Pull pcmcia updates from Dominik Brodowski:
 "A few odd cleanups and fixes, including a Kconfig fix to add a
  required dependency on MIPS"

* 'pcmcia-next' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux:
  pcmcia: Use platform_get_irq() to get the interrupt
  pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
  drivers/pcmcia: Fix typo in comment

Pull NFS client updates from Anna Schumaker:
 "New Features:
   - Add support for 'dacl' and 'sacl' attributes

  Bugfixes and Cleanups:
   - Fixes for reporting mapping errors
   - Fixes for memory allocation errors
   - Improve warning message when locks are lost
   - Update documentation for the nfs4_unique_id parameter
   - Add an explanation of NFSv4 client identifiers
   - Ensure the i_size attribute is written to the fscache storage
   - Fix freeing uninitialized nfs4_labels
   - Better handling when xprtrdma bc_serv is NULL
   - Mark qualified async operations as MOVEABLE tasks"

* tag 'nfs-for-5.19-1' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  NFSv4.1 mark qualified async operations as MOVEABLE tasks
  xprtrdma: treat all calls not a bcall when bc_serv is NULL
  NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
  NFS: Pass i_size to fscache_unuse_cookie() when a file is released
  Documentation: Add an explanation of NFSv4 client identifiers
  NFS: update documentation for the nfs4_unique_id parameter
  NFS: Improve warning message when locks are lost.
  NFSv4.1: Enable access to the NFSv4.1 'dacl' and 'sacl' attributes
  NFSv4: Add encoders/decoders for the NFSv4.1 dacl and sacl attributes
  NFSv4: Specify the type of ACL to cache
  NFSv4: Don't hold the layoutget locks across multiple RPC calls
  pNFS/files: Fall back to I/O through the MDS on non-fatal layout errors
  NFS: Further fixes to the writeback error handling
  NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout
  NFS: Memory allocation failures are not server fatal errors
  NFS: Don't report errors from nfs_pageio_complete() more than once
  NFS: Do not report flush errors in nfs_write_end()
  NFS: Don't report ENOSPC write errors twice
  NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS
  NFS: Do not report EINTR/ERESTARTSYS as mapping errors

Pull f2fs updates from Jaegeuk Kim:
 "In this round, we've refactored the existing atomic write support
  implemented by in-memory operations to have storing data in disk
  temporarily, which can give us a benefit to accept more atomic writes.

  At the same time, we removed the existing volatile write support.

  We've also revisited the file pinning and GC flows and found some
  corner cases which contributeed abnormal system behaviours.

  As usual, there're several minor code refactoring for readability,
  sanity check, and clean ups.

  Enhancements:

   - allow compression for mmap files in compress_mode=user

   - kill volatile write support

   - change the current atomic write way

   - give priority to select unpinned section for foreground GC

   - introduce data read/write showing path info

   - remove unnecessary f2fs_lock_op in f2fs_new_inode

  Bug fixes:

   - fix the file pinning flow during checkpoint=disable and GCs

   - fix foreground and background GCs to select the right victims and
     get free sections on time

   - fix GC flags on defragmenting pages

   - avoid an infinite loop to flush node pages

   - fix fallocate to use file_modified to update permissions
     consistently"

* tag 'f2fs-for-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (40 commits)
  f2fs: fix to tag gcing flag on page during file defragment
  f2fs: replace F2FS_I(inode) and sbi by the local variable
  f2fs: add f2fs_init_write_merge_io function
  f2fs: avoid unneeded error handling for revoke_entry_slab allocation
  f2fs: allow compression for mmap files in compress_mode=user
  f2fs: fix typo in comment
  f2fs: make f2fs_read_inline_data() more readable
  f2fs: fix to do sanity check for inline inode
  f2fs: fix fallocate to use file_modified to update permissions consistently
  f2fs: don't use casefolded comparison for "." and ".."
  f2fs: do not stop GC when requiring a free section
  f2fs: keep wait_ms if EAGAIN happens
  f2fs: introduce f2fs_gc_control to consolidate f2fs_gc parameters
  f2fs: reject test_dummy_encryption when !CONFIG_FS_ENCRYPTION
  f2fs: kill volatile write support
  f2fs: change the current atomic write way
  f2fs: don't need inode lock for system hidden quota
  f2fs: stop allocating pinned sections if EAGAIN happens
  f2fs: skip GC if possible when checkpoint disabling
  f2fs: give priority to select unpinned section for foreground GC
  ...

Pull LED updates from Pavel Machek:
 "Most significant here is the driver for Qualcomm LPG. Apparently it
  drives backlight on some boards, so it is quite important for some
  people"

* tag 'leds-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds:
  leds: qcom-lpg: Require pattern to follow documentation
  leds: lp50xx: Remove duplicated error reporting in .remove()
  leds: qcom-lpg: add missing PWM dependency
  leds: ktd2692: Make aux-gpios optional
  dt-bindings: leds: convert ktd2692 bindings to yaml
  leds: ktd2692: Avoid duplicate error messages on probe deferral
  leds: is31fl32xx: Improve error reporting in .remove()
  leds: Move pwm-multicolor driver into rgb directory
  leds: Add PWM multicolor driver
  dt-bindings: leds: Add multicolor PWM LED bindings
  dt-bindings: leds: Optional multi-led unit address
  leds: regulator: Make probeable from device tree
  leds: regulator: Add dev helper variable
  dt-bindings: leds: Add regulator-led binding
  leds: pca9532: Make pca9532_destroy_devices() return void
  leds: Add pm8350c support to Qualcomm LPG driver
  dt-bindings: leds: Add pm8350c pmic support
  leds: Add driver for Qualcomm LPG
  dt-bindings: leds: Add Qualcomm Light Pulse Generator binding

Pull i2c updates from Wolfram Sang:
 "Only driver updates for 5.19.

