The values of the variables xres and yres are placed in strbuf.
These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters.
Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres);
more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Andrey Shumilin <shum.sdl@nppct.ru>
Signed-off-by: Helge Deller <deller@gmx.de>

Break the for loop immediately upon finding the target, making the
process more efficient.
Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>

An of_node_put(ep) call was immediately used after a pointer check
for a of_graph_get_remote_port() call in this function implementation.
Thus call such a function only once instead directly before the check.

This issue was transformed by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Helge Deller <deller@gmx.de>

syzbot has found a NULL pointer dereference bug in fbcon.
Here is the simplified C reproducer:

struct param {
	uint8_t type;
	struct tiocl_selection ts;
};

int main()
{
	struct fb_con2fbmap con2fb;
	struct param param;

	int fd = open("/dev/fb1", 0, 0);

	con2fb.console = 0x19;
	con2fb.framebuffer = 0;
	ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);

	param.type = 2;
	param.ts.xs = 0; param.ts.ys = 0;
	param.ts.xe = 0; param.ts.ye = 0;
	param.ts.sel_mode = 0;

	int fd1 = open("/dev/tty1", O_RDWR, 0);
	ioctl(fd1, TIOCLINUX, &param);

	con2fb.console = 1;
	con2fb.framebuffer = 0;
	ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb);

	return 0;
}

After calling ioctl(fd1, TIOCLINUX, &param), the subsequent ioctl(fd, FBIOPUT_CON2FBMAP, &con2fb)
causes the kernel to follow a different execution path:

 set_con2fb_map
  -> con2fb_init_display
   -> fbcon_set_disp
    -> redraw_screen
     -> hide_cursor
      -> clear_selection
       -> highlight
        -> invert_screen
         -> do_update_region
          -> fbcon_putcs
           -> ops->putcs

Since ops->putcs is a NULL pointer, this leads to a kernel panic.
To prevent this, we need to call set_blitting_type() within set_con2fb_map()
to properly initialize ops->putcs.

Reported-by: syzbot+3d613ae53c031502687a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3d613ae53c031502687a
Tested-by: syzbot+3d613ae53c031502687a@syzkaller.appspotmail.com
Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>

Pull media updates from Mauro Carvalho Chehab:

 - New CEC driver: Extron DA HD 4K Plus

 - Lots of driver fixes, cleanups and improvements

* tag 'media/v6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (179 commits)
  media: atomisp: Use clamp() in ia_css_eed1_8_vmem_encode()
  media: atomisp: Fix eed1_8 code assigning signed values to an unsigned variable
  media: atomisp: set lock before calling vb2_queue_init()
  media: atomisp: Improve binary finding debug logging
  media: atomisp: Drop dev_dbg() calls from hmm_[alloc|free]()
  media: atomisp: csi2-bridge: Add DMI quirk for t4ka3 on Xiaomi Mipad2
  media: atomisp: add missing wait_prepare/finish ops
  media: atomisp: Remove unused declaration
  media: atomisp: use clamp() in compute_coring()
  media: atomisp: use clamp() in ia_css_eed1_8_encode()
  media: atomisp: Simplify ia_css_pipe_create_cas_scaler_desc_single_output()
  media: atomisp: Replace rarely used macro from math_support.h
  media: atomisp: Remove duplicated leftover, i.e. sh_css_dvs_info.h
  media: atomisp: bnr: fix trailing statement
  media: atomisp: move trailing */ to separate lines
  media: atomisp: move trailing statement to next line.
  media: atomisp: Fix trailing statement in ia_css_de.host.c
  media: atomisp: Fix spelling mistakes in atomisp.h
  media: atomisp: Fix spelling mistakes in atomisp_platform.h
  media: atomisp: Fix spelling mistake in csi_rx_public.h
  ...

Pull clk updates from Stephen Boyd:
 "The core clk framework is left largely untouched this time around
  except for support for the newly ratified DT property
  'assigned-clock-rates-u64'.

  I'm much more excited about the support for loading DT overlays from
  KUnit tests so that we can test how the clk framework parses DT nodes
  during clk registration. The clk framework has some places that are
  highly DeviceTree dependent so this charts the path to extend the
  KUnit tests to cover even more framework code in the future. I've got
  some more tests on the list that use the DT overlay support, but they
  uncovered issues with clk unregistration that I'm still working on
  fixing.

