For buffer registration (or updates), a userspace iovec is copied in
and updated. If the application is within a compat syscall, then the
iovec type is compat_iovec rather than iovec. However, the type used
in __io_sqe_buffers_update() and io_sqe_buffers_register() is always
struct iovec, and hence the source is incremented by the size of a
non-compat iovec in the loop. This misses every other iovec in the
source, and will run into garbage half way through the copies and
return -EFAULT to the application.

Maintain the source address separately and assign to our user vec
pointer, so that copies always happen from the right source address.

While in there, correct a bad placement of __user which triggered
the following sparse warning prior to this fix:

io_uring/rsrc.c:981:33: warning: cast removes address space '__user' of expression
io_uring/rsrc.c:981:30: warning: incorrect type in assignment (different address spaces)
io_uring/rsrc.c:981:30:    expected struct iovec const [noderef] __user *uvec
io_uring/rsrc.c:981:30:    got struct iovec *[noderef] __user

Fixes: f4eaf8ed ("io_uring/rsrc: Drop io_copy_iov in favor of iovec API")
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Harden the buffer peeking a bit, by adding a sanity check for it having
a valid size. Outside of that, arg->max_len is a size_t, though it's
only ever set to a 32-bit value (as it's governed by MAX_RW_COUNT).
Bump our needed check to a size_t so we know it fits. Finally, cap the
calculated needed iov value to the PEEK_MAX_IMPORT, which is the
maximum number of segments that should be peeked.

Fixes: 35c8711c ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

io_uring_cqe's user_data field refers to `sqe->data`, but io_uring_sqe
does not have a data field. Fix the comment to say `sqe->user_data`.
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Link: https://github.com/axboe/liburing/pull/1206
Link: https://lore.kernel.org/r/20240816181526.3642732-1-csander@purestorage.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

There's a debug check in io_sq_thread_park() checking if it's the SQPOLL
thread itself calling park. KCSAN warns about this, as we should not be
reading sqd->thread outside of sqd->lock.

Just silence this with data_race(). The pointer isn't used for anything
but this debug check.

Reported-by: syzbot+2b946a3fd80caf971b21@syzkaller.appspotmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

io_napi_entry() has 2 calling sites. One of them is unlikely to find an
entry and if it does, the timeout should arguable not be updated.

The other io_napi_entry() calling site is overwriting the update made
by io_napi_entry() so the io_napi_entry() timeout value update has no or
little value and therefore is removed.
Signed-off-by: Olivier Langlois <olivier@trillion01.com>
Link: https://lore.kernel.org/r/145b54ff179f87609e20dffaf5563c07cdbcad1a.1723423275.git.olivier@trillion01.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

doing so avoids the overhead of adding napi ids to all the rings that do
not enable napi.

if no id is added to napi_list because napi is disabled,
__io_napi_busy_loop() will not be called.
Signed-off-by: Olivier Langlois <olivier@trillion01.com>
Fixes: b4ccc4dd ("io_uring/napi: enable even with a timeout of 0")
Link: https://lore.kernel.org/r/bd989ccef5fda14f5fd9888faf4fefcf66bd0369.1723400131.git.olivier@trillion01.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

If a send is issued marked with IOSQE_BUFFER_SELECT for selecting a
buffer, unless it's a bundle, it should not select multiple buffers.

Cc: stable@vger.kernel.org
Fixes: a05d1f62 ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: a05d1f62 ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: 2f9c9515 ("io_uring/net: support bundles for recv")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

These lists are unused, remove them.
Signed-off-by: Olivier Langlois <olivier@trillion01.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/0a0ae3e955aed0f3e3d29882fb3d3cb575e0009b.1722294947.git.olivier@trillion01.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

This refresh statement was originally present in the original patch:
https://lore.kernel.org/netdev/20221121191437.996297-2-shr@devkernel.io/

It has been removed with no explanation in v6:
https://lore.kernel.org/netdev/20230201222254.744422-2-shr@devkernel.io/

It is important to make the refresh for multishot requests, because if no
new requests using the same NAPI device are added to the ring, the entry
will become stale and be removed silently. The unsuspecting user will
not know that their ring had busy polling for only 60 seconds before
being pruned.
Signed-off-by: Olivier Langlois <olivier@trillion01.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Fixes: 8d0c12a8 ("io-uring: add napi busy poll support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/0fe61a019ec61e5708cd117cb42ed0dab95e1617.1722294646.git.olivier@trillion01.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

Pass the waiting time for __io_napi_adjust_timeout as ktime and get rid
of all timespec64 conversions. It's especially simpler since the caller
already have a ktime.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/4f5b8e8eed4f53a1879e031a6712b25381adc23d.1722003776.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

It's more natural to use ktime/ns instead of keeping around usec,
especially since we're comparing it against user provided timers,
so convert napi busy poll internal handling to ktime. It's also nicer
since the type (ktime_t vs unsigned long) now tells the unit of measure.

Keep everything as ktime, which we convert to/from micro seconds for
IORING_[UN]REGISTER_NAPI. The net/ busy polling works seems to work with
usec, however it's not real usec as shift by 10 is used to get it from
nsecs, see busy_loop_current_time(), so it's easy to get truncated nsec
back and we get back better precision.

Note, we can further improve it later by removing the truncation and
maybe convincing net/ to use ktime/ns instead.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/95e7ec8d095069a3ed5d40a4bc6f8b586698bc7e.1722003776.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

syzbot reports that KMSAN complains that 'nr_tw' is an uninit-value
with the following report:

BUG: KMSAN: uninit-value in io_req_local_work_add io_uring/io_uring.c:1192 [inline]
BUG: KMSAN: uninit-value in io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
 io_req_local_work_add io_uring/io_uring.c:1192 [inline]
 io_req_task_work_add_remote+0x588/0x5d0 io_uring/io_uring.c:1240
 io_msg_remote_post io_uring/msg_ring.c:102 [inline]
 io_msg_data_remote io_uring/msg_ring.c:133 [inline]
 io_msg_ring_data io_uring/msg_ring.c:152 [inline]
 io_msg_ring+0x1c38/0x1ef0 io_uring/msg_ring.c:305
 io_issue_sqe+0x383/0x22c0 io_uring/io_uring.c:1710
 io_queue_sqe io_uring/io_uring.c:1924 [inline]
 io_submit_sqe io_uring/io_uring.c:2180 [inline]
 io_submit_sqes+0x1259/0x2f20 io_uring/io_uring.c:2295
 __do_sys_io_uring_enter io_uring/io_uring.c:3205 [inline]
 __se_sys_io_uring_enter+0x40c/0x3ca0 io_uring/io_uring.c:3142
 __x64_sys_io_uring_enter+0x11f/0x1a0 io_uring/io_uring.c:3142
 x64_sys_call+0x2d82/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

which is the following check:

if (nr_tw < nr_wait)
	return;

in io_req_local_work_add(). While nr_tw itself cannot be uninitialized,
it does depend on req->flags, which off the msg ring issue path can
indeed be uninitialized.

Fix this by always clearing the allocated 'req' fully if we can't grab
one from the cache itself.