  Bigger changes are for Meson, NPCM, and R-Car, but there are also
  changes all over the place"

* tag 'i2c-for-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (34 commits)
  i2c: meson: fix typo in comment
  i2c: rcar: use flags instead of atomic_xfer
  i2c: rcar: REP_AFTER_RD is not a persistent flag
  i2c: rcar: use BIT macro consistently
  i2c: qcom-geni: remove unnecessary conditions
  i2c: mt7621: Use devm_platform_get_and_ioremap_resource()
  i2c: rcar: refactor handling of first message
  i2c: rcar: avoid race condition with SMIs
  i2c: xiic: Correct the datatype for rx_watermark
  i2c: rcar: fix PM ref counts in probe error paths
  i2c: npcm: Handle spurious interrupts
  i2c: npcm: Correct register access width
  i2c: npcm: Add tx complete counter
  i2c: npcm: Fix timeout calculation
  i2c: npcm: Remove unused variable clk_regmap
  i2c: npcm: Change the way of getting GCR regmap
  i2c: xiic: Fix Tx Interrupt path for grouped messages
  i2c: xiic: Fix coding style issues
  i2c: xiic: return value of xiic_reinit
  i2c: cadence: Increase timeout per message if necessary
  ...

Pull RISC-V updates from Palmer Dabbelt:

 - Support for the Svpbmt extension, which allows memory attributes to
   be encoded in pages

 - Support for the Allwinner D1's implementation of page-based memory
   attributes

 - Support for running rv32 binaries on rv64 systems, via the compat
   subsystem

 - Support for kexec_file()

 - Support for the new generic ticket-based spinlocks, which allows us
   to also move to qrwlock. These should have already gone in through
   the asm-geneic tree as well

 - A handful of cleanups and fixes, include some larger ones around
   atomics and XIP

* tag 'riscv-for-linus-5.19-mw0' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (51 commits)
  RISC-V: Prepare dropping week attribute from arch_kexec_apply_relocations[_add]
  riscv: compat: Using seperated vdso_maps for compat_vdso_info
  RISC-V: Fix the XIP build
  RISC-V: Split out the XIP fixups into their own file
  RISC-V: ignore xipImage
  RISC-V: Avoid empty create_*_mapping definitions
  riscv: Don't output a bogus mmu-type on a no MMU kernel
  riscv: atomic: Add custom conditional atomic operation implementation
  riscv: atomic: Optimize dec_if_positive functions
  riscv: atomic: Cleanup unnecessary definition
  RISC-V: Load purgatory in kexec_file
  RISC-V: Add purgatory
  RISC-V: Support for kexec_file on panic
  RISC-V: Add kexec_file support
  RISC-V: use memcpy for kexec_file mode
  kexec_file: Fix kexec_file.c build error for riscv platform
  riscv: compat: Add COMPAT Kbuild skeletal support
  riscv: compat: ptrace: Add compat_arch_ptrace implement
  riscv: compat: signal: Add rt_frame implementation
  riscv: add memory-type errata for T-Head
  ...

Mark async operations such as RENAME, REMOVE, COMMIT MOVEABLE
for the nfsv4.1+ sessions.

Fixes: 85e39fee ("NFSv4.1 identify and mark RPC tasks that can move between transports")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

When a rdma server returns a fault format reply, nfs v3 client may
treats it as a bcall when bc service is not exist.

The debug message at rpcrdma_bc_receive_call are,

[56579.837169] RPC:       rpcrdma_bc_receive_call: callback XID
00000001, length=20
[56579.837174] RPC:       rpcrdma_bc_receive_call: 00 00 00 01 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 04

After that, rpcrdma_bc_receive_call will meets NULL pointer as,

[  226.057890] BUG: unable to handle kernel NULL pointer dereference at
00000000000000c8
...
[  226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20
...
[  226.059732] Call Trace:
[  226.059878]  rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma]
[  226.060011]  __ib_process_cq+0x89/0x170 [ib_core]
[  226.060092]  ib_cq_poll_work+0x26/0x80 [ib_core]
[  226.060257]  process_one_work+0x1a7/0x360
[  226.060367]  ? create_worker+0x1a0/0x1a0
[  226.060440]  worker_thread+0x30/0x390
[  226.060500]  ? create_worker+0x1a0/0x1a0
[  226.060574]  kthread+0x116/0x130
[  226.060661]  ? kthread_flush_work_fn+0x10/0x10
[  226.060724]  ret_from_fork+0x35/0x40
...
Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

Send along the already-allocated fattr along with nfs4_fs_locations, and
drop the memcpy of fattr.  We end up growing two more allocations, but this
fixes up a crash as:

PID: 790    TASK: ffff88811b43c000  CPU: 0   COMMAND: "ls"
 #0 [ffffc90000857920] panic at ffffffff81b9bfde
 #1 [ffffc900008579c0] do_trap at ffffffff81023a9b
 #2 [ffffc90000857a10] do_error_trap at ffffffff81023b78
 #3 [ffffc90000857a58] exc_stack_segment at ffffffff81be1f45
 #4 [ffffc90000857a80] asm_exc_stack_segment at ffffffff81c009de
 #5 [ffffc90000857b08] nfs_lookup at ffffffffa0302322 [nfs]
 #6 [ffffc90000857b70] __lookup_slow at ffffffff813a4a5f
 #7 [ffffc90000857c60] walk_component at ffffffff813a86c4
 #8 [ffffc90000857cb8] path_lookupat at ffffffff813a9553
 #9 [ffffc90000857cf0] filename_lookup at ffffffff813ab86b
Suggested-by: Trond Myklebust <trondmy@hammerspace.com>
Fixes: 9558a007 ("NFS: Remove the label from the nfs4_lookup_res struct")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

Pull iommu updates from Joerg Roedel:

 - Intel VT-d driver updates:
     - Domain force snooping improvement.
     - Cleanups, no intentional functional changes.

 - ARM SMMU driver updates:
     - Add new Qualcomm device-tree compatible strings
     - Add new Nvidia device-tree compatible string for Tegra234
     - Fix UAF in SMMUv3 shared virtual addressing code
     - Force identity-mapped domains for users of ye olde SMMU legacy
       binding
     - Minor cleanups

 - Fix a BUG_ON in the vfio_iommu_group_notifier:
     - Groundwork for upcoming iommufd framework
     - Introduction of DMA ownership so that an entire IOMMU group is
       either controlled by the kernel or by user-space