  Outside the core, the clk driver update pile is dominated by Qualcomm
  and Renesas SoCs, making it fairly usual. Looking closer, there are
  fixes for things all over the place, like adding missing clk
  frequencies or moving defines for the number of clks out of DT binding
  headers into the drivers. There are even conversions of DT bindings to
  YAML and migration away from strings to describe clk topology. Overall
  it doesn't look unusual so I expect the new drivers to be where we'll
  have fixes in the coming weeks.

  Core:
   - KUnit tests for clk registration and fixed rate basic clk type
   - A couple more devm helpers, one consumer and one provider
   - Support for assigned-clock-rates-u64

  New Drivers:
   - Camera, display and GPU clocks on Qualcomm SM4450
   - Camera clocks on Qualcomm SM8150
   - Rockchip rk3576 clks
   - Microchip SAM9X7 clks
   - Renesas RZ/V2H(P) (R9A09G057) clks

  Updates:
   - Mark a bunch of struct freq_tbl const to reduce .data usage
   - Add Qualcomm MSM8226 A7PLL and Regera PLL support
   - Fix the Qualcomm Lucid 5LPE PLL configuration sequence to not reuse
     Trion, as they do differ
   - A number of fixes to the Qualcomm SM8550 display clock driver
   - Fold Qualcomm SM8650 display clock driver into SM8550 one
   - Add missing clocks and GDSCs needed for audio on Qualcomm MSM8998
   - Add missing USB MP resets, GPLL9, and QUPv3 DFS to Qualcomm SC8180X
   - Fix sdcc clk frequency tables on Qualcomm SC8180X
   - Drop the Qualcomm SM8150 gcc_cpuss_ahb_clk_src
   - Mark Qualcomm PCIe GDSCs as RET_ON on sm8250 and sm8540 to avoid
     them turning off during suspend
   - Use the HW_CTRL mechanism on Qualcomm SM8550 video clock controller
     GDSCs
   - Get rid of CLK_NR_CLKS defines in Rockchip DT binding headers
   - Some fixes for Rockchip rk3228 and rk3588
   - Exynos850: Add clock for Thermal Management Unit
   - Exynos7885: Fix duplicated ID in the header, add missing TOP PLLs
     and add clocks for USB block in the FSYS clock controller
   - ExynosAutov9: Add DPUM clock controller
   - ExynosAutov920: Add new (first) clock controllers: TOP and PERIC0
     (and a bit more complete bindings)
   - Use clk_hw pointer instead of fw_name for acm_aud_clk[0-1]_sel
     clocks on i.MX8Q as parents in ACM provider
   - Add i.MX95 NETCMIX support to the block control provider
   - Fix parents for ENETx_REF_SEL clocks on i.MX6UL
   - Add USB clocks, resets and power domains on Renesas RZ/G3S
   - Add Generic Timer (GTM), I2C Bus Interface (RIIC), SD/MMC Host
     Interface (SDHI) and Watchdog Timer (WDT) clocks and resets on
     Renesas RZ/V2H
   - Add PCIe, PWM, and CAN-FD clocks on Renesas R-Car V4M
   - Add LCD controller clocks and resets on Renesas RZ/G2UL
   - Add DMA clocks and resets on Renesas RZ/G3S
   - Add fractional multiplication PLL support on Renesas R-Car Gen4
   - Document support for the Renesas RZ/G2M v3.0 (r8a774a3) SoC
   - Support for the Microchip SAM9X7 SoC as follows:
   - Updates for the Microchip PLL drivers
   - DT binding documentation updates (for the new clock driver and for
     the slow clock controller that SAM9X7 is using)
   - A fix for the Microchip SAMA7G5 clock driver to avoid allocating
     more memory than necessary
   - Constify some Amlogic structs
   - Add SM1 eARC clocks for Amlogic
   - Introduce a symbol namespace for Amlogic clock specific symbols
   - Add reset controller support to audiomix block control on i.MX
   - Add CLK_SET_RATE_PARENT flag to all audiomix clocks and to i.MX7D
     lcdif_pixel_src clock
   - Fix parent clocks for earc_phy and audpll on i.MX8MP
   - Fix default parents for enet[12]_ref_sel on i.MX6UL
   - Add ops in composite 8M and 93 that allow no-op on disable
   - Add check for PCC present bit on composite 7ULP register
   - Fix fractional part for fracn-gppll on prepare in i.MX
   - Fix clock tree update for TF-A managed clocks on i.MX8M
   - Drop CLK_SET_PARENT_GATE for DRAM mux on i.MX7D
   - Add the SAI7 IPG clock for i.MX8MN
   - Mark the 'nand_usdhc_bus' clock as non-critical on i.MX8MM
   - Add LVDS bypass clocks on i.MX8QXP
   - Add muxes for MIPI and PHY ref clocks on i.MX
   - Reorder dc0_bypass0_clk, lcd_pxl and dc1_disp clocks on i.MX8QXP
   - Add 1039.5MHz and 800MHz rates to fracn-gppll table on i.MX
   - Add CLK_SET_RATE_PARENT for media_disp pixel clocks on i.MX8QXP
   - Add some module descriptions to the i.MX generic and the i.MXRT1050
     driver
   - Fix return value for bypass for composite i.MX7ULP
   - Move Mediatek clk bindings to clock/
   - Convert some more clk bindings to dt schema"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (180 commits)
  clk: Switch back to struct platform_driver::remove()
  dt-bindings: clock, reset: fix top-comment indentation rk3576 headers
  clk: rockchip: remove unused mclk_pdm0_p/pdm0_p definitions
  clk: provide devm_clk_get_optional_enabled_with_rate()
  clk: fixed-rate: add devm_clk_hw_register_fixed_rate_parent_data()
  clk: imx6ul: fix clock parent for IMX6UL_CLK_ENETx_REF_SEL
  clk: renesas: r9a09g057: Add clock and reset entries for GTM/RIIC/SDHI/WDT
  clk: renesas: rzv2h: Add support for dynamic switching divider clocks
  clk: renesas: r9a08g045: Add clocks, resets and power domains for USB
  clk: rockchip: fix error for unknown clocks
  clk: rockchip: rk3588: drop unused code
  clk: rockchip: Add clock controller for the RK3576
  clk: rockchip: Add new pll type pll_rk3588_ddr
  dt-bindings: clock, reset: Add support for rk3576
  dt-bindings: clock: rockchip,rk3588-cru: drop unneeded assigned-clocks
  clk: rockchip: rk3588: Fix 32k clock name for pmu_24m_32k_100m_src_p
  clk: imx95: enable the clock of NETCMIX block control
  dt-bindings: clock: add RMII clock selection
  dt-bindings: clock: add i.MX95 NETCMIX block control
  clk: imx: imx8: Use clk_hw pointer for self registered clock in clk_parent_data
  ...