Fixes: 50cf5f38 ("io_uring/msg_ring: add an alloc cache for io_kiocb entries")
Reported-by: syzbot+82609b8937a4458106ca@syzkaller.appspotmail.com
Link: https://lore.kernel.org/io-uring/000000000000fd3d8d061dfc0e4a@google.com/Signed-off-by: Jens Axboe <axboe@kernel.dk>

There is a difference in how io_queue_sqe and io_wq_submit_work treat
error codes they get from io_issue_sqe. The first one fails anything
unknown but latter only fails when the code is negative.

It doesn't make sense to have this discrepancy, align them to the
io_queue_sqe behaviour.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c550e152bf4a290187f91a4322ddcb5d6d1f2c73.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

We removed the reliance on the flag by the cancellation path and now
it's unused.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/e57afe566bbe4fefeb44daffb08900f2a4756577.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

We don't have to return error code from an op handler back to core
io_uring, so once io_uring_cmd() sets the results and handles errors we
can juts return IOU_OK and simplify the code.

Note, only valid with e0b23d99 ("io_uring: optimise ltimeout for
inline execution"), there was a problem with iopoll before.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/8eae2be5b2a49236cd5f1dadbd1aa5730e9e2d4f.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

The __must_hold annotation in io_match_task() uses a non existing
parameter "req", fix it.

Fixes: 6af3f48b ("io_uring: fix link traversal locking")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/3e65ee7709e96507cef3d93291746f2c489f2307.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

IORING_SETUP_IOPOLL rings don't have any netpoll handling, let's fail
attempts to register netpolling in this case, there might be people who
will mix up IOPOLL and netpoll.

Cc: stable@vger.kernel.org
Fixes: ef1186c1 ("io_uring: add register/unregister napi function")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1e7553aee0a8ae4edec6742cd6dd0c1e6914fba8.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

io_uring_cancel_generic() should retry if any state changes like a
request is completed, however in case of a task exit it only goes for
another loop and avoids schedule() if any tracked (i.e. REQ_F_INFLIGHT)
request got completed.

Let's assume we have a non-tracked request executing in iowq and a
tracked request linked to it. Let's also assume
io_uring_cancel_generic() fails to find and cancel the request, i.e.
via io_run_local_work(), which may happen as io-wq has gaps.
Next, the request logically completes, io-wq still hold a ref but queues
it for completion via tw, which happens in
io_uring_try_cancel_requests(). After, right before prepare_to_wait()
io-wq puts the request, grabs the linked one and tries executes it, e.g.
arms polling. Finally the cancellation loop calls prepare_to_wait(),
there are no tw to run, no tracked request was completed, so the
tctx_inflight() check passes and the task is put to indefinite sleep.

Cc: stable@vger.kernel.org
Fixes: 3f48cf18 ("io_uring: unify files and task cancel")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/acac7311f4e02ce3c43293f8f1fda9c705d158f1.1721819383.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent
error handling in io_alloc_pbuf_ring().

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341
Call Trace:
 <TASK>
 io_put_bl io_uring/kbuf.c:378 [inline]
 io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392
 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613
 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Cc: stable@vger.kernel.org
Reported-by: syzbot+2074b1a3d447915c6f1c@syzkaller.appspotmail.com
Fixes: 87585b05 ("io_uring/kbuf: use vm_insert_pages() for mmap'ed pbuf ring")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/c5f9df20560bd9830401e8e48abc029e7cfd9f5e.1721329239.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

There is a report that iowq executed getsockopt never completes. The
reason being that io_uring_cmd_sock() can return a positive result, and
io_uring_cmd() propagates it back to core io_uring, instead of IOU_OK.
In case of io_wq_submit_work(), the request will be dropped without
completing it.

The offending code was introduced by a hack in
a9c3eda7 ("io_uring: fix submission-failure handling for uring-cmd"),
however it was fine until getsockopt was introduced and started
returning positive results.

The right solution is to always return IOU_OK, since
e0b23d99 ("io_uring: optimise ltimeout for inline execution"),
we should be able to do it without problems, however for the sake of
backporting and minimising side effects, let's keep returning negative
return codes and otherwise do IOU_OK.

Link: https://github.com/axboe/liburing/issues/1181
Cc: stable@vger.kernel.org
Fixes: 8e9fad0e ("io_uring: Add io_uring command support for sockets")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://lore.kernel.org/r/ff349cf0654018189b6077e85feed935f0f8839e.1721149870.git.asml.silence@gmail.comSigned-off-by: Jens Axboe <axboe@kernel.dk>

Pull RISC-V updates from Palmer Dabbelt:

 - Support for various new ISA extensions:
     * The Zve32[xf] and Zve64[xfd] sub-extensios of the vector
       extension
     * Zimop and Zcmop for may-be-operations
     * The Zca, Zcf, Zcd and Zcb sub-extensions of the C extension
     * Zawrs

 - riscv,cpu-intc is now dtschema

 - A handful of performance improvements and cleanups to text patching

 - Support for memory hot{,un}plug

 - The highest user-allocatable virtual address is now visible in
   hwprobe

* tag 'riscv-for-linus-6.11-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (58 commits)
  riscv: lib: relax assembly constraints in hweight
  riscv: set trap vector earlier
  KVM: riscv: selftests: Add Zawrs extension to get-reg-list test
  KVM: riscv: Support guest wrs.nto
  riscv: hwprobe: export Zawrs ISA extension
  riscv: Add Zawrs support for spinlocks
  dt-bindings: riscv: Add Zawrs ISA extension description
  riscv: Provide a definition for 'pause'
  riscv: hwprobe: export highest virtual userspace address
  riscv: Improve sbi_ecall() code generation by reordering arguments
  riscv: Add tracepoints for SBI calls and returns
  riscv: Optimize crc32 with Zbc extension
  riscv: Enable DAX VMEMMAP optimization
  riscv: mm: Add support for ZONE_DEVICE
  virtio-mem: Enable virtio-mem for RISC-V
  riscv: Enable memory hotplugging for RISC-V
  riscv: mm: Take memory hotplug read-lock during kernel page table dump
  riscv: mm: Add memory hotplugging support
  riscv: mm: Add pfn_to_kaddr() implementation
  riscv: mm: Refactor create_linear_mapping_range() for memory hot add
  ...

Pull MIPS updates from Thomas Bogendoerfer:

 - add support for Realtek RTL9302C

 - add support for Mobileye EyeQ6H

 - add support for Mobileye EyeQ OLB system controller

 - improve r4k clocksource

 - add mode for emulating ieee754 NAN2008

 - rework for BMIPS CBR address handling

 - fixes for Loongson 2K1000

 - defconfig updates

 - cleanups and fixes

* tag 'mips_6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (58 commits)
  MIPS: config: Add ip30_defconfig
  MIPS: config: lemote2f: Regenerate defconfig
  MIPS: config: generic: Add board-litex
  MIPS: config: Enable MSA and virtualization for MIPS64R6
  MIPS: Fix fallback march for SB1
  mips: dts: realtek: Add RTL9302C board
  mips: generic: add fdt fixup for Realtek reference board
  mips: select REALTEK_OTTO_TIMER for Realtek platforms
  dt-bindings: interrupt-controller: realtek,rtl-intc: Add rtl9300-intc
  dt-bindings: mips: realtek: Add rtl930x-soc compatible
  dt-bindings: vendor-prefixes: Add Cameo Communications
  mips: dts: realtek: add device_type property to cpu node
  mips: dts: realtek: use "serial" instead of "uart" in node name
  MIPS: Implement ieee754 NAN2008 emulation mode
  MIPS: lantiq: improve USB initialization
  MIPS: GIC: Generate redirect block accessors
  MIPS: CPS: Add a couple of multi-cluster utility functions
  MIPS: Octeron: remove source file executable bit
  MAINTAINERS: Mobileye: add OLB drivers and dt-bindings
  MIPS: mobileye: eyeq5: add OLB system-controller node
  ...