 - MT8195 and MT8186 support in the Mediatek IOMMU driver

 - Make forcing of cache-coherent DMA more coherent between IOMMU
   drivers

 - Fixes for thunderbolt device DMA protection

 - Various smaller fixes and cleanups

* tag 'iommu-updates-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (88 commits)
  iommu/amd: Increase timeout waiting for GA log enablement
  iommu/s390: Tolerate repeat attach_dev calls
  iommu/vt-d: Remove hard coding PGSNP bit in PASID entries
  iommu/vt-d: Remove domain_update_iommu_snooping()
  iommu/vt-d: Check domain force_snooping against attached devices
  iommu/vt-d: Block force-snoop domain attaching if no SC support
  iommu/vt-d: Size Page Request Queue to avoid overflow condition
  iommu/vt-d: Fold dmar_insert_one_dev_info() into its caller
  iommu/vt-d: Change return type of dmar_insert_one_dev_info()
  iommu/vt-d: Remove unneeded validity check on dev
  iommu/dma: Explicitly sort PCI DMA windows
  iommu/dma: Fix iova map result check bug
  iommu/mediatek: Fix NULL pointer dereference when printing dev_name
  iommu: iommu_group_claim_dma_owner() must always assign a domain
  iommu/arm-smmu: Force identity domains for legacy binding
  iommu/arm-smmu: Support Tegra234 SMMU
  dt-bindings: arm-smmu: Add compatible for Tegra234 SOC
  dt-bindings: arm-smmu: Document nvidia,memory-controller property
  iommu/arm-smmu-qcom: Add SC8280XP support
  dt-bindings: arm-smmu: Add compatible for Qualcomm SC8280XP
  ...

Pull microblaze updates from Michal Simek:

 - Fix issues with freestanding

 - Wire memblock_dump_all()

 - Add support for memory reservation from DT

* tag 'microblaze-v5.19' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: fix typos in comments
  microblaze: Add support for reserved memory defined by DT
  microblaze: Wire memblock_dump_all()
  microblaze: Use simple memmove/memcpy implementation from lib/string.c
  microblaze: Do loop unrolling for optimized memset implementation
  microblaze: Use simple memset implementation from lib/string.c

Without this change arch/riscv/kernel/elf_kexec.c fails to compile once
commit 233c1e6c319c ("kexec_file: drop weak attribute from
arch_kexec_apply_relocations[_add]") is also contained in the tree.
This currently happens in next-20220527.

Prepare the RISC-V similar to the s390 adaption done in 233c1e6c319c.
This is safe to do on top of the riscv change even without the change to
arch_kexec_apply_relocations.

Fixes: 838b3e28 ("RISC-V: Load purgatory in kexec_file")
Looks-good-to: liaochang (A) <liaochang1@huawei.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>

Pull fbdev fixes and updates from Helge Deller:
 "A buch of small fixes and cleanups, including:

   - vesafb: Fix a use-after-free due early fb_info cleanup

   - clcdfb: Fix refcount leak in clcdfb_of_vram_setup

   - hyperv_fb: Allow resolutions with size > 64 MB for Gen1

   - pxa3xx-gcu: release the resources correctly in
     pxa3xx_gcu_probe/remove()

   - omapfb: Prevent compiler warning regarding
     hwa742_update_window_async()"

* tag 'for-5.19/fbdev-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  video: fbdev: omap: Add prototype for hwa742_update_window_async()
  video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup
  video: fbdev: radeon: Fix spelling typo in comment
  video: fbdev: xen: remove setting of 'transp' parameter
  video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
  video: fbdev: omapfb: simplify the return expression of nec_8048_connect()
  video: fbdev: omapfb: simplify the return expression of dsi_init_pll_data()
  video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup
  video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1

Pull parisc architecture updates from Helge Deller:
 "Minor cleanups and code optimizations, e.g.:

   - improvements in assembly statements in the tmpalias code path

   - added some additionals compile time checks

   - drop some unneccesary assembler DMA syncs"

* tag 'for-5.19/parisc-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Drop __ARCH_WANT_OLD_READDIR and __ARCH_WANT_SYS_OLDUMOUNT
  parisc: Optimize tmpalias function calls
  parisc: Add dep_safe() macro to deposit a register in 32- and 64-kernels
  parisc: Fix wrong comment for shr macro
  parisc: Prevent ldil() to sign-extend into upper 32 bits
  parisc: Don't hardcode assembler bit definitions in tmpalias code
  parisc: Don't enforce DMA completion order in cache flushes
  parisc: video: fbdev: stifb: Add sti_dump_font() to dump STI font

Pull more power management updates from Rafael Wysocki:
 "These update the ARM cpufreq drivers and fix up the CPPC cpufreq
  driver after recent changes, update the OPP code and PM documentation
  and add power sequences support to the system reboot and power off
  code.

  Specifics:

   - Add Tegra234 cpufreq support (Sumit Gupta)

   - Clean up and enhance the Mediatek cpufreq driver (Wan Jiabing,
     Rex-BC Chen, and Jia-Wei Chang)

   - Fix up the CPPC cpufreq driver after recent changes (Zheng Bin,
     Pierre Gondois)

   - Minor update to dt-binding for Qcom's opp-v2-kryo-cpu (Yassine
     Oudjana)

   - Use list iterator only inside the list_for_each_entry loop
     (Xiaomeng Tong, and Jakob Koschel)

   - New APIs related to finding OPP based on interconnect bandwidth
     (Krzysztof Kozlowski)

   - Fix the missing of_node_put() in _bandwidth_supported() (Dan
     Carpenter)

   - Cleanups (Krzysztof Kozlowski, and Viresh Kumar)

   - Add Out of Band mode description to the intel-speed-select utility
     documentation (Srinivas Pandruvada)

   - Add power sequences support to the system reboot and power off code
     and make related platform-specific changes for multiple platforms
     (Dmitry Osipenko, Geert Uytterhoeven)"

* tag 'pm-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (60 commits)
  cpufreq: CPPC: Fix unused-function warning
  cpufreq: CPPC: Fix build error without CONFIG_ACPI_CPPC_CPUFREQ_FIE
  Documentation: admin-guide: PM: Add Out of Band mode
  kernel/reboot: Change registration order of legacy power-off handler
  m68k: virt: Switch to new sys-off handler API
  kernel/reboot: Add devm_register_restart_handler()
  kernel/reboot: Add devm_register_power_off_handler()
  soc/tegra: pmc: Use sys-off handler API to power off Nexus 7 properly
  reboot: Remove pm_power_off_prepare()
  regulator: pfuze100: Use devm_register_sys_off_handler()
  ACPI: power: Switch to sys-off handler API
  memory: emif: Use kernel_can_power_off()
  mips: Use do_kernel_power_off()
  ia64: Use do_kernel_power_off()
  x86: Use do_kernel_power_off()
  sh: Use do_kernel_power_off()
  m68k: Switch to new sys-off handler API
  powerpc: Use do_kernel_power_off()
  xen/x86: Use do_kernel_power_off()
  parisc: Use do_kernel_power_off()
  ...