Pull i2c updates from Wolfram Sang:
 "I2C core:

   - finally remove the I2C_COMPAT symbol after 15 years of deprecation

   - lock client addresses during initialization to prevent race
     conditions between different kinds of instantiation

   - use scoped foreach OF child loops

   - testunit cleanups and documentation improvements, as well as two
     new tests, one for repeated start and one for triggering SMBusAlert
     interrupts

  I2C host drivers:

   - DesignWare and Renesas I2C driver updates.

     The first has has undergone through a series of cleanups that have
     been sent to the mailing list a year ago for the first time and
     finally get merged in this pull request. They are many, from typos
     (e.g. i2/i2c), to cosmetics, to refactoring (e.g. move inline
     functions to librarieas) and many others.

   - all the DesignWare Kconfig options have been grouped under the
     I2C_DESIGNWARE_CORE and this required some adaptation in many of
     the kernel configuration files for different arm and mips boards

  Cleanups:

   - improve the exit path in the runtime resume function for the
     Qualcomm Geni platform

   - get rid of the unused "target_addr" parameter in the Intel LJCA
     driver

   - intialize the restart_flag in the MediaTek controller in one single
     place

   - constify a few global data structures in the virtio driver

   - simplify the bus speed handling in the Renesas driver init function
     making it more readable

   - improved probe function of the Renesas R-Car driver

   - switch the iMX/MXC driver to use RUNTIME_PM_OPS() instead of
     SET_RUNTIME_PM_OPS()

   - iMX/MXC driver cleanups

   - use devm_clk_get_enabled() to simplify the Renesas EMEV2, Ingenic
     and MPC drivers

  Refactoring:

   - Fix a potential out of boundary array access in the Nuvoton driver.