Pull powerpc updates from Michael Ellerman:

 - Remove support for 40x CPUs & platforms

 - Add support to the 64-bit BPF JIT for cpu v4 instructions

 - Fix PCI hotplug driver crash on powernv

 - Fix doorbell emulation for KVM on PAPR guests (nestedv2)

 - Fix KVM nested guest handling of some less used SPRs

 - Online NUMA nodes with no CPU/memory if they have a PCI device
   attached

 - Reduce memory overhead of enabling kfence on 64-bit Radix MMU kernels

 - Reimplement the iommu table_group_ops for pseries for VFIO SPAPR TCE

Thanks to: Anjali K, Artem Savkov, Athira Rajeev, Breno Leitao, Brian
King, Celeste Liu, Christophe Leroy, Esben Haabendal, Gaurav Batra,
Gautam Menghani, Haren Myneni, Hari Bathini, Jeff Johnson, Krishna
Kumar, Krzysztof Kozlowski, Nathan Lynch, Nicholas Piggin, Nick Bowler,
Nilay Shroff, Rob Herring (Arm), Shawn Anastasio, Shivaprasad G Bhat,
Sourabh Jain, Srikar Dronamraju, Timothy Pearson, Uwe Kleine-König, and
Vaibhav Jain.

* tag 'powerpc-6.11-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (57 commits)
  Documentation/powerpc: Mention 40x is removed
  powerpc: Remove 40x leftovers
  macintosh/therm_windtunnel: fix module unload.
  powerpc: Check only single values are passed to CPU/MMU feature checks
  powerpc/xmon: Fix disassembly CPU feature checks
  powerpc: Drop clang workaround for builtin constant checks
  powerpc64/bpf: jit support for signed division and modulo
  powerpc64/bpf: jit support for sign extended mov
  powerpc64/bpf: jit support for sign extended load
  powerpc64/bpf: jit support for unconditional byte swap
  powerpc64/bpf: jit support for 32bit offset jmp instruction
  powerpc/pci: Hotplug driver bridge support
  pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
  powerpc/configs: Update defconfig with now user-visible CONFIG_FSL_IFC
  powerpc: add missing MODULE_DESCRIPTION() macros
  macintosh/mac_hid: add MODULE_DESCRIPTION()
  KVM: PPC: add missing MODULE_DESCRIPTION() macros
  powerpc/kexec: Use of_property_read_reg()
  powerpc/64s/radix/kfence: map __kfence_pool at page granularity
  powerpc/pseries/iommu: Define spapr_tce_table_group_ops only with CONFIG_IOMMU_API
  ...

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Define PCIE_RESET_CONFIG_DEVICE_WAIT_MS for the generic 100ms
     required after reset before config access (Kevin Xie)

   - Define PCIE_T_RRS_READY_MS for the generic 100ms required after
     reset before config access (probably should be unified with
     PCIE_RESET_CONFIG_DEVICE_WAIT_MS) (Damien Le Moal)

  Resource management:

   - Rename find_resource() to find_resource_space() to be more
     descriptive (Ilpo Järvinen)

   - Export find_resource_space() for use by PCI core, which needs to
     learn whether there is available space for a bridge window (Ilpo
     Järvinen)

   - Prevent double counting of resources so window size doesn't grow on
     each remove/rescan cycle (Ilpo Järvinen)

   - Relax bridge window sizing algorithm so a device doesn't break
     simply because it was removed and rescanned (Ilpo Järvinen)

   - Evaluate the ACPI PRESERVE_BOOT_CONFIG _DSM in
     pci_register_host_bridge() (not acpi_pci_root_create()) so we can
     unify it with similar DT functionality (Vidya Sagar)

   - Extend use of DT "linux,pci-probe-only" property so it works
     per-host bridge as well as globally (Vidya Sagar)

   - Unify support for ACPI PRESERVE_BOOT_CONFIG _DSM and the DT
     "linux,pci-probe-only" property in pci_preserve_config() (Vidya
     Sagar)

  Driver binding:

   - Add devres infrastructure for managed request and map of partial
     BAR resources (Philipp Stanner)

   - Deprecate pcim_iomap_table() because uses like
     "pcim_iomap_table()[0]" have no good way to return errors (Philipp
     Stanner)

   - Add an always-managed pcim_request_region() for use instead of
     pci_request_region() and similar, which are sometimes managed
     depending on whether pcim_enable_device() has been called
     previously (Philipp Stanner)

   - Reimplement pcim_set_mwi() so it doesn't need to keep store MWI
     state (Philipp Stanner)

   - Add pcim_intx() for use instead of pci_intx(), which is sometimes
     managed depending on whether pcim_enable_device() has been called
     previously (Philipp Stanner)

   - Add managed pcim_iomap_range() to allow mapping of a partial BAR
     (Philipp Stanner)

   - Fix a devres mapping leak in drm/vboxvideo (Philipp Stanner)

  Error handling:

   - Add missing bridge locking in device reset path and add a warning
     for other possible lock issues (Dan Williams)

   - Fix use-after-free on concurrent DPC and hot-removal (Lukas Wunner)

  Power management:

   - Disable AER and DPC during suspend to avoid spurious wakeups if
     they share an interrupt with PME (Kai-Heng Feng)

  PCIe native device hotplug:

   - Detect if a device was removed or replaced during system sleep so
     we don't assume a new device is the one that used to be there
     (Lukas Wunner)

  Virtualization:

   - Add an ACS quirk for Broadcom BCM5760X multi-function NIC; it
     prevents transactions between functions even though it doesn't
     advertise ACS, so the functions can be attached individually via
     VFIO (Ajit Khaparde)

  Peer-to-peer DMA:

   - Add a "pci=config_acs=" kernel command-line parameter to relax
     default ACS settings to enable additional peer-to-peer
     configurations. Requires expert knowledge of topology and ACS
     operation (Vidya Sagar)

  Endpoint framework:

   - Remove unused struct pci_epf_group.type_group (Christophe JAILLET)

   - Fix error handling in vpci_scan_bus() and epf_ntb_epc_cleanup()
     (Dan Carpenter)

   - Make struct pci_epc_class constant (Greg Kroah-Hartman)

   - Remove unused pci_endpoint_test_bar_{readl,writel} functions
     (Jiapeng Chong)

   - Rename "BME" to "Bus Master Enable" (Manivannan Sadhasivam)

   - Rename struct pci_epc_event_ops.core_init() callback to epc_init()
     (Manivannan Sadhasivam)

   - Move DMA init to MHI .epc_init() callback for uniformity
     (Manivannan Sadhasivam)

   - Cancel EPF test delayed work when link goes down (Manivannan
     Sadhasivam)

   - Add struct pci_epc_event_ops.epc_deinit() callback for cleanup
     needed on fundamental reset (Manivannan Sadhasivam)