Pull additional thermal control update from Rafael Wysocki:
 "Add Meteor Lake PCI device ID to the int340x thermal control driver
  (Sumeet Pawnikar)"

* tag 'thermal-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal: int340x: Add Meteor Lake PCI device ID

Pull more ACPI updates from Rafael Wysocki:
 "These add some new device IDs, update a few drivers (processor,
  battery, backlight) and clean up code in a few places.

  Specifics:

   - Add Meteor Lake ACPI IDs for DPTF devices (Sumeet Pawnikar)

   - Rearrange find_child_checks() to simplify code (Rafael Wysocki)

   - Use memremap() to map the UCSI mailbox that is always in main
     memory and drop acpi_release_memory() that has no more users
     (Heikki Krogerus, Dan Carpenter)

   - Make max_cstate/nocst/bm_check_disable processor module parameters
     visible in sysfs (Yajun Deng)

   - Fix typo in the CPPC driver (Julia Lawall)

   - Make the ACPI battery driver show the "not-charging" status by
     default unless "charging" or "full" is directly indicated (Werner
     Sembach)

   - Improve the PM notifier in the ACPI backlight driver (Zhang Rui)

   - Clean up some white space in the ACPI code (Ian Cowan)"

* tag 'acpi-5.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe
  ACPI: DPTF: Support Meteor Lake
  ACPI: CPPC: fix typo in comment
  ACPI: video: improve PM notifer callback
  ACPI: clean up white space in a few places for consistency
  ACPI: glue: Rearrange find_child_checks()
  ACPI: processor: idle: Expose max_cstate/nocst/bm_check_disable read-only in sysfs
  ACPI: battery: Make "not-charging" the default on no charging or full info
  ACPI: OSL: Remove the helper for deactivating memory region
  usb: typec: ucsi: acpi: Map the mailbox with memremap()

Pull overlayfs updates from Miklos Szeredi:

 - Support idmapped layers in overlayfs (Christian Brauner)

 - Add a fix to exportfs that is relevant to open_by_handle_at(2) as
   well

 - Introduce new lookup helpers that allow passing mnt_userns into
   inode_permission()

* tag 'ovl-update-5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
  ovl: support idmapped layers
  ovl: handle idmappings in ovl_xattr_{g,s}et()
  ovl: handle idmappings in layer open helpers
  ovl: handle idmappings in ovl_permission()
  ovl: use ovl_copy_{real,upper}attr() wrappers
  ovl: store lower path in ovl_inode
  ovl: handle idmappings for layer lookup
  ovl: handle idmappings for layer fileattrs
  ovl: use ovl_path_getxattr() wrapper
  ovl: use ovl_lookup_upper() wrapper
  ovl: use ovl_do_notify_change() wrapper
  ovl: pass layer mnt to ovl_open_realfile()
  ovl: pass ofs to setattr operations
  ovl: handle idmappings in creation operations
  ovl: add ovl_upper_mnt_userns() wrapper
  ovl: pass ofs to creation operations
  ovl: use wrappers to all vfs_*xattr() calls
  exportfs: support idmapped mounts
  fs: add two trivial lookup helpers

Pull MIPS updates from Thomas Bogendoerfer:
 "Cleanups and fixes"

* tag 'mips_5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (38 commits)
  MIPS: RALINK: Define pci_remap_iospace under CONFIG_PCI_DRIVERS_GENERIC
  MIPS: Use memblock_add_node() in early_parse_mem() under CONFIG_NUMA
  MIPS: Return -EINVAL if mem parameter is empty in early_parse_mem()
  MIPS: Kconfig: Fix indentation and add endif comment
  MIPS: bmips: Fix compiler warning observed on W=1 build
  MIPS: Rewrite `csum_tcpudp_nofold' in plain C
  mips: setup: use strscpy to replace strlcpy
  MIPS: Octeon: add SNIC10E board
  MIPS: Ingenic: Refresh defconfig for CU1000-Neo and CU1830-Neo.
  MIPS: Ingenic: Refresh device tree for Ingenic SoCs and boards.
  MIPS: Ingenic: Add PWM nodes for X1830.
  MIPS: Octeon: fix typo in comment
  MIPS: loongson32: Kconfig: Remove extra space
  MIPS: Sibyte: remove unnecessary return variable
  MIPS: Use NOKPROBE_SYMBOL() instead of __kprobes annotation
  selftests/ftrace: Save kprobe_events to test log
  MIPS: tools: no need to initialise statics to 0
  MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon
  MIPS: VR41xx: Drop redundant spinlock initialization
  MIPS: smp: optimization for flush_tlb_mm when exiting
  ...

Pull m68knommu updates from Greg Ungerer:
 "A collection of changes to add elf-fdpic loader support for m68k.

  Also a collection of various fixes. They include typo corrections,
  undefined symbol compilation fixes, removal of the ISA_DMA_API support
  and removal of unused code.

  Summary:

   - correctly set up ZERO_PAGE pointer

   - drop ISA_DMA_API support

   - fix comment typos

   - fixes for undefined symbols

   - remove unused code and variables

   - elf-fdpic loader support for m68k"

* tag 'm68knommu-for-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68knommu: fix 68000 CPU link with no platform selected
  m68k: removed unused "mach_get_ss"
  m68knommu: fix undefined reference to `mach_get_rtc_pll'
  m68knommu: fix undefined reference to `_init_sp'
  m68knommu: allow elf_fdpic loader to be selected
  m68knommu: add definitions to support elf_fdpic program loader
  m68knommu: implement minimal regset support
  m68knommu: use asm-generic/mmu.h for nommu setups
  m68k: fix typos in comments
  m68k: coldfire: drop ISA_DMA_API support
  m68knommu: set ZERO_PAGE() to the allocated zeroed page

Merge ACPI battery and backlight driver update and miscellaneous
cleanup for 5.19-rc1:

 - Make the ACPI battery driver show the "not-charging" status by
   default unless "charging" or "full" is directly indicated (Werner
   Sembach).

 - Improve the PM notifier in the ACPI backlight driver (Zhang Rui).

 - Clean up some white space in the ACPI code (Ian Cowan).