     This is not a bug fix because the issue could never occur due to
     hardware not having the properties listed in the array. The change
     makes the driver more future proof and, at the same time, silences
     code analyzers.

  Improvements:

   - several patches improving the runtime power management handling of
     the Renesas I2C (riic) driver

   - use a more descriptive adapter name in the Intel i801 driver to
     show the presence of the IDF feature

   - kill pending transactions when irq's can't complete their handling
     in the Intel Denverton (ismt) driver, triggering a timeout

  New Feature:

   - support fast mode plus in the Renesas I2C (riic) driver

  New support:

   - Added support for:
      - Renesas R9A08G045
      - Rockchip RK3576
      - KEBA I2C
      - Theobroma Systems Mule Multiplexer.

   - new i2c-keba.c driver

   - new driver for The Mule i2c multiplexer

  Core I2C framework:

   - move runtime PM functions in order to allow them to be accessed
     during device add

  Devicetree:

   - nVidia and Qualcomm binding improvements

   - get rid of redundant "multi-master" property in the aspeed binding

   - convert i2c-sprd binding to YAML

  AT24 updates:

  - document a new model from giantec in DT bindings"

* tag 'i2c-for-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (69 commits)
  i2c: designware: Use pci_get_drvdata()
  i2c: designware: Propagate firmware node
  i2c: designware: Uninline i2c_dw_probe()
  i2c: ljca: Remove unused "target_addr" parameter
  i2c: keba: Add KEBA I2C controller support
  i2c: i801: Use a different adapter-name for IDF adapters
  i2c: core: Setup i2c_adapter runtime-pm before calling device_add()
  dt-bindings: i2c: i2c-sprd: convert to YAML
  i2c: ismt: kill transaction in hardware on timeout
  i2c: designware: Group all DesignWare drivers under a single option
  net: txgbe: Fix I2C Kconfig dependencies
  RISC-V: configs: enable I2C_DESIGNWARE_CORE with I2C_DESIGNWARE_PLATFORM
  mips: configs: enable I2C_DESIGNWARE_CORE with I2C_DESIGNWARE_PLATFORM
  arm64: defconfig: enable I2C_DESIGNWARE_CORE with I2C_DESIGNWARE_PLATFORM
  ARM: configs: enable I2C_DESIGNWARE_CORE with I2C_DESIGNWARE_PLATFORM
  ARC: configs: enable I2C_DESIGNWARE_CORE with I2C_DESIGNWARE_PLATFORM
  i2c: virtio: Constify struct i2c_algorithm and struct virtio_device_id
  i2c: rcar: tidyup priv->devtype handling on rcar_i2c_probe()
  i2c: imx: Convert comma to semicolon
  i2c: jz4780: Use devm_clk_get_enabled() helpers
  ...

Pull libnvdimm updates from Ira Weiny:

 - use Open Firmware helper routines

 - fix memory leak when nvdimm labels are incorrect

 - remove some dead code

* tag 'libnvdimm-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  nvdimm: Remove dead code for ENODEV checking in scan_labels()
  nvdimm: Fix devs leaks in scan_labels()
  nvdimm: Use of_property_present() and of_property_read_bool()

Pull backlight update from Lee Jones:

 - Added a check for the return value of spi_setup() in the l4f00242t03
   driver to catch errors

* tag 'backlight-next-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: l4f00242t03: Add check for spi_setup

Pull LED updates from Lee Jones:

 - Limited LED current based on thermal conditions in the QCOM flash LED
   driver

 - Fixed device child node usage in the BD2606MVV and PCA995x drivers

 - Used device_for_each_child_node_scoped() to access child nodes in the
   IS31FL319X driver

 - Reset the LED controller during the probe in the LM3601X driver

 - Used device_for_each_child_node() to access device child nodes in the
   PCA995X driver