   - Add 64KB alignment to endpoint test to support Rockchip rk3588
     (Niklas Cassel)

   - Optimize endpoint test by using memcpy() instead of readl() (Niklas
     Cassel)

  Device tree bindings:

   - Add generic "ats-supported" property to advertise that a PCIe Root
     Complex supports ATS (Jean-Philippe Brucker)

  Amazon Annapurna Labs PCIe controller driver:

   - Validate IORESOURCE_BUS presence to avoid NULL pointer dereference
     (Aleksandr Mishin)

  Axis ARTPEC-6 PCIe controller driver:

   - Rename .cpu_addr_fixup() parameter to reflect that it is a PCI
     address, not a CPU address (Niklas Cassel)

  Freescale i.MX6 PCIe controller driver:

   - Convert to agnostic GPIO API (Andy Shevchenko)

  Freescale Layerscape PCIe controller driver:

   - Make struct mobiveil_rp_ops constant (Christophe JAILLET)

   - Use new generic dw_pcie_ep_linkdown() to handle link-down events
     (Manivannan Sadhasivam)

  HiSilicon Kirin PCIe controller driver:

   - Convert to agnostic GPIO API (Andy Shevchenko)

   - Use _scoped() iterator for OF children to ensure refcounts are
     decremented at loop exit (Javier Carrasco)

  Intel VMD host bridge driver:

   - Create sysfs "domain" symlink before downstream devices are exposed
     to userspace by pci_bus_add_devices() (Jiwei Sun)

  Loongson PCIe controller driver:

   - Enable MSI when LS7A is used with new CPUs that have integrated
     PCIe Root Complex, e.g., Loongson-3C6000, so downstream devices can
     use MSI (Huacai Chen)

  Microchip AXI PolarFlare PCIe controller driver:

   - Move pcie-microchip-host.c to a new PLDA directory (Minda Chen)

   - Factor PLDA generic items out to a common
     plda,xpressrich3-axi-common.yaml binding (Minda Chen)

   - Factor PLDA generic data structures and code out to shared
     pcie-plda.h, pcie-plda-host.c (Minda Chen)

   - Add PLDA generic interrupt handling with a .request_event_irq()
     callback for vendor-specific events (Minda Chen)

   - Add PLDA generic host init/deinit and map bus functions for use by
     vendor-specific drivers (Minda Chen)

   - Rework to use PLDA core (Minda Chen)

  Microsoft Hyper-V host bridge driver:

   - Return zero, not garbage, when reading PCI_INTERRUPT_PIN (Wei Liu)

  NVIDIA Tegra194 PCIe controller driver:

   - Remove unused struct tegra_pcie_soc (Dr. David Alan Gilbert)

   - Set 64KB inbound ATU alignment restriction (Jon Hunter)

  Qualcomm PCIe controller driver:

   - Make the MHI reg region mandatory for X1E80100, since all PCIe
     controllers have it (Abel Vesa)

   - Prevent use of uninitialized data and possible error pointer
     dereference (Dan Carpenter)

   - Return error, not success, if dev_pm_opp_find_freq_floor() fails
     (Dan Carpenter)

   - Add Operating Performance Points (OPP) support to scale performance
     state based on aggregate link bandwidth to improve SoC power
     efficiency (Krishna chaitanya chundru)

   - Vote for the CPU-PCIe ICC (interconnect) path to ensure it stays
     active even if other drivers don't vote for it (Krishna chaitanya
     chundru)

   - Use devm_clk_bulk_get_all() to get all the clocks from DT to avoid
     writing out all the clock names (Manivannan Sadhasivam)

   - Add DT binding and driver support for the SA8775P SoC (Mrinmay
     Sarkar)

   - Add HDMA support for the SA8775P SoC (Mrinmay Sarkar)

   - Override the SA8775P NO_SNOOP default to avoid possible memory
     corruption (Mrinmay Sarkar)

   - Make sure resources are disabled during PERST# assertion, even if
     the link is already disabled (Manivannan Sadhasivam)

   - Use new generic dw_pcie_ep_linkdown() to handle link-down events
     (Manivannan Sadhasivam)

   - Add DT and endpoint driver support for the SA8775P SoC (Mrinmay
     Sarkar)

   - Add Hyper DMA (HDMA) support for the SA8775P SoC and enable it in
     the EPF MHI driver (Mrinmay Sarkar)

   - Set PCIE_PARF_NO_SNOOP_OVERIDE to override the default NO_SNOOP
     attribute on the SA8775P SoC (both Root Complex and Endpoint mode)
     to avoid possible memory corruption (Mrinmay Sarkar)

  Renesas R-Car PCIe controller driver:

   - Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() to
     avoid unnecessary backtrace (Marek Vasut)

   - Add DT and driver support for R-Car V4H (R8A779G0) host and
     endpoint. This requires separate proprietary firmware (Yoshihiro
     Shimoda)

  Rockchip PCIe controller driver:

   - Assert PERST# for 100ms after power is stable (Damien Le Moal)

   - Wait PCIE_T_RRS_READY_MS (100ms) after reset before starting
     configuration (Damien Le Moal)

   - Use GPIOD_OUT_LOW flag while requesting ep_gpio to fix a firmware
     crash on Qcom-based modems with Rockpro64 board (Manivannan
     Sadhasivam)

  Rockchip DesignWare PCIe controller driver:

   - Factor common parts of rockchip-dw-pcie DT binding to be shared by
     Root Complex and Endpoint mode (Niklas Cassel)

   - Add missing INTx signals to common DT binding (Niklas Cassel)

   - Add eDMA items to DT binding for Endpoint controller (Niklas
     Cassel)

   - Fix initial dw-rockchip PERST# GPIO value to prevent unnecessary
     short assert/deassert that causes issues with some WLAN controllers
     (Niklas Cassel)

   - Refactor dw-rockchip and add support for Endpoint mode (Niklas
     Cassel)

   - Call pci_epc_init_notify() and drop dw_pcie_ep_init_notify()
     wrapper (Niklas Cassel)

   - Add error messages in .probe() error paths to improve user
     experience (Uwe Kleine-König)

  Samsung Exynos PCIe controller driver:

   - Use bulk clock APIs to simplify clock setup (Shradha Todi)

  StarFive PCIe controller driver:

   - Add DT binding and driver support for the StarFive JH7110
     PLDA-based PCIe controller (Minda Chen)

  Synopsys DesignWare PCIe controller driver:

   - Add generic support for sending PME_Turn_Off when system suspends
     (Frank Li)

   - Fix incorrect interpretation of iATU slot 0 after PERST#
     assert/deassert (Frank Li)

   - Use msleep() instead of usleep_range() while waiting for link
     (Konrad Dybcio)

   - Refactor dw_pcie_edma_find_chip() to enable adding support for
     Hyper DMA (HDMA) (Manivannan Sadhasivam)

   - Enable drivers to supply the eDMA channel count since some can't
     auto detect this (Manivannan Sadhasivam)

   - Call pci_epc_init_notify() and drop dw_pcie_ep_init_notify()
     wrapper (Manivannan Sadhasivam)

   - Pass the eDMA mapping format directly from drivers instead of
     maintaining a capability for it (Manivannan Sadhasivam)

   - Add generic dw_pcie_ep_linkdown() to notify EPF drivers about
     link-down events and restore non-sticky DWC registers lost on link
     down (Manivannan Sadhasivam)