* acpi-battery:
  ACPI: battery: Make "not-charging" the default on no charging or full info

* acpi-video:
  ACPI: video: improve PM notifer callback

* acpi-misc:
  ACPI: clean up white space in a few places for consistency

Merge general ACPI cleanups and processor support updates for 5.19-rc1:

 - Rearrange find_child_checks() to simplify code (Rafael Wysocki).

 - Use memremap() to map the UCSI mailbox that is always in main memory
   and drop acpi_release_memory() that has no more users (Heikki
   Krogerus, Dan Carpenter).

 - Make max_cstate/nocst/bm_check_disable processor module parameters
   visible in sysfs (Yajun Deng).

 - Fix typo in the CPPC driver (Julia Lawall).

* acpi-glue:
  ACPI: glue: Rearrange find_child_checks()

* acpi-osl:
  usb: typec: ucsi: acpi: fix a NULL vs IS_ERR() check in probe
  ACPI: OSL: Remove the helper for deactivating memory region
  usb: typec: ucsi: acpi: Map the mailbox with memremap()

* acpi-processor:
  ACPI: processor: idle: Expose max_cstate/nocst/bm_check_disable read-only in sysfs

* acpi-cppc:
  ACPI: CPPC: fix typo in comment

The devm_memremap() function never returns NULL.  It returns error
pointers.

Fixes: cdc3d2ab ("usb: typec: ucsi: acpi: Map the mailbox with memremap()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Those old syscalls aren't exported via our syscall table, so just drop
them.
Signed-off-by: Helge Deller <deller@gmx.de>

Merge system power off handling rework from Dmitry Osipenko for
5.19-rc1.

This introduces a mechanism allowing power sequences to be used for
powering off the system and makes related changes in platform-specific
code for multiple platforms.

* pm-sysoff: (29 commits)
  kernel/reboot: Change registration order of legacy power-off handler
  m68k: virt: Switch to new sys-off handler API
  kernel/reboot: Add devm_register_restart_handler()
  kernel/reboot: Add devm_register_power_off_handler()
  soc/tegra: pmc: Use sys-off handler API to power off Nexus 7 properly
  reboot: Remove pm_power_off_prepare()
  regulator: pfuze100: Use devm_register_sys_off_handler()
  ACPI: power: Switch to sys-off handler API
  memory: emif: Use kernel_can_power_off()
  mips: Use do_kernel_power_off()
  ia64: Use do_kernel_power_off()
  x86: Use do_kernel_power_off()
  sh: Use do_kernel_power_off()
  m68k: Switch to new sys-off handler API
  powerpc: Use do_kernel_power_off()
  xen/x86: Use do_kernel_power_off()
  parisc: Use do_kernel_power_off()
  arm64: Use do_kernel_power_off()
  riscv: Use do_kernel_power_off()
  csky: Use do_kernel_power_off()
  ...

Merge PM documentation update for 5.19-rc1.

* pm-docs:
  Documentation: admin-guide: PM: Add Out of Band mode

Merge OPP (Operating Performance Points) changes for 5.19-rc1:

 - Minor update to dt-binding for Qcom's opp-v2-kryo-cpu (Yassine
   Oudjana).

 - Use list iterator only inside the list_for_each_entry loop (Xiaomeng
   Tong, and Jakob Koschel).

 - New APIs related to finding OPP based on interconnect bandwidth
   (Krzysztof Kozlowski).

 - Fix the missing of_node_put() in _bandwidth_supported() (Dan
   Carpenter).

 - Cleanups (Krzysztof Kozlowski, and Viresh Kumar).

* pm-opp:
  opp: Reorder definition of ceil/floor helpers
  opp: Add apis to retrieve opps with interconnect bandwidth
  dt-bindings: opp: opp-v2-kryo-cpu: Remove SMEM
  opp: use list iterator only inside the loop
  opp: replace usage of found with dedicated list iterator variable
  PM: opp: simplify with dev_err_probe()
  OPP: call of_node_put() on error path in _bandwidth_supported()

Building the cppc_cpufreq driver with for arm64 with
CONFIG_ENERGY_MODEL=n triggers the following warnings:
 drivers/cpufreq/cppc_cpufreq.c:550:12: error: ‘cppc_get_cpu_cost’ defined but not used
[-Werror=unused-function]
   550 | static int cppc_get_cpu_cost(struct device *cpu_dev, unsigned long KHz,
       |            ^~~~~~~~~~~~~~~~~
 drivers/cpufreq/cppc_cpufreq.c:481:12: error: ‘cppc_get_cpu_power’ defined but not used
[-Werror=unused-function]
   481 | static int cppc_get_cpu_power(struct device *cpu_dev,
       |            ^~~~~~~~~~~~~~~~~~

Move the Energy Model related functions into specific guards.
This allows to fix the warning and prevent doing extra work
when the Energy Model is not present.

Fixes: 740fcdc2 ("cpufreq: CPPC: Register EM based on efficiency class information")
Reported-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
Tested-by: Shaokun Zhang <zhangshaokun@hisilicon.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

If CONFIG_ACPI_CPPC_CPUFREQ_FIE is not set, building fails:

drivers/cpufreq/cppc_cpufreq.c: In function ‘populate_efficiency_class’:
drivers/cpufreq/cppc_cpufreq.c:584:2: error: ‘cppc_cpufreq_driver’ undeclared (first use in this function); did you mean ‘cpufreq_driver’?
  cppc_cpufreq_driver.register_em = cppc_cpufreq_register_em;
  ^~~~~~~~~~~~~~~~~~~
  cpufreq_driver

Make declare of cppc_cpufreq_driver out of CONFIG_ACPI_CPPC_CPUFREQ_FIE
to fix this.

Fixes: 740fcdc2 ("cpufreq: CPPC: Register EM based on efficiency class information")
Signed-off-by: Zheng Bin <zhengbin13@huawei.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Pull dmaengine updates from Vinod Koul:
 "Nothing special, this includes a couple of new device support and new
  driver support and bunch of driver updates.