 - Fixed CONFIG_LEDS_CLASS_MULTICOLOR dependency in the BlinkM driver

 - Replaced msleep() with usleep_range() in the SUN50I-A100 driver

 - Used scoped device node handling to simplify error paths in the
   AAT1290, KTD2692, and MC13783 drivers

 - Added missing of_node_get for probe duration in the MAX77693 driver

 - Simplified using for_each_available_child_of_node_scoped() loops when
   iterating over device nodes

 - Used devm_clk_get_enabled() helpers in the LP55XX driver

 - Converted DT bindings from TXT to YAML format for various drivers,
   including LM3692x and SC2731-BLTC

 - Set num_leds after allocation in the GPIO driver

 - Removed irrelevant blink configuration error message in the PCA9532
   driver

 - Fixed module autoloading with MODULE_DEVICE_TABLE() in the Turris
   Omnia driver

* tag 'leds-next-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (38 commits)
  leds: turris-omnia: Fix module autoloading with MODULE_DEVICE_TABLE()
  leds: pca9532: Remove irrelevant blink configuration error message
  leds: gpio: Set num_leds after allocation
  dt-bindings: leds: Convert leds-lm3692x to YAML format
  leds: lp55xx: Use devm_clk_get_enabled() helpers
  leds: as3645a: Use device_* to iterate over device child nodes
  leds: qcom-lpg: Simplify with scoped for each OF child loop
  leds: turris-omnia: Simplify with scoped for each OF child loop
  leds: sc27xx: Simplify with scoped for each OF child loop
  leds: pca9532: Simplify with scoped for each OF child loop
  leds: netxbig: Simplify with scoped for each OF child loop
  leds: mt6323: Simplify with scoped for each OF child loop
  leds: mc13783: Use scoped device node handling to simplify error paths
  leds: lp55xx: Simplify with scoped for each OF child loop
  leds: is31fl32xx: Simplify with scoped for each OF child loop
  leds: bcm6358: Simplify with scoped for each OF child loop
  leds: bcm6328: Simplify with scoped for each OF child loop
  leds: aw2013: Simplify with scoped for each OF child loop
  leds: 88pm860x: Simplify with scoped for each OF child loop
  leds: max77693: Simplify with scoped for each OF child loop
  ...

Pull MFD updates from Lee Jones:

 - Added support for the Analog Devices ADP5585 GPIO and PWM functions

 - Added parsing of GPIO hogs for the ADP5585

 - Fixed module autoloading in the MAX14577 driver

 - Simplified and cleaned up the CROS_EC driver

 - Made the Lenovo Yoga Tab 3 X90F DMI match less strict in the
   INTEL_SOC_PMIC_CHTWC driver

 - Added support for the RK806 PMIC on the I2C bus

 - Removed the remaining header file for the DS1WM driver

 - Added compatible strings for various devices in the device tree
   bindings

 - Fixed a comma-related issue in the 88PM860X_CORE driver

 - Constified read-only regmap structs in various drivers

 - Used scoped variables with memory allocators to simplify error paths
   in the MT6360 and SYSCON drivers

 - Added Intel Arrow Lake-H and Panther Lake LPSS PCI IDs

* tag 'mfd-next-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (44 commits)
  mfd: atc260x: Convert a bunch of commas to semicolons
  dt-bindings: mfd: qcom,tcsr: Add compatible for sa8775p
  mfd: intel-lpss: Add Intel Panther Lake LPSS PCI IDs
  mfd: intel-lpss: Add Intel Arrow Lake-H LPSS PCI IDs
  dt-bindings: mfd: syscon: Add rk3576 QoS register compatible
  dt-bindings: mfd: adp5585: Add parsing of hogs
  mfd: tc3589x: Drop vendorless compatible string from match table
  mfd: qcom-spmi-pmic: Use for_each_child_of_node_scoped()
  mfd: max77620: Use for_each_child_of_node_scoped()
  mfd: intel_soc_pmic_chtwc: Make Lenovo Yoga Tab 3 X90F DMI match less strict
  mfd: cros_ec: Update module description
  mfd: cros_ec: Simplify and clean-up cros_ec_dev_init()
  mfd: max14577: Provide MODULE_DEVICE_TABLE() to fix module autoloading
  mfd: rk8xx: Add support for rk806 on i2c bus
  dt-bindings: mfd: syscon: Add ti,j784s4-acspcie-proxy-ctrl compatible
  mfd: ds1wm: Remove remaining header file
  MAINTAINERS: Repair file entry in MARVELL 88PM886 PMIC DRIVER
  mfd: 88pm860x-core: Convert comma to semicolon
  mfd: syscon: Use scoped variables with memory allocators to simplify error paths
  mfd: mt6360: Use scoped variables with memory allocators to simplify error paths
  ...

