Merge tag 'thermal-v6.10-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux into thermal

Merge updates of thermal drivers for v6.10 from Daniel Lezcano:

"- Add QCM2290 compatible DT bindings for Lmh and fix a null pointer
   dereference in the lmh driver in case the SCM is not present (Konrad
   Dybcio)

 - Use the strreplace() function instead of doing it manually in the
   Armada driver (Rasmus Villemoes)

 - Convert st,stih407-thermal to DT schema and fix up missing
   properties (Raphael Gallais-Pou)

 - Add suspend/resume by restoring the context of the tsens sensor
   (Priyansh Jain)

 - Support A1 SoC family Thermal Sensor controller and add the DT
   bindings (Dmitry Rokosov)

 - Improve the temperature approximation calculation and consolidate
   the Tj constant into a shared area of the structure instead of
   duplicating it on the Rcar Gen3 (Niklas Söderlund)

 - Fix the Mediatek LVTS sensor coefficient for the MT8192 in order to support
   it correctly (Hsin-Te Yuan)

 - Fix a null pointer dereference on the tsens driver when the function
   compute_intercept_slope() is called with a null parameter (Aleksandr
   Mishin)

 - Remove some unused fields in struct qpnp_tm_chip and k3_bandgap
   (Christophe Jaillet)

 - Fixup calibration efuse data decoding, consolidate the code by
   checking boundaries and refactor some part of the LVTS Mediatek
   driver. After setting the scene, add MT8186 and MT8188 along with
   the DT bindings (Nicolas Pitre)

 - Add Loongson-2K2000 support after some minor code adjustements and
   providing the DT bindings definition (Binbin Zhou)"

* tag 'thermal-v6.10-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (28 commits)
  thermal/drivers/loongson2: Add Loongson-2K2000 support
  dt-bindings: thermal: loongson,ls2k-thermal: Fix incorrect compatible definition
  dt-bindings: thermal: loongson,ls2k-thermal: Add Loongson-2K0500 compatible
  thermal/drivers/loongson2: Trivial code style adjustment
  thermal/drivers/mediatek/lvts_thermal: Add MT8188 support
  dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT8188
  thermal/drivers/mediatek/lvts_thermal: Allow early empty sensor slots
  thermal/drivers/mediatek/lvts_thermal: Provision for gt variable location
  thermal/drivers/mediatek/lvts_thermal: Add MT8186 support
  dt-bindings: thermal: mediatek: Add LVTS thermal controller definition for MT8186
  thermal/drivers/mediatek/lvts_thermal: Guard against efuse data buffer overflow
  thermal/drivers/mediatek/lvts_thermal: Use offsets for every calibration byte
  thermal/drivers/mediatek/lvts_thermal: Remove .hw_tshut_temp
  thermal/drivers/mediatek/lvts_thermal: Move comment
  thermal/drivers/mediatek/lvts_thermal: Retrieve all calibration bytes
  thermal/drivers/k3_bandgap: Remove some unused fields in struct k3_bandgap
  thermal/drivers/qcom: Remove some unused fields in struct qpnp_tm_chip
  thermal/drivers/tsens: Fix null pointer dereference
  thermal/drivers/mediatek/lvts_thermal: Add coeff for mt8192
  thermal/drivers/rcar_gen3: Update temperature approximation calculation
  ...

Since thermal_debug_cdev_remove() does not run under cdev->lock, it can
run in parallel with thermal_debug_cdev_state_update() and it may free
the struct thermal_debugfs object used by the latter after it has been
checked against NULL.

If that happens, thermal_debug_cdev_state_update() will access memory
that has been freed already causing the kernel to crash.

Address this by using cdev->lock in thermal_debug_cdev_remove() around
the cdev->debugfs value check (in case the same cdev is removed at the
same time in two different threads) and its reset to NULL.

Fixes: 755113d7 ("thermal/debugfs: Add thermal cooling device debugfs information")
Cc :6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>

With the current thermal zone locking arrangement in the debugfs code,
user space can open the "mitigations" file for a thermal zone before
the zone's debugfs pointer is set which will result in a NULL pointer
dereference in tze_seq_start().

Moreover, thermal_debug_tz_remove() is not called under the thermal
zone lock, so it can run in parallel with the other functions accessing
the thermal zone's struct thermal_debugfs object.  Then, it may clear
tz->debugfs after one of those functions has checked it and the
struct thermal_debugfs object may be freed prematurely.