  New support:

   - Tegra gpcdma driver support

   - Qualcomm SM8350, Sm8450 and SC7280 device support

   - Renesas RZN1 dma and platform support

  Updates:

   - stm32 device pause/resume support and updates

   - DMA memset ops Documentation and usage clarification

   - deprecate '#dma-channels' & '#dma-requests' bindings

   - driver updates for stm32, ptdma idsx etc"

* tag 'dmaengine-5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (87 commits)
  dmaengine: idxd: make idxd_wq_enable() return 0 if wq is already enabled
  dmaengine: sun6i: Add support for the D1 variant
  dmaengine: sun6i: Add support for 34-bit physical addresses
  dmaengine: sun6i: Do not use virt_to_phys
  dt-bindings: dma: sun50i-a64: Add compatible for D1
  dmaengine: tegra: Remove unused switch case
  dmaengine: tegra: Fix uninitialized variable usage
  dmaengine: stm32-dma: add device_pause/device_resume support
  dmaengine: stm32-dma: rename pm ops before dma pause/resume introduction
  dmaengine: stm32-dma: pass DMA_SxSCR value to stm32_dma_handle_chan_done()
  dmaengine: stm32-dma: introduce stm32_dma_sg_inc to manage chan->next_sg
  dmaengine: stm32-dmamux: avoid reset of dmamux if used by coprocessor
  dmaengine: qcom: gpi: Add support for sc7280
  dt-bindings: dma: pl330: Add power-domains
  dmaengine: stm32-mdma: use dev_dbg on non-busy channel spurious it
  dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler()
  dmaengine: stm32-mdma: remove GISR1 register
  dmaengine: ti: deprecate '#dma-channels'
  dmaengine: mmp: deprecate '#dma-channels'
  dmaengine: pxa: deprecate '#dma-channels' and '#dma-requests'
  ...

Pull tracing tool updates from Steven Rostedt:

 - Various clean ups and fixes to rtla (Real Time Linux Analysis)

* tag 'trace-tools-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  rtla: Remove procps-ng dependency
  rtla: Fix __set_sched_attr error message
  rtla: Minor grammar fix for rtla README
  rtla: Don't overwrite existing directory mode
  rtla: Avoid record NULL pointer dereference
  rtla/Makefile: Properly handle dependencies

Pull tracing updates from Steven Rostedt:
 "The majority of the changes are for fixes and clean ups.

  Notable changes:

   - Rework trace event triggers code to be easier to interact with.

   - Support for embedding bootconfig with the kernel (as suppose to
     having it embedded in initram). This is useful for embedded boards
     without initram disks.

   - Speed up boot by parallelizing the creation of tracefs files.

   - Allow absolute ring buffer timestamps handle timestamps that use
     more than 59 bits.

   - Added new tracing clock "TAI" (International Atomic Time)

   - Have weak functions show up in available_filter_function list as:
     __ftrace_invalid_address___<invalid-offset> instead of using the
     name of the function before it"

* tag 'trace-v5.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (52 commits)
  ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function
  tracing: Fix comments for event_trigger_separate_filter()
  x86/traceponit: Fix comment about irq vector tracepoints
  x86,tracing: Remove unused headers
  ftrace: Clean up hash direct_functions on register failures
  tracing: Fix comments of create_filter()
  tracing: Disable kcov on trace_preemptirq.c
  tracing: Initialize integer variable to prevent garbage return value
  ftrace: Fix typo in comment
  ftrace: Remove return value of ftrace_arch_modify_*()
  tracing: Cleanup code by removing init "char *name"
  tracing: Change "char *" string form to "char []"
  tracing/timerlat: Do not wakeup the thread if the trace stops at the IRQ
  tracing/timerlat: Print stacktrace in the IRQ handler if needed
  tracing/timerlat: Notify IRQ new max latency only if stop tracing is set
  kprobes: Fix build errors with CONFIG_KRETPROBES=n
  tracing: Fix return value of trace_pid_write()
  tracing: Fix potential double free in create_var_ref()
  tracing: Use strim() to remove whitespace instead of doing it manually
  ftrace: Deal with error return code of the ftrace_process_locs() function
  ...

Merge tag 'perf-tools-for-v5.19-2022-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux

Pull more perf tools updates from Arnaldo Carvalho de Melo:

 - Add BPF based off-CPU profiling

 - Improvements for system wide recording, specially for Intel PT

 - Improve DWARF unwinding on arm64

 - Support Arm CoreSight trace data disassembly in 'perf script' python

 - Fix build with new libbpf version, related to supporting older
   versions of distro released libbpf packages

 - Fix event syntax error caused by ExtSel in the JSON events infra

 - Use stdio interface if slang is not supported in 'perf c2c'

 - Add 'perf test' checking for perf stat CSV output

 - Sync the msr-index.h copy with the kernel sources

* tag 'perf-tools-for-v5.19-2022-05-28' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: (38 commits)
  tools arch x86: Sync the msr-index.h copy with the kernel sources
  perf scripts python: Support Arm CoreSight trace data disassembly
  perf scripting python: Expose dso and map information
  perf jevents: Fix event syntax error caused by ExtSel
  perf tools arm64: Add support for VG register
  perf unwind arm64: Decouple Libunwind register names from Perf
  perf unwind: Use dynamic register set for DWARF unwind
  perf tools arm64: Copy perf_regs.h from the kernel
  perf unwind arm64: Use perf's copy of kernel headers
  perf c2c: Use stdio interface if slang is not supported
  perf test: Add a basic offcpu profiling test
  perf record: Add cgroup support for off-cpu profiling
  perf record: Handle argument change in sched_switch
  perf record: Implement basic filtering for off-cpu
  perf record: Enable off-cpu analysis with BPF
  perf report: Do not extend sample type of bpf-output event
  perf test: Add checking for perf stat CSV output.
  perf tools: Allow system-wide events to keep their own threads
  perf tools: Allow system-wide events to keep their own CPUs
  libperf evsel: Add comments for booleans
  ...