Pull dmaengine updates from Vinod Koul:
 "Unusually, more new driver and device support than updates. Couple of
  new device support, AMD, Rcar, Intel and New drivers in Freescale,
  Loonsoon, AMD and LPC32XX with DT conversion and mode updates etc.

  New support:
   - Support for AMD Versal Gen 2 DMA IP
   - Rcar RZ/G3S SoC dma controller
   - Support for Intel Diamond Rapids and Granite Rapids-D dma controllers
   - Support for Freescale ls1021a-qdma controller
   - New driver for Loongson-1 APB DMA
   - New driver for AMD QDMA
   - Pl08x in LPC32XX router dma driver

  Updates:
   - Support for dpdma cyclic dma mode
   - XML conversion for marvell xor dma bindings
   - Dma clocks documentation for imx dma"

* tag 'dmaengine-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (24 commits)
  dmaengine: loongson1-apb-dma: Fix the build warning caused by the size of pdev_irqname
  dmaengine: Fix spelling mistakes
  dmaengine: Add dma router for pl08x in LPC32XX SoC
  dmaengine: fsl-edma: add edma src ID check at request channel
  dmaengine: fsl-edma: change to guard(mutex) within fsl_edma3_xlate()
  dmaengine: avoid non-constant format string
  dmaengine: imx-dma: Remove i.MX21 support
  dt-bindings: dma: fsl,imx-dma: Document the DMA clocks
  dmaengine: Loongson1: Add Loongson-1 APB DMA driver
  dt-bindings: dma: Add Loongson-1 APB DMA
  dmaengine: zynqmp_dma: Add support for AMD Versal Gen 2 DMA IP
  dt-bindings: dmaengine: zynqmp_dma: Add a new compatible string
  dmaengine: idxd: Add new DSA and IAA device IDs for Diamond Rapids platform
  dmaengine: idxd: Add a new DSA device ID for Granite Rapids-D platform
  dmaengine: ti: k3-udma: Remove unused declarations
  dmaengine: amd: qdma: Add AMD QDMA driver
  dmaengine: xilinx: dpdma: Add support for cyclic dma mode
  dma: ipu: Remove include/linux/dma/ipu-dma.h
  dt-bindings: dma: fsl-mxs-dma: Add compatible string "fsl,imx8qxp-dma-apbh"
  dt-bindings: fsl-qdma: allow compatible string fallback to fsl,ls1021a-qdma
  ...

Pull phy updates from Vinod Koul:
 "New hw support:
   - Rcar usb2 support for RZ/G3S SoC
   - Nuvoton MA35 SoC USB 2.0 PHY driver

  Removed:
   - obsolete qcom,usb-8x16-phy bindings

  Updates:
   - 4 lane PCIe support for Qualcomm X1E80100
   - Constify structure in subsystem update
   - Subsystem simplification with scoped for each OF child loop update
   - Yaml conversion for Qualcomm sata phy, Hiilicon hi3798cv200-combphy
     bindings"