   - Add vendor-specific "apb" reg name, interrupt names, INTx names to
     generic binding (Niklas Cassel)

   - Enforce DWC restriction that 64-bit BARs must start with an
     even-numbered BAR (Niklas Cassel)

   - Consolidate args of dw_pcie_prog_outbound_atu() into a structure
     (Yoshihiro Shimoda)

   - Add support for endpoints to send Message TLPs, e.g., for INTx
     emulation (Yoshihiro Shimoda)

  TI DRA7xx PCIe controller driver:

   - Rename .cpu_addr_fixup() parameter to reflect that it is a PCI
     address, not a CPU address (Niklas Cassel)

  TI Keystone PCIe controller driver:

   - Validate IORESOURCE_BUS presence to avoid NULL pointer dereference
     (Aleksandr Mishin)

   - Work around AM65x/DRA80xM Errata #i2037 that corrupts TLPs and
     causes processor hangs by limiting Max_Read_Request_Size (MRRS) and
     Max_Payload_Size (MPS) (Kishon Vijay Abraham I)

   - Leave BAR 0 disabled for AM654x to fix a regression caused by
     6ab15b5e ("PCI: dwc: keystone: Convert .scan_bus() callback to
     use add_bus"), which caused a 45-second boot delay (Siddharth
     Vadapalli)

  Xilinx Versal CPM PCIe controller driver:

   - Fix overlapping bridge registers and 32-bit BAR addresses in DT
     binding (Thippeswamy Havalige)

  MicroSemi Switchtec management driver:

   - Make struct switchtec_class constant (Greg Kroah-Hartman)

  Miscellaneous:

   - Remove unused struct acpi_handle_node (Dr. David Alan Gilbert)

   - Add missing MODULE_DESCRIPTION() macros (Jeff Johnson)"

* tag 'pci-v6.11-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (154 commits)
  PCI: loongson: Enable MSI in LS7A Root Complex
  PCI: Extend ACS configurability
  PCI: Add missing bridge lock to pci_bus_lock()
  drm/vboxvideo: fix mapping leaks
  PCI: Add managed pcim_iomap_range()
  PCI: Remove legacy pcim_release()
  PCI: Add managed pcim_intx()
  PCI: vmd: Create domain symlink before pci_bus_add_devices()
  PCI: qcom: Prevent use of uninitialized data in qcom_pcie_suspend_noirq()
  PCI: qcom: Prevent potential error pointer dereference
  PCI: qcom: Fix missing error code in qcom_pcie_probe()
  PCI: Give pcim_set_mwi() its own devres cleanup callback
  PCI: Move struct pci_devres.pinned bit to struct pci_dev
  PCI: Remove struct pci_devres.enabled status bit
  PCI: Document hybrid devres hazards
  PCI: Add managed pcim_request_region()
  PCI: Deprecate pcim_iomap_table(), pcim_iomap_regions_request_all()
  PCI: Add managed partial-BAR request and map infrastructure
  PCI: Add devres helpers for iomap table
  PCI: Add and use devres helper for bit masks
  ...

Pull input updates from Dmitry Torokhov:

 - streamlined logic in input core for handling normal input handlers vs
   input filters

 - updates to input drivers to allocate memory with sizeof(*pointer)
   instead of sizeof(type)

 - change to ads7846 touchscreen driver to use hsync GPIO instead of
   requiring platform data with special method (which is not compatible
   with boards using device tree)

 - update to adc-joystick driver to handle inverted axes

 - cleanups in various drivers switching them to use the new "guard" and
   "__free()" facilities

 - changes to several drivers (adxl34x, atmel_mxt_ts, ati-remote2,
   omap-keypad, yealink) to stop creating driver-specific device
   attributes manually and use driver core facilities for this

 - update to Cypress PS/2 protocol driver to properly handle errors from
   the PS/2 transport as well as other cleanups

 - update to edt-ft5x06 driver to support ft5426 variant

 - update to ektf2127 driver to support ektf2232 variant

 - update to exc3000 driver to support EXC81W32 variant

 - update to imagis driver to support IST3038 variant

 - other assorted driver cleanups.

* tag 'input-for-v6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (71 commits)
  Input: yealink - simplify locking in sysfs attribute handling
  Input: yealink - use driver core to instantiate device attributes
  Input: ati-remote2 - use driver core to instantiate device attributes
  Input: omap-keypad - use driver core to instantiate device attributes
  Input: atmel_mxt_ts - use driver core to instantiate device attributes
  Input: exc3000 - add EXC81W32 support
  dt-bindings: input: touchscreen: exc3000: add EXC81W32
  Input: twl4030-pwrbutton - fix kernel-doc warning
  Input: himax_hx83112b - add support for HX83100A
  Input: himax_hx83112b - add himax_chip struct for multi-chip support
  Input: himax_hx83112b - implement MCU register reading
  Input: himax_hx83112b - use more descriptive register defines
  dt-bindings: input: touchscreen: himax,hx83112b: add HX83100A
  Input: do not check number of events in input_pass_values()
  Input: preallocate memory to hold event values
  Input: rearrange input_alloc_device() to prepare for preallocating of vals
  Input: simplify event handling logic
  Input: make events() method return number of events processed
  Input: make sure input handlers define only one processing method
  Input: evdev - remove ->event() method
  ...

Pull i2c fixes from Wolfram Sang:
 "The I2C core gains documentation updates for the testunit, a cleanup
  regarding unneeded 'driver_data' and more sanity checks in the char
  device.

  For the host drivers, this release includes significant updates, with
  the primary change being the renaming from "master/slave" to
  "controller/target" to adhere to I2C v7 and SMBus 3.2 standards.

  New Support:

   - Added support for Intel Arrow Lake-H
   - Added I2C support in the Arioha SoC by linking the Mediatek I2C
     controller

  Cleanups:

   - Added the MODULE_DESCRIPTION() macro, resolving a modpost warning
     in the ALi 1563 Southbridge driver.
   - Constified the regmap_config declaration in the i2c-designware
     driver.
   - Improved the coding style in the Renesas R-Car driver by removing
     unnecessary semicolons after brackets.

  General improvements:

   - In the OMAP device, replaced NOIRQ_SYSTEM_SLEEP_PM_OPS with
     RUNTIME_PM_OPS to enable waking up the controller during suspend()
     before suspend_noirq() kicks in.
   - Improved logging in the Xilinx driver.
   - Added a warning (WARN()) in the Renesas R-Car driver for spurious
     interrupts.

  DTS Changes:

   - Removed address-cell and size-cell from the Atmel at91sam, nVidia
     Tegra 20, and Samsung S3c2410 devices.
   - Fixed Texas Instruments OMAP4 I2C controller to comply with the
     i2c-controller.yaml schema.
   - Improved indentation in DTS examples for several I2C devices.
   - Converted the NXP LPC1788 binding to the dt-schema.
   - Added documentation for the compatible string thead,th1520-i2c.
   - Added the "power-domains" property for the Meson I2C driver.

