffff8d6ac811>] __irq_exit_rcu+0xa1/0xc0
[   35.117316] ---[ end trace 0000000000000000 ]---

Fix this by using xas_reset() instead, which is equivalent in
implementation to xas_pause() but does not advance the XArray state.

Fixes: 6be3e21d25ca ("fs/dax: don't skip locked entries when scanning entries")
Signed-off-by: Alistair Popple <apopple@nvidia.com>
Link: https://lore.kernel.org/20250523043749.1460780-1-apopple@nvidia.com
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: "Matthew Wilcow (Oracle)" <willy@infradead.org>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jan Kara <jack@suse.cz>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Ted Ts'o <tytso@mit.edu>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>

Merge tag 'vfio-v6.16-rc1' of https://github.com/awilliam/linux-vfio

Pull VFIO updates from Alex Williamson:

- Remove an outdated DMA unmap optimization that relies on a feature
   only implemented in AMDv1 page tables. (Jason Gunthorpe)

- Fix various migration issues in the hisi_acc_vfio_pci variant driver,
   including use of a wrong DMA address requiring an update to the
   migration data structure, resending task completion interrupt after
   migration to re-sync queues, fixing a write-back cache sequencing
   issue, fixing a driver unload issue, behaving correctly when the
   guest driver is not loaded, and avoiding to squash errors from
   sub-functions. (Longfang Liu)

- mlx5-vfio-pci variant driver update to make use of the new two-step
   DMA API for migration, using a page array directly rather than using
   a page list mapped across a scatter list. (Leon Romanovsky)

- Fix an incorrect loop index used when unwinding allocation of dirty
   page bitmaps on error, resulting in temporary failure in freeing
   unused bitmaps. (Li RongQing)

* tag 'vfio-v6.16-rc1' of https://github.com/awilliam/linux-vfio:
  vfio/type1: Fix error unwind in migration dirty bitmap allocation
  vfio/mlx5: Enable the DMA link API
  vfio/mlx5: Rewrite create mkey flow to allow better code reuse
  vfio/mlx5: Explicitly use number of pages instead of allocated length
  hisi_acc_vfio_pci: update function return values.
  hisi_acc_vfio_pci: bugfix live migration function without VF device driver
  hisi_acc_vfio_pci: bugfix the problem of uninstalling driver
  hisi_acc_vfio_pci: bugfix cache write-back issue
  hisi_acc_vfio_pci: add eq and aeq interruption restore
  hisi_acc_vfio_pci: fix XQE dma address error
  vfio/type1: Remove Fine Grained Superpages detection

Merge tag 'for-linus-6.16-1' of https://github.com/cminyard/linux-ipmi

Pull IPMI updates from Corey Minyard:
"Restructure the IPMI driver.

  This is a restructure of the IPMI driver, mostly to remove SRCU. The
  locking had issues, and they were not going to be straightforward to
  fix. Plus it used tons of memory and was generally a pain.

  Most of this moves handling of messages out of bh and interrupt
  context and runs it in thread context. Then getting rid of SRCU is
  easy.

  This also has a minor cleanup to remove a warning on newer GCCs and to
  fix some documentation"

* tag 'for-linus-6.16-1' of https://github.com/cminyard/linux-ipmi: (26 commits)
  docs: ipmi: fix spelling and grammar mistakes
  ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
  ipmi:watchdog: Use the new interface for panic messages
  ipmi:msghandler: Export and fix panic messaging capability
  Documentation:ipmi: Remove comments about interrupt level
  ipmi:ssif: Fix a shutdown race
  ipmi:msghandler: Don't deliver messages to deleted users
  ipmi:si: Rework startup of IPMI devices
  ipmi:msghandler: Add a error return from unhandle LAN cmds
  ipmi:msghandler: Shut down lower layer first at unregister
  ipmi:msghandler: Remove proc_fs.h
  ipmi:msghandler: Don't check for shutdown when returning responses
  ipmi:msghandler: Don't acquire a user refcount for queued messages
  ipmi:msghandler: Fix locking around users and interfaces
  ipmi:msghandler: Remove some user level processing in panic mode
  ipmi: Add a note about the pretimeout callback
  ipmi:watchdog: Change lock to mutex
  ipmi:msghandler: Remove srcu for the ipmi_interfaces list
  ipmi:msghandler: Remove srcu from the ipmi user structure
  ipmi:msghandler: Use the system_wq, not system_bh_wq
  ...

Merge tag 'tsm-for-6.16' of git://git./linux/kernel/git/devsec/tsm

Pull trusted security manager (TSM) updates from Dan Williams:

- Add a general sysfs scheme for publishing "Measurement" values
   provided by the architecture's TEE Security Manager. Use it to
   publish TDX "Runtime Measurement Registers" ("RTMRs") that either
   maintain a hash of stored values (similar to a TPM PCR) or provide
   statically provisioned data. These measurements are validated by a
   relying party.

- Reorganize the drivers/virt/coco/ directory for "host" and "guest"
   shared infrastructure.

- Fix a configfs-tsm-report unregister bug

- With CONFIG_TSM_MEASUREMENTS joining CONFIG_TSM_REPORTS and in
   anticipation of more shared "TSM" infrastructure arriving, rename the
   maintainer entry to "TRUSTED SECURITY MODULE (TSM) INFRASTRUCTURE".

* tag 'tsm-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm:
  tsm-mr: Fix init breakage after bin_attrs constification by scoping non-const pointers to init phase
  sample/tsm-mr: Fix missing static for sample_report
  virt: tdx-guest: Transition to scoped_cond_guard for mutex operations
  virt: tdx-guest: Refactor and streamline TDREPORT generation
  virt: tdx-guest: Expose TDX MRs as sysfs attributes
  x86/tdx: tdx_mcall_get_report0: Return -EBUSY on TDCALL_OPERAND_BUSY error
  x86/tdx: Add tdx_mcall_extend_rtmr() interface
  tsm-mr: Add tsm-mr sample code
  tsm-mr: Add TVM Measurement Register support
  configfs-tsm-report: Fix NULL dereference of tsm_ops
  coco/guest: Move shared guest CC infrastructure to drivers/virt/coco/guest/
  configfs-tsm: Namespace TSM report symbols

Merge tag 'x86_sgx_for_6.16-rc1' of git://git./linux/kernel/git/tip/tip

Pull Intel software guard extension (SGX) updates from Dave Hansen:
"A couple of x86/sgx changes.

  The first one is a no-brainer to use the (simple) SHA-256 library.

  For the second one, some folks doing testing noticed that SGX systems
  under memory pressure were inducing fatal machine checks at pretty
  unnerving rates, despite the SGX code having _some_ awareness of
  memory poison.

  It turns out that the SGX reclaim path was not checking for poison
  _and_ it always accesses memory to copy it around. Make sure that
  poisoned pages are not reclaimed"

* tag 'x86_sgx_for_6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/sgx: Prevent attempts to reclaim poisoned pages
  x86/sgx: Use SHA-256 library API instead of crypto_shash API