The symbol hwa742_update_window_async() is exported, but there is no
prototype defined for it. That's why gcc complains:

drivers-video-fbdev-omap-hwa742.c:warning:no-previous-prototype-for-hwa742_update_window_async

Add the prototype, but I wonder if we couldn't drop exporting the symbol
instead. Since omapfb_update_window_async() is exported the same way,
are there any users outside of the tree?
Signed-off-by: Helge Deller <deller@gmx.de>

Pull input updates from Dmitry Torokhov:

 - a new driver for the Azoteq IQS7222A/B/C capacitive touch controller

 - a new driver for Raspberry Pi Sense HAT joystick

 - sun4i-lradc-keys gained support of R329 and D1 variants, plus it can
   be now used as a wakeup source

 - pm8941-pwrkey can now properly handle PON GEN3 variants; the driver
   also implements software debouncing and has a workaround for missing
   key press events

 - assorted driver fixes and cleanups

* tag 'input-for-v5.19-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (29 commits)
  Input: stmfts - do not leave device disabled in stmfts_input_open
  Input: gpio-keys - cancel delayed work only in case of GPIO
  Input: cypress_ps2 - fix typo in comment
  Input: vmmouse - disable vmmouse before entering suspend mode
  dt-bindings: google,cros-ec-keyb: Fixup bad compatible match
  Input: cros-ec-keyb - allow skipping keyboard registration
  dt-bindings: google,cros-ec-keyb: Introduce switches only compatible
  Input: psmouse-smbus - avoid flush_scheduled_work() usage
  Input: bcm-keypad - remove unneeded NULL check before clk_disable_unprepare
  Input: sparcspkr - fix refcount leak in bbc_beep_probe
  Input: sun4i-lradc-keys - add support for R329 and D1
  Input: sun4i-lradc-keys - add optional clock/reset support
  dt-bindings: input: sun4i-lradc-keys: Add R329 and D1 compatibles
  Input: sun4i-lradc-keys - add wakeup support
  Input: pm8941-pwrkey - simulate missed key press events
  Input: pm8941-pwrkey - add software key press debouncing support
  Input: pm8941-pwrkey - add support for PON GEN3 base addresses
  Input: pm8941-pwrkey - fix error message
  Input: synaptics-rmi4 - remove unnecessary flush_workqueue()
  Input: ep93xx_keypad - use devm_platform_ioremap_resource() helper
  ...

When building the kernel for arm with the "-mabi=apcs-gnu" option, gcc
will force alignment of all structures and unions to a word boundary
(see also STRUCTURE_SIZE_BOUNDARY and the "-mstructure-size-boundary=XX"
option if you're a gcc person), even when the members of said structures
do not want or need said alignment.

This completely messes up the structure alignment of 'struct edid' on
those targets, because even though all the embedded structures are
marked with "__attribute__((packed))", the unions that contain them are
not.

This was exposed by commit f1e4c916 ("drm/edid: add EDID block count
and size helpers"), but the bug is pre-existing.  That commit just made
the structure layout problem cause a build failure due to the addition
of the

        BUILD_BUG_ON(sizeof(*edid) != EDID_LENGTH);

sanity check in drivers/gpu/drm/drm_edid.c:edid_block_data().

This legacy union alignment should probably not be used in the first
place, but we can fix the layout by adding the packed attribute to the
union entries even when each member is already packed and it shouldn't
matter in a sane build environment.

You can see this issue with a trivial test program:

  union {
	struct {
		char c[5];
	};
	struct {
		char d;
		unsigned e;
	} __attribute__((packed));
  } a = { "1234" };

where building this with a normal "gcc -S" will result in the expected
5-byte size of said union:

	.type	a, @object
	.size	a, 5

but with an ARM compiler and the old ABI:

    arm-linux-gnu-gcc -mabi=apcs-gnu -mfloat-abi=soft -S t.c

you get

	.type	a, %object
	.size	a, 8

instead, because even though each member of the union is packed, the
union itself still gets aligned.

This was reported by Sudip for the spear3xx_defconfig target.

Link: https://lore.kernel.org/lkml/YpCUzStDnSgQLNFN@debian/Reported-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge tag 'hyperv-next-signed-20220528' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv updates from Wei Liu:

 - Harden hv_sock driver (Andrea Parri)

 - Harden Hyper-V PCI driver (Andrea Parri)

 - Fix multi-MSI for Hyper-V PCI driver (Jeffrey Hugo)

 - Fix Hyper-V PCI to reduce boot time (Dexuan Cui)

 - Remove code for long EOL'ed Hyper-V versions (Michael Kelley, Saurabh
   Sengar)

 - Fix balloon driver error handling (Shradha Gupta)

 - Fix a typo in vmbus driver (Julia Lawall)

 - Ignore vmbus IMC device (Michael Kelley)

 - Add a new error message to Hyper-V DRM driver (Saurabh Sengar)

* tag 'hyperv-next-signed-20220528' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: (28 commits)
  hv_balloon: Fix balloon_probe() and balloon_remove() error handling
  scsi: storvsc: Removing Pre Win8 related logic
  Drivers: hv: vmbus: fix typo in comment
  PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit()
  PCI: hv: Add validation for untrusted Hyper-V values
  PCI: hv: Fix interrupt mapping for multi-MSI
  PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
  drm/hyperv: Remove support for Hyper-V 2008 and 2008R2/Win7
  video: hyperv_fb: Remove support for Hyper-V 2008 and 2008R2/Win7
  scsi: storvsc: Remove support for Hyper-V 2008 and 2008R2/Win7
  Drivers: hv: vmbus: Remove support for Hyper-V 2008 and Hyper-V 2008R2/Win7
  x86/hyperv: Disable hardlockup detector by default in Hyper-V guests
  drm/hyperv: Add error message for fb size greater than allocated
  PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time
  PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
  Drivers: hv: vmbus: Refactor the ring-buffer iterator functions
  Drivers: hv: vmbus: Accept hv_sock offers in isolated guests
  hv_sock: Add validation for untrusted Hyper-V values
  hv_sock: Copy packets sent by Hyper-V out of the ring buffer
  hv_sock: Check hv_pkt_iter_first_raw()'s return value
  ...

Pull powerpc updates from Michael Ellerman:

 - Convert to the generic mmap support (ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)

 - Add support for outline-only KASAN with 64-bit Radix MMU (P9 or later)

 - Increase SIGSTKSZ and MINSIGSTKSZ and add support for AT_MINSIGSTKSZ

 - Enable the DAWR (Data Address Watchpoint) on POWER9 DD2.3 or later

 - Drop support for system call instruction emulation

 - Many other small features and fixes

Thanks to Alexey Kardashevskiy, Alistair Popple, Andy Shevchenko, Bagas
Sanjaya, Bjorn Helgaas, Bo Liu, Chen Huang, Christophe Leroy, Colin Ian
King, Daniel Axtens, Dwaipayan Ray, Fabiano Rosas, Finn Thain, Frank
Rowand, Fuqian Huang, Guilherme G. Piccoli, Hangyu Hua, Haowen Bai,
Haren Myneni, Hari Bathini, He Ying, Jason Wang, Jiapeng Chong, Jing
Yangyang, Joel Stanley, Julia Lawall, Kajol Jain, Kevin Hao, Krzysztof
Kozlowski, Laurent Dufour, Lv Ruyi, Madhavan Srinivasan, Magali Lemes,
Miaoqian Lin, Minghao Chi, Nathan Chancellor, Naveen N. Rao, Nicholas
Piggin, Oliver O'Halloran, Oscar Salvador, Pali Rohár, Paul Mackerras,
Peng Wu, Qing Wang, Randy Dunlap, Reza Arbab, Russell Currey, Sohaib
Mohamed, Vaibhav Jain, Vasant Hegde, Wang Qing, Wang Wensheng, Xiang
wangx, Xiaomeng Tong, Xu Wang, Yang Guang, Yang Li, Ye Bin, YueHaibing,
Yu Kuai, Zheng Bin, Zou Wei, and Zucheng Zheng.