  AT24 EEPROM driver changes:

   - add support for two new Microchip models
   - document even more new models in DT bindings (those use fallback
     compatibles so no code changes)"

* tag 'i2c-for-6.11-rc1-try2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (87 commits)
  i2c: document new callbacks in i2c_algorithm
  dt-bindings: i2c: amlogic,meson6-i2c: add optional power-domains
  dt-bindings: i2c: at91: Add sama7d65 compatible string
  i2c: st: reword according to newest specification
  i2c: cpm: reword according to newest specification
  i2c: virtio: reword according to newest specification
  i2c: nvidia-gpu: reword according to newest specification
  i2c: viai2c: reword according to newest specification
  i2c: viperboard: reword according to newest specification
  i2c: uniphier: reword according to newest specification
  i2c: uniphier-f: reword according to newest specification
  i2c: tiny-usb: reword according to newest specification
  i2c: thunderx-pcidrv: reword according to newest specification
  i2c: tegra-bpmp: reword according to newest specification
  i2c: taos-evm: reword according to newest specification
  i2c: sun6i-p2wi: reword according to newest specification
  i2c: stm32f4: reword according to newest specification
  i2c: sprd: reword according to newest specification
  i2c: sis5595: reword according to newest specification
  i2c: rzv2m: reword according to newest specification
  ...

Pull char / misc and other driver updates from Greg KH:
 "Here is the "big" set of char/misc and other driver subsystem changes
  for 6.11-rc1. Nothing major in here, just loads of new drivers and
  updates. Included in here are:

   - IIO api updates and new drivers added

   - wait_interruptable_timeout() api cleanups for some drivers

   - MODULE_DESCRIPTION() additions for loads of drivers

   - parport out-of-bounds fix

   - interconnect driver updates and additions

   - mhi driver updates and additions

   - w1 driver fixes

   - binder speedups and fixes

   - eeprom driver updates

   - coresight driver updates

   - counter driver update

   - new misc driver additions

   - other minor api updates

  All of these, EXCEPT for the final Kconfig build fix for 32bit
  systems, have been in linux-next for a while with no reported issues.
  The Kconfig fixup went in 29 hours ago, so might have missed the
  latest linux-next, but was acked by everyone involved"

* tag 'char-misc-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (330 commits)
  misc: Kconfig: exclude mrvl-cn10k-dpi compilation for 32-bit systems
  misc: delete Makefile.rej
  binder: fix hang of unregistered readers
  misc: Kconfig: add a new dependency for MARVELL_CN10K_DPI
  virtio: add missing MODULE_DESCRIPTION() macro
  agp: uninorth: add missing MODULE_DESCRIPTION() macro
  spmi: add missing MODULE_DESCRIPTION() macros
  dev/parport: fix the array out-of-bounds risk
  samples: configfs: add missing MODULE_DESCRIPTION() macro
  misc: mrvl-cn10k-dpi: add Octeon CN10K DPI administrative driver
  misc: keba: Fix missing AUXILIARY_BUS dependency
  slimbus: Fix struct and documentation alignment in stream.c
  MAINTAINERS: CC dri-devel list on Qualcomm FastRPC patches
  misc: fastrpc: use coherent pool for untranslated Compute Banks
  misc: fastrpc: support complete DMA pool access to the DSP
  misc: fastrpc: add missing MODULE_DESCRIPTION() macro
  misc: fastrpc: Add missing dev_err newlines
  misc: fastrpc: Use memdup_user()
  nvmem: core: Implement force_ro sysfs attribute
  nvmem: Use sysfs_emit() for type attribute
  ...

Pull staging driver updates from Greg KH:
 "This is the "big" staging driver update for 6.11-rc1. Not really all
  that much happened this release cycle, just lots of tiny cleanups,
  overall about 3000 lines removed, so the cleanups were worth it.

  Included in here are:

   - loads of rtl8723bs driver cleanups

   - lots of rtl8192e driver cleanups

   - vc04_services reworks and cleanups as that codebase gets slowly
     evolved into something that will make it into the "real" part of
     the kernel hopefully soon.

   - other tiny staging driver cleanups

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (124 commits)
  staging: rtl8723bs: Remove constant result function CheckNegative()
  staging: rtl8723bs: Remove unused macros in rtw_mlme_ext.h
  staging: rtl8723bs: Remove unused macros in hal_pwr_seq.h
  staging: rtl8723bs: Remove unused macros in rtw_efuse.h
  staging: rtl8723bs: Remove unused macros in rtw_mlme.h
  staging: rtl8723bs: Remove unused macros in HalPwrSeqCmd.h
  staging: rtl8723bs: Remove unused macros in Hal8723BReg.h
  staging: rtl8723bs: Remove unused macros in Hal8192CPhyReg.h
  staging: rtl8723bs: Delete file hal_phy_reg_8723b.h
  staging: rtl8723bs: Move last macro from hal_phy_reg_8723b.h
  staging: rtl8723bs: Remove unused macros in hal_phy_reg_8723b.h
  staging: rtl8723bs: Remove unused macros in hal_com_reg.h
  staging: rtl8723bs: Remove unused macros in rtw_ht.h
  staging: rtl8723bs: Remove unused macros in hal_com_h2c.h
  staging: vc04_services: vchiq_core: Stop kthreads on vchiq module unload
  staging: vchiq_core: Bubble up wait_event_interruptible() return value
  staging: nvec: Use x instead of x != NULL to improve readability.
  staging: rtl8192e: Fix conflicting types error with net_device.
  staging: rtl8723bs: Remove unused variable pwdev_priv
  staging: vc04_services: Update testing instructions
  ...

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 6.11-rc1.

  Nothing earth-shattering in here, just constant forward progress in
  adding support for new hardware and better debugging functionalities
  for thunderbolt devices and the subsystem. Included in here are:

   - thunderbolt debugging update and driver additions

   - xhci driver updates

   - typec driver updates

   - kselftest device driver changes (acked by the relevant maintainers,
     depended on other changes in this tree.)

   - cdns3 driver updates

   - gadget driver updates

   - MODULE_DESCRIPTION() additions

   - dwc3 driver updates and fixes

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (112 commits)
  kselftest: devices: Add test to detect device error logs
  kselftest: Move ksft helper module to common directory
  kselftest: devices: Move discoverable devices test to subdirectory
  usb: gadget: f_uac2: fix non-newline-terminated function name
  USB: uas: Implement the new shutdown callback
  USB: core: add 'shutdown' callback to usb_driver
  usb: typec: Drop explicit initialization of struct i2c_device_id::driver_data to 0
  usb: dwc3: enable CCI support for AMD-xilinx DWC3 controller
  usb: dwc2: add support for other Lantiq SoCs
  usb: gadget: Use u16 types for 16-bit fields
  usb: gadget: midi2: Fix incorrect default MIDI2 protocol setup
  usb: dwc3: core: Check all ports when set phy suspend
  usb: typec: tcpci: add support to set connector orientation
  dt-bindings: usb: Convert fsl-usb to yaml
  usb: typec: ucsi: reorder operations in ucsi_run_command()
  usb: typec: ucsi: extract common code for command handling
  usb: typec: ucsi: inline ucsi_read_message_in
  usb: typec: ucsi: rework command execution functions
  usb: typec: ucsi: split read operation
  usb: typec: ucsi: simplify command sending API
  ...