To address the first problem, pass a pointer to the thermal zone's
struct thermal_debugfs object to debugfs_create_file() in
thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(),
tze_seq_stop(), and tze_seq_show() retrieve it from s->private
instead of a pointer to the thermal zone object.  This will ensure
that tz_debugfs will be valid across the "mitigations" file accesses
until thermal_debugfs_remove_id() called by thermal_debug_tz_remove()
removes that file.

To address the second problem, use tz->lock in thermal_debug_tz_remove()
around the tz->debugfs value check (in case the same thermal zone is
removed at the same time in two different threads) and its reset to NULL.

Fixes: 7ef01f22 ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Cc :6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>

Because thermal_debug_tz_remove() does not free all memory allocated for
thermal zone diagnostics, some of that memory becomes unreachable after
freeing the thermal zone's struct thermal_debugfs object.

Address this by making thermal_debug_tz_remove() free all of the memory
in question.

Fixes: 7ef01f22 ("thermal/debugfs: Add thermal debugfs information for mitigation episodes")
Cc :6.8+ <stable@vger.kernel.org> # 6.8+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>

The Loongson-2K2000 and Loongson-2K1000 have similar thermal sensors,
except that the temperature is read differently.

In particular, the temperature output registers of the Loongson-2K2000
are defined in the chip configuration domain and are read in a different
way.
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/fdbfdcc3231a36a4ee0bcf1377ddcbd6f8c944b5.1713837379.git.zhoubinbin@loongson.cn

The temperature output register of the Loongson-2K2000 is defined in the
chip configuration domain, which is different from the Loongson-2K1000,
so it can't be fallbacked.

We need to use two groups of registers to describe it: the first group
is the high and low temperature threshold setting register; the second
group is the temperature output register.

It is true that this fix will cause ABI corruption, but it is necessary
otherwise the Loongson-2K2000 temperature sensor will not work properly.

Fixes: 72684d99 ("thermal: dt-bindings: add loongson-2 thermal")
Cc: Yinbo Zhu <zhuyinbo@loongson.cn>
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/5198999d679f1a1c3457385acb9fadfc85da1f1e.1713837379.git.zhoubinbin@loongson.cn

The thermal on the Loongson-2K0500 shares the design with the
Loongson-2K1000. Define corresponding compatible string, having the
loongson,ls2k1000-thermal as a fallback.
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/26524a63abd2d032e4c45efe6ce3fedb46841768.1713837379.git.zhoubinbin@loongson.cn

Here are some minor code style adjustment. Such as fix whitespace code
style; align function call arguments to opening parenthesis.
Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
Acked-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/ccca50f2ad3fd8c84fcbfcb1f875427ea7f637a0.1713837379.git.zhoubinbin@loongson.cn

Various values extracted from the vendor's kernel driver.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-15-nico@fluxnic.net

Add LVTS thermal controller definition for MT8188.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-13-nico@fluxnic.net

Some systems don't always populate sensor controller slots starting
at slot 0. Use a bitmap instead of a count to indicate valid sensor
slots. Also create a pretty iterator for that.

About that iterator: it causes checkpatch to complain with "ERROR:
Macros with multiple statements should be enclosed in a do - while
loop". However this is not possible here. And many similar iterators
do exist using the same form in the tree already.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-12-nico@fluxnic.net

The golden temperature calibration value in nvram is not always the
3rd byte. A future commit will prove this assumption wrong.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-11-nico@fluxnic.net

Various values extracted from the vendor's kernel driver.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-9-nico@fluxnic.net

Add LVTS thermal controller definition for MT8186.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-7-nico@fluxnic.net

We don't want to silently fetch garbage past the actual buffer.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-6-nico@fluxnic.net

Current code assumes calibration values are always stored contiguously
in host endian order. A future patch will prove this wrong.

Let's specify the offset for each calibration byte instead.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-5-nico@fluxnic.net

All the .hw_tshut_temp instances are initialized with the same value.
Let's remove those and use a common definition instead. If ever a
different value must be used in the future then an override parameter
could be added back.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-4-nico@fluxnic.net

Move efuse data interpretation inside lvts_golden_temp_init() alongside
the actual code retrieving wanted value.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-3-nico@fluxnic.net

Calibration values are 24-bit wide. Those values so far appear to span
only 16 bits but let's not push our luck.

Found while looking at the original Mediatek driver code.
Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240402032729.2736685-2-nico@fluxnic.net

In "struct k3_bandgap", the 'conf' field is unused.
Remove it.

Found with cppcheck, unusedStructMember.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/206d39bed9ec6df9b4d80b1fc064e499389fc7fc.1712687420.git.christophe.jaillet@wanadoo.fr

In "struct qpnp_tm_chip", the 'prev_stage' field is unused.
Remove it.