* tag 'powerpc-5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (200 commits)
  powerpc/64: Include cache.h directly in paca.h
  powerpc/64s: Only set HAVE_ARCH_UNMAPPED_AREA when CONFIG_PPC_64S_HASH_MMU is set
  powerpc/xics: Include missing header
  powerpc/powernv/pci: Drop VF MPS fixup
  powerpc/fsl_book3e: Don't set rodata RO too early
  powerpc/microwatt: Add mmu bits to device tree
  powerpc/powernv/flash: Check OPAL flash calls exist before using
  powerpc/powermac: constify device_node in of_irq_parse_oldworld()
  powerpc/powermac: add missing g5_phy_disable_cpu1() declaration
  selftests/powerpc/pmu: fix spelling mistake "mis-match" -> "mismatch"
  powerpc: Enable the DAWR on POWER9 DD2.3 and above
  powerpc/64s: Add CPU_FTRS_POWER10 to ALWAYS mask
  powerpc/64s: Add CPU_FTRS_POWER9_DD2_2 to CPU_FTRS_ALWAYS mask
  powerpc: Fix all occurences of "the the"
  selftests/powerpc/pmu/ebb: remove fixed_instruction.S
  powerpc/platforms/83xx: Use of_device_get_match_data()
  powerpc/eeh: Drop redundant spinlock initialization
  powerpc/iommu: Add missing of_node_put in iommu_init_early_dart
  powerpc/pseries/vas: Call misc_deregister if sysfs init fails
  powerpc/papr_scm: Fix leaking nvdimm_events_map elements
  ...

Pull pin control updates from Linus Walleij:
 "Pretty big this time. Mostly due to (nice) Renesas refactorings.

  Core changes:

   - New helpers from Andy such as for_each_gpiochip_node() affecting
     both GPIO and pin control, improving a bunch of drivers in the
     process.

   - Pulled in Marc Zyngiers work to make IRQ chips immutable, and
     started to apply fixups on top.

  New drivers:

   - New driver for Marvell MVEBU 98DX2530.

   - New driver for Mediatek MT8195.

   - Support Qualcomm PMX65 and PM6125.

   - New driver for Qualcomm SC7280 LPASS pin control.

   - New driver for Rockchip RK3588.

   - New driver for NXP Freescale i.MXRT1170.

   - New driver for Mediatek MT6795 Helio X10.

  Improvements:

   - Several Aspeed G6 cleanups and non-critical fixes.

   - Thorought refactoring of some of the ever improving Renesas
     drivers.

   - Clean up Mediatek MT8192 bindings a bit.

   - PWM output and clock monitoring in the Ocelot LAN966x driver.

   - Thorough refactoring and cleanup of the Ralink drivers such as
     RT2880, RT3883, RT305X, MT7620, MT7621, MT7628 splitting these into
     proper sub-drivers"

* tag 'pinctrl-v5.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (161 commits)
  pinctrl: apple: Use a raw spinlock for the regmap
  pinctrl: berlin: bg4ct: Use devm_platform_*ioremap_resource() APIs
  pinctrl: intel: Fix kernel doc format, i.e. add return sections
  dt-bindings: pinctrl: qcom: Drop 'maxItems' on 'wakeup-parent'
  pinctrl: starfive: Make the irqchip immutable
  pinctrl: mediatek: Add pinctrl driver for MT6795 Helio X10
  dt-bindings: pinctrl: Add MediaTek MT6795 pinctrl bindings
  pinctrl: freescale: Add i.MXRT1170 pinctrl driver support
  dt-bindings: pinctrl: add i.MXRT1170 pinctrl Documentation
  dt-bindings: pinctrl: rockchip: increase max amount of device functions
  dt-bindings: pinctrl: qcom,pmic-gpio: add 'gpio-reserved-ranges'
  dt-bindings: pinctrl: qcom,pmic-gpio: add 'input-disable'
  dt-bindings: pinctrl: qcom,pmic-gpio: describe gpio-line-names
  dt-bindings: pinctrl: qcom,pmic-gpio: fix matching pin config
  dt-bindings: pinctrl: qcom,pmic-gpio: document PM8150L and PMM8155AU
  pinctrl: qcom: spmi-gpio: Add pm6125 compatible
  dt-bindings: pinctrl: qcom-pmic-gpio: Add pm6125 compatible
  pinctrl: intel: Drop unused irqchip member in struct intel_pinctrl
  pinctrl: intel: make irq_chip immutable
  pinctrl: cherryview: Use GPIO chip pointer in chv_gpio_irq_mask_unmask()
  ...

Commit b3c9a924 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather
than .remove") fixed a use-after-free error due the vesafb driver freeing
the fb_info in the .remove handler instead of doing it in .fb_destroy.

This can happen if the .fb_destroy callback is executed after the .remove
callback, since the former tries to access a pointer freed by the latter.

But that change didn't take into account that another possible scenario is
that .fb_destroy is called before the .remove callback. For example, if no
process has the fbdev chardev opened by the time the driver is removed.

If that's the case, fb_info will be freed when unregister_framebuffer() is
called, making the fb_info pointer accessed in vesafb_remove() after that
to no longer be valid.

To prevent that, move the expression containing the info->par to happen
before the unregister_framebuffer() function call.

Fixes: b3c9a924 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove")
Reported-by: Pascal Ernster <dri-devel@hardfalcon.net>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Tested-by: Pascal Ernster <dri-devel@hardfalcon.net>
Signed-off-by: Helge Deller <deller@gmx.de>