Pull tty / serial updates from Greg KH:
 "Here is a small set of tty and serial driver updates for 6.11-rc1. Not
  much happened this cycle, unlike the previous kernel release which had
  lots of "excitement" in this part of the kernel. Included in here are
  the following changes:

   - dt binding updates for new platforms

   - 8250 driver updates

   - various small serial driver fixes and updates

   - printk/console naming and matching attempt #2 (was reverted for
     6.10-final, should be good to go this time around, acked by the
     relevant maintainers).

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (22 commits)
  Documentation: kernel-parameters: Add DEVNAME:0.0 format for serial ports
  serial: core: Add serial_base_match_and_update_preferred_console()
  printk: Add match_devname_and_update_preferred_console()
  serial: sc16is7xx: hardware reset chip if reset-gpios is defined in DT
  dt-bindings: serial: sc16is7xx: add reset-gpios
  dt-bindings: serial: vt8500-uart: convert to json-schema
  serial: 8250_platform: Explicitly show we initialise ISA ports only once
  tty: add missing MODULE_DESCRIPTION() macros
  dt-bindings: serial: mediatek,uart: add MT7988
  serial: sh-sci: Add support for RZ/V2H(P) SoC
  dt-bindings: serial: Add documentation for Renesas RZ/V2H(P) (R9A09G057) SCIF support
  dt-bindings: serial: renesas,scif: Make 'interrupt-names' property as required
  dt-bindings: serial: renesas,scif: Validate 'interrupts' and 'interrupt-names'
  dt-bindings: serial: renesas,scif: Move ref for serial.yaml at the end
  riscv: dts: starfive: jh7110: Add the core reset and jh7110 compatible for uarts
  serial: 8250_dw: Use reset array API to get resets
  dt-bindings: serial: snps-dw-apb-uart: Add one more reset signal for StarFive JH7110 SoC
  serial: 8250: Extract platform driver
  serial: 8250: Extract RSA bits
  serial: imx: stop casting struct uart_port to struct imx_port
  ...

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Notably this includes fixes for a s390 build breakage.

  Current release - new code bugs:

   - eth: fbnic: fix s390 build

   - eth: airoha: fix NULL pointer dereference in
     airoha_qdma_cleanup_rx_queue()

  Previous releases - regressions:

   - flow_dissector: use DEBUG_NET_WARN_ON_ONCE

   - ipv4: fix incorrect TOS in route get reply

   - dsa: fix chip-wide frame size config in some drivers

  Previous releases - always broken:

   - netfilter: nf_set_pipapo: fix initial map fill

   - eth: gve: fix XDP TX completion handling when counters overflow"

* tag 'net-6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net:
  eth: fbnic: don't build the driver when skb has more than 21 frags
  net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
  net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
  net: airoha: Fix NULL pointer dereference in airoha_qdma_cleanup_rx_queue()
  net: wwan: t7xx: add support for Dell DW5933e
  ipv4: Fix incorrect TOS in fibmatch route get reply
  ipv4: Fix incorrect TOS in route get reply
  net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE
  driver core: auxiliary bus: Fix documentation of auxiliary_device
  net: airoha: fix error branch in airoha_dev_xmit and airoha_set_gdm_ports
  gve: Fix XDP TX completion handling when counters overflow
  ipvs: properly dereference pe in ip_vs_add_service
  selftests: netfilter: add test case for recent mismatch bug
  netfilter: nf_set_pipapo: fix initial map fill
  netfilter: ctnetlink: use helper function to calculate expect ID
  eth: fbnic: fix s390 build.

Pull btrfs fix from David Sterba:
 "A fix for build breakage on 32bit platforms"

* tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: change BTRFS_MOUNT_* flags to 64bit type

Merge tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull uprobe fix from Masami Hiramatsu:

 - Add sys_uretprobe entry to scripts/syscall.tbl.

* tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  syscalls: Fix to add sys_uretprobe to syscall.tbl

Pull power sequencing fixes from Bartosz Golaszewski:
 "There's one fix for an invalid pointer dereference in error path
  reported by smatch and two patches that address the noisy config
  choices you reported earlier this week.

  Summary:

   - fix an invalid pointer dereference in error path in pwrseq core

   - reduce the Kconfig noise from PCI pwrctl choices"

* tag 'pwrseq-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  arm64: qcom: don't select HAVE_PWRCTL when PCI=n
  Kconfig: reduce the amount of power sequencing noise
  power: sequencing: fix an invalid pointer dereference in error path

Pull sound updates from Takashi Iwai:
 "Lots of changes in this cycle, but mostly for cleanups and
  refactoring.

  Significant amount of changes are about DT schema conversions for ASoC
  at this time while we see other usual suspects, too.

  Some highlights below:

  Core:
   - Re-introduction of PCM sync ID support API
   - MIDI2 time-base extension in ALSA sequencer API

  ASoC:
   - Syncing of features between simple-audio-card and the two
     audio-graph cards
   - Support for specifying the order of operations for components
     within cards to allow quirking for unusual systems
   - Lots of DT schema conversions
   - Continued SOF/Intel updates for topology, SoundWire, IPC3/4
   - New support for Asahi Kasei AK4619, Cirrus Logic CS530x, Everest
     Semiconductors ES8311, NXP i.MX95 and LPC32xx, Qualcomm LPASS v2.5
     and WCD937x, Realtek RT1318 and RT1320 and Texas Instruments
     PCM5242

  HD-audio:
   - More quirks, Intel PantherLake support, senarytech codec support
   - Refactoring of Cirrus codec component-binding

  Others:
   - ALSA control kselftest improvements, and fixes for input value
     checks in various drivers"

* tag 'sound-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (349 commits)
  kselftest/alsa: Log the PCM ID in pcm-test
  kselftest/alsa: Use card name rather than number in test names
  ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360
  ALSA: hda/tas2781: Add new quirk for Lenovo Hera2 Laptop
  ALSA: seq: ump: Skip useless ports for static blocks
  ALSA: pcm_dmaengine: Don't synchronize DMA channel when DMA is paused
  ALSA: usb: Use BIT() for bit values
  ALSA: usb: Fix UBSAN warning in parse_audio_unit()
  ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
  ASoC: tas2781: Add new Kontrol to set tas2563 digital Volume
  ASoC: codecs: wcd937x: Remove separate handling for vdd-buck supply
  ASoC: codecs: wcd937x: Remove the string compare in MIC BIAS widget settings
  ASoC: codecs: wcd937x-sdw: Fix Unbalanced pm_runtime_enable
  ASoC: dt-bindings: cirrus,cs42xx8: Convert to dtschema
  ASoC: cs530x: Remove bclk from private structure
  ASoC: cs530x: Calculate proper bclk rate using TDM
  ASoC: dt-bindings: cirrus,cs4270: Convert to dtschema
  firmware: cs_dsp: Rename fw_ver to wmfw_ver
  firmware: cs_dsp: Clarify wmfw format version log message
  firmware: cs_dsp: Make wmfw and bin filename arguments const char *
  ...

Pull clk updates from Stephen Boyd:
 "This a large collection of clk driver updates and a handful of new SoC
  clk driver support.

  We have the usual Qualcomm clk drivers, along with clk drivers for the
  Sophgo and T-Head vendors, all to support some new SoCs.

  Nothing in particular stands out to me in the updates. There's the
  interconnect clk driver which exposes clks as interconnects, crossing
  subsystems. There's a bunch of janitorial things that are improving
  drivers in general like kmemdup_array() or fixing error paths. But
  overall the updates look normal to fix the description data which is
  usually the stuff that's wrong and/or untested.