Found with cppcheck, unusedStructMember.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/d1c3a3c455f485dae46290e3488daf1dcc1d355a.1712687589.git.christophe.jaillet@wanadoo.fr

compute_intercept_slope() is called from calibrate_8960() (in tsens-8960.c)
as compute_intercept_slope(priv, p1, NULL, ONE_PT_CALIB) which lead to null
pointer dereference (if DEBUG or DYNAMIC_DEBUG set).
Fix this bug by adding null pointer check.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: dfc1193d ("thermal/drivers/tsens: Replace custom 8960 apis with generic apis")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240411114021.12203-1-amishin@t-argos.ru

In order for lvts_raw_to_temp to function properly on mt8192,
temperature coefficients for mt8192 need to be added.

Fixes: 28873224 ("thermal/drivers/mediatek/lvts_thermal: Add mt8192 support")
Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240416-lvts_thermal-v2-1-f8a36882cc53@chromium.org

The initial driver used a formula to approximate the temperature and
register values reversed engineered from an out-of-tree BSP driver. This
was needed as the datasheet at the time did not contain any information
on how to do this. Later Gen3 (Rev 2.30) and Gen4 (all) now contains
this information.

Update the approximation formula to use the datasheet's information
instead of the reversed-engineered one.

On an idle M3-N without fused calibration values for PTAT and THCODE the
old formula reports,

    zone0: 52000
    zone1: 53000
    zone2: 52500

While the new formula under the same circumstances reports,

    zone0: 52500
    zone1: 54000
    zone2: 54000
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240327133013.3982199-3-niklas.soderlund+renesas@ragnatech.se

The calculated Tj_T constant is calculated from the PTAT data either
read from the first TSC zone on the device if calibration data is fused,
or from fallback values in the driver itself. The value calculated is
shared among all TSC zones.

Move the Tj_T constant to the shared private data structure instead of
duplicating it in each TSC private data. This requires adding a pointer
to the shared data to the TSC private data structure. This back pointer
make it easier to further rework the temperature conversion logic.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240327133013.3982199-2-niklas.soderlund+renesas@ragnatech.se

In comparison to other Amlogic chips, there is one key difference.
The offset for the sec_ao base, also known as u_efuse_off, is special,
while other aspects remain the same.
Signed-off-by: Dmitry Rokosov <ddrokosov@salutedevices.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240328191322.17551-3-ddrokosov@salutedevices.com

Provide right compatible properties for Amlogic A1 Thermal Sensor
controller. A1 family supports only one thermal node - CPU thermal
sensor.
Signed-off-by: Dmitry Rokosov <ddrokosov@salutedevices.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240328191322.17551-2-ddrokosov@salutedevices.com

As part of suspend to RAM, tsens hardware will be turned off.
While resume callback, re-initialize tsens hardware.
Signed-off-by: Priyansh Jain <quic_priyjain@quicinc.com>
Acked-by: Amit Kucheria <amitk@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240328050230.31770-1-quic_priyjain@quicinc.com

'st,passive_colling_temp' does not appear in the device-tree, 'reg' and
'#thermal-sensor-cells' are also missing in the device description.

Convert st,stih407-thermal binding to DT schema format in order to clean
unused 'st,passive_cooling_temp' and add missing properties.
Signed-off-by: Raphael Gallais-Pou <rgallaispou@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240320-thermal-v3-1-700296694c4a@gmail.com

Simplify the code by using the helper we have for doing exactly this.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240320104940.65031-1-linux@rasmusvillemoes.dk

Up until now, the necessary scm availability check has not been
performed, leading to possible null pointer dereferences (which did
happen for me on RB1).

Fix that.

Fixes: 53bca371 ("thermal/drivers/qcom: Add support for LMh driver")
Cc: <stable@vger.kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240308-topic-rb1_lmh-v2-2-bac3914b0fe3@linaro.org

Document the QCM2290 LMH.
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240308-topic-rb1_lmh-v2-1-bac3914b0fe3@linaro.org

Pull char / misc driver fixes from Greg KH:
 "Here are some small char/misc and other driver fixes for 6.9-rc5.
  Included in here are the following:

   - binder driver fix for reported problem

   - speakup crash fix

   - mei driver fixes for reported problems

   - comdei driver fix

   - interconnect driver fixes

   - rtsx driver fix

   - peci.h kernel doc fix

  All of these have been in linux-next for over a week with no reported
  problems"

* tag 'char-misc-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  peci: linux/peci.h: fix Excess kernel-doc description warning
  binder: check offset alignment in binder_get_object()
  comedi: vmk80xx: fix incomplete endpoint checking
  mei: vsc: Unregister interrupt handler for system suspend
  Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
  misc: rtsx: Fix rts5264 driver status incorrect when card removed
  mei: me: disable RPL-S on SPS and IGN firmwares
  speakup: Avoid crash on very long word
  interconnect: Don't access req_list while it's being manipulated
  interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM

Pull kernfs bugfix and documentation update from Greg KH:
 "Here are two changes for 6.9-rc5 that deal with "driver core" stuff,
  that do the following:

   - sysfs reference leak fix

   - embargoed-hardware-issues.rst update for Power

  Both of these have been in linux-next for over a week with no reported
  issues"

* tag 'driver-core-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  Documentation: embargoed-hardware-issues.rst: Add myself for Power
  fs: sysfs: Fix reference leak in sysfs_break_active_protection()

Pull tty/serial driver fixes from Greg KH:
 "Here are some small tty and serial driver fixes for 6.9-rc5 that
  resolve a bunch of reported problems. Included in here are:

   - MAINTAINERS and .mailmap update for Richard Genoud

   - serial core regression fixes from 6.9-rc1 changes

   - pci id cleanups

   - serial core crash fix

   - stm32 driver fixes

   - 8250 driver fixes

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'tty-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: stm32: Reset .throttled state in .startup()
  serial: stm32: Return IRQ_NONE in the ISR if no handling happend
  serial: core: Fix missing shutdown and startup for serial base port
  serial: core: Clearing the circular buffer before NULLifying it
  MAINTAINERS: mailmap: update Richard Genoud's email address
  serial/pmac_zilog: Remove flawed mitigation for rx irq flood
  serial: 8250_pci: Remove redundant PCI IDs
  serial: core: Fix regression when runtime PM is not enabled
  serial: mxs-auart: add spinlock around changing cts state
  serial: 8250_dw: Revert: Do not reclock if already at correct rate
  serial: 8250_lpc18xx: disable clks on error in probe()

Pull USB / Thunderbolt driver fixes from Greg KH:
 "Here are some small USB and Thunderbolt driver fixes for 6.9-rc5.
  Included in here are:

   - MAINTAINER file update for invalid email address

   - usb-serial device id updates

   - typec driver fixes

   - thunderbolt / usb4 driver fixes

   - usb core shutdown fixes

   - cdc-wdm driver revert for reported problem in -rc1

   - usb gadget driver fixes

   - xhci driver fixes

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'usb-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
  USB: serial: option: add Telit FN920C04 rmnet compositions
  usb: dwc3: ep0: Don't reset resource alloc flag
  Revert "usb: cdc-wdm: close race between read and workqueue"
  USB: serial: option: add Rolling RW101-GL and RW135-GL support
  USB: serial: option: add Lonsung U8300/U9300 product
  USB: serial: option: add support for Fibocom FM650/FG650
  USB: serial: option: support Quectel EM060K sub-models
  USB: serial: option: add Fibocom FM135-GL variants
  usb: misc: onboard_usb_hub: Disable the USB hub clock on failure
  thunderbolt: Avoid notify PM core about runtime PM resume
  thunderbolt: Fix wake configurations after device unplug
  usb: dwc2: host: Fix dereference issue in DDMA completion flow.
  usb: typec: mux: it5205: Fix ChipID value typo
  MAINTAINERS: Drop Li Yang as their email address stopped working
  usb: gadget: fsl: Initialize udc before using it
  usb: Disable USB3 LPM at shutdown
  usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
  usb: typec: tcpm: Correct the PDO counting in pd_set
  usb: gadget: functionfs: Wait for fences before enqueueing DMABUF
  usb: gadget: functionfs: Fix inverted DMA fence direction
  ...

Pull scheduler fix from Borislav Petkov:

 - Add a missing memory barrier in the concurrency ID mm switching

* tag 'sched_urgent_for_v6.9_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched: Add missing memory barrier in switch_mm_cid

Pull x86 fixes from Borislav Petkov:

 - Fix CPU feature dependencies of GFNI, VAES, and VPCLMULQDQ

 - Print the correct error code when FRED reports a bad event type

 - Add a FRED-specific INT80 handler without the special dances that
   need to happen in the current one

 - Enable the using-the-default-return-thunk-but-you-should-not warning
   only on configs which actually enable those special return thunks

 - Check the proper feature flags when selecting BHI retpoline
   mitigation

* tag 'x86_urgent_for_v6.9_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
  x86/fred: Fix incorrect error code printout in fred_bad_type()
  x86/fred: Fix INT80 emulation for FRED
  x86/retpolines: Enable the default thunk warning only on relevant configs
  x86/bugs: Fix BHI retpoline check