  Core:
   - Skip gate basic type KUnit tests on s390 due to lack of MMIO
     emulation

  New Drivers:
   - AP sub-system clock controller in the T-Head TH1520
   - Sophgo Sophon sg2042 clk driver
   - Qualcomm SM7150 camera, display and video clk drivers
   - Qualcomm QCM2290 GPU clk driver
   - Qualcomm QCS8386/QCS8084 NSS clk driver
   - Qualcomm SM8650 camera and video drivers

  Updates:
   - Add reset support to Airoha EN7581 clk driver
   - Add MODULE_DESCRIPTIONs to various clk drivers
   - Introduce helper logic to expose clock controllers as simple
     interconnect providers
   - Use the interconnect helper above on Qualcomm ipq9574
   - Add CLK_SET_RATE_PARENT to the remaining USB pipe clocks on
     Qualcomm X1Elite
   - Improve error handling in Qualcomm kpss-xcc driver
   - Mark Qualcomm SC8280XP LPASS clock controller regmap_config const
   - Export more clocks for Rockchip rk3128 peripherals
   - Convert Rockchip clk drivers to use kmemdup_array()
   - Drop CLK_NR_CLKS from Rockchip rk3128 and rk3188 binding headers
   - Make qcom_cc_really_probe() take a struct device to allow reuse in
     non-platform-drivers
   - Introduce prepare-only branch clock ops in the qcom clk driver to
     support clocks on buses that take locks
   - Describe parent/child relationship for Qualcomm SC7280 camera GDSCs
   - Support Qualcomm Huayra 2290 alpha PLL
   - Adjust the highest SDCC clock frequency on Qualcomm IPQ6018 to
     match HS200 support
   - Add missing PCIe PIPE clocks on Qualcomm IPQ9574
   - Fix various configurations and properties in the Qualcomm SA8775P,
     X1E80100 and SM7280 drivers
   - Park Qualcomm SM8350 GPU RCGs on XO while disabled
   - Remove unused CONFIG_QCOM_RPMCC Kconfig symbol
   - exynos-clkout: Remove usage of of_device_id table as
     .of_match_table, because the driver is instantiated as MFD cell,
     not as standalone platform driver. Populated .of_match_table
     confused people few times to convert the code to
     device_get_match_data(), which broke the driver
   - Mark one Samsung UFS clock as critical, because having it off stops
     the system from shutdown
   - Use kmemdup_array() when applicable
   - Remove unused 'struct gates_data' from old sunxi driver library
   - Add GPADC clock and reset for Allwinner H616
   - Minor Amlogic S4 clock fixes
   - DT bindings Yaml conversion of the Amlogic AXG audio controller
   - Amlogic C3 clock controllers support
   - Amlogic clk flag added to skip init of already enabled PLLs and
     avoid relocking
   - Amlogic A1 DT bindings updates for system pll support
   - Add missing MODULE_DESCRIPTION where necessary
   - Remove obsolete clock DT binding header files
   - Add Battery Backup (VBATTB) and I2C clocks, resets, and power
     domains on Renesas RZ/G3S
   - Add audio clocks on Renesas R-Car V4M
   - Add video capture (ISPCS, CSI-2, VIN) clocks on Renesas R-Car V4M"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (135 commits)
  clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks
  dt-bindings: clock: Document T-Head TH1520 AP_SUBSYS controller
  clk: sophgo: Avoid -Wsometimes-uninitialized in sg2042_clk_pll_set_rate()
  clk/sophgo: Using BUG() instead of unreachable() in mmux_get_parent_id()
  clk: mxs: Use clamp() in clk_ref_round_rate() and clk_ref_set_rate()
  clk: sunxi-ng r40: Constify struct regmap_config
  clk: en7523: fix rate divider for slic and spi clocks
  clk: lpc32xx: Constify struct regmap_config
  clk: xilinx: Constify struct regmap_config
  clk: en7523: Remove PCIe reset open drain configuration for EN7581
  clk: en7523: Remove pcie prepare/unpreare callbacks for EN7581 SoC
  clk: en7523: Add reset-controller support for EN7581 SoC
  dt-bindings: clock: airoha: Add reset support to EN7581 clock binding
  dt-bindings: clock: mediatek: Document reset cells for MT8188 sys
  clk: mediatek: mt8173-infracfg: Handle unallocated infracfg when module
  dt-bindings: clock: mediatek: add syscon compatible for mt7622 pciesys
  dt-bindings: clock: sprd,sc9860-clk: convert to YAML
  dt-bindings: clock: qoriq-clock: convert to yaml format
  clk: qcom: Park shared RCGs upon registration
  clk: qcom: ipq9574: Use icc-clk for enabling NoC related clocks
  ...

Pull virtio updates from Michael Tsirkin:
 "Several new features here:

   - Virtio find vqs API has been reworked (required to fix the
     scalability issue we have with adminq, which I hope to merge later
     in the cycle)

   - vDPA driver for Marvell OCTEON

   - virtio fs performance improvement

   - mlx5 migration speedups

  Fixes, cleanups all over the place"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (56 commits)
  virtio: rename virtio_find_vqs_info() to virtio_find_vqs()
  virtio: remove unused virtio_find_vqs() and virtio_find_vqs_ctx() helpers
  virtio: convert the rest virtio_find_vqs() users to virtio_find_vqs_info()
  virtio_balloon: convert to use virtio_find_vqs_info()
  virtiofs: convert to use virtio_find_vqs_info()
  scsi: virtio_scsi: convert to use virtio_find_vqs_info()
  virtio_net: convert to use virtio_find_vqs_info()
  virtio_crypto: convert to use virtio_find_vqs_info()
  virtio_console: convert to use virtio_find_vqs_info()
  virtio_blk: convert to use virtio_find_vqs_info()
  virtio: rename find_vqs_info() op to find_vqs()
  virtio: remove the original find_vqs() op
  virtio: call virtio_find_vqs_info() from virtio_find_single_vq() directly
  virtio: convert find_vqs() op implementations to find_vqs_info()
  virtio_pci: convert vp_*find_vqs() ops to find_vqs_info()
  virtio: introduce virtio_queue_info struct and find_vqs_info() config op
  virtio: make virtio_find_single_vq() call virtio_find_vqs()
  virtio: make virtio_find_vqs() call virtio_find_vqs_ctx()
  caif_virtio: use virtio_find_single_vq() for single virtqueue finding
  vdpa/mlx5: Don't enable non-active VQs in .set_vq_ready()
  ...

Pull VFIO updates from Alex Williamson:

 - Add support for 8-byte accesses when using read/write through the
   device regions.  This fills a gap for userspace drivers that might
   not be able to use access through mmap to perform native register
   width accesses (Gerd Bayer)

 - Add missing MODULE_DESCRIPTION to vfio-mdev sample drivers and
   replace a non-standard MODULE_INFO usage (Jeff Johnson)

* tag 'vfio-v6.11-rc1' of https://github.com/awilliam/linux-vfio:
  vfio-mdev: add missing MODULE_DESCRIPTION() macros
  vfio/pci: Fix typo in macro to declare accessors
  vfio/pci: Support 8-byte PCI loads and stores
  vfio/pci: Extract duplicated code into macro