* tag 'phy-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (40 commits)
  phy: renesas: rcar-gen3-usb2: Add support for the RZ/G3S SoC
  dt-bindings: phy: renesas,usb2-phy: Document RZ/G3S phy bindings
  phy: renesas: rcar-gen3-usb2: Add support to initialize the bus
  phy: ti: j721e-wiz: Simplify with scoped for each OF child loop
  phy: ti: j721e-wiz: Drop OF node reference earlier for simpler code
  phy: ti: gmii-sel: Simplify with dev_err_probe()
  phy: ti: am654-serdes: Use scoped device node handling to simplify error paths
  phy: qcom: qmp-pcie-msm8996: Simplify with scoped for each OF child loop
  phy: mediatek: xsphy: Simplify with scoped for each OF child loop
  phy: mediatek: tphy: Simplify with scoped for each OF child loop
  phy: hisilicon: usb2: Simplify with scoped for each OF child loop
  phy: cadence: sierra: Simplify with scoped for each OF child loop
  phy: broadcom: brcm-sata: Simplify with scoped for each OF child loop
  phy: broadcom: bcm-cygnus-pcie: Simplify with scoped for each OF child loop
  phy: nuvoton: add new driver for the Nuvoton MA35 SoC USB 2.0 PHY
  dt-bindings: phy: nuvoton,ma35-usb2-phy: add new bindings
  phy: qcom: qmp-pcie: Configure all tables on port B PHY
  phy: airoha: adjust initialization delay in airoha_pcie_phy_init()
  dt-bindings: phy: socionext,uniphier: add top-level constraints
  phy: qcom: qmp-pcie: Add Gen4 4-lanes mode for X1E80100
  ...

Pull soundwire updates from Vinod Koul:

 - bus cleanup for warnings and probe deferral errors suppression

 - cadence recheck for status with a delayed work

 - intel interrupt rework on reset exit

* tag 'soundwire-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_bus_common: enable interrupts before exiting reset
  soundwire: cadence: re-check Peripheral status with delayed_work
  soundwire: bus: clean up probe warnings
  soundwire: bus: drop unused driver name field
  soundwire: bus: suppress probe deferral errors

Pull watchdog updates from Wim Van Sebroeck:

 - Add Watchdog Timer driver for RZ/V2H(P)

 - Add Cirrus EP93x

 - Some small fixes and improvements

* tag 'linux-watchdog-6.12-rc1' of git://www.linux-watchdog.org/linux-watchdog:
  watchdog: Convert comma to semicolon
  watchdog: rzv2h_wdt: Add missing MODULE_LICENSE tag to fix modpost error
  dt-bindings: watchdog: Add Cirrus EP93x
  dt-bindings: watchdog: stm32-iwdg: Document interrupt and wakeup properties
  drivers: watchdog: marvell_gti: Convert comma to semicolon
  watchdog: iTCO_wdt: Convert comma to semicolon
  watchdog: Add Watchdog Timer driver for RZ/V2H(P)
  dt-bindings: watchdog: renesas,wdt: Document RZ/V2H(P) SoC
  watchdog: imx_sc_wdt: detect if already running
  watchdog: imx2_wdt: Remove __maybe_unused notations
  watchdog: imx_sc_wdt: Don't disable WDT in suspend
  watchdog: imx7ulp_wdt: move post_rcs_wait into struct imx_wdt_hw_feature

Pull pin control updates from Linus Walleij:
 "Core changes:

   - Add support for "input-schmitt-microvolt" property, as used in the
     Sophgo SoC

  New drivers:

   - Mobileye EyeQ5 pin controller, I think this is an automotive SoC

   - Rockchip rk3576 pin control support

   - Sophgo CV1800 series pin controllers: CV1800B, CV1812H and SG2000

  Improvements:

   - Gradual improvements to Renesas, Samsung, Qualcomm, Nuvoton and a
     few other drivers"

* tag 'pinctrl-v6.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (67 commits)
  pinctrl: intel: Constify struct intel_pinctrl parameter
  pinctrl: Remove redundant null pointer checks in pinctrl_remove_device_debugfs()
  pinctrl: baytrail: Drop duplicate return statement
  pinctrl: intel: Inline intel_gpio_community_irq_handler()
  dt-bindings: pinctrl: qcom: add missing type to GPIO hogs
  pinctrl: madera: Simplify with dev_err_probe()
  pinctrl: k210: Use devm_clk_get_enabled() helpers
  pinctrl: Join split messages and remove double whitespace
  pinctrl: renesas: rzg2l: Move pinconf_to_config_argument() call outside of switch cases
  pinctrl: renesas: rzg2l: Introduce single macro for digital noise filter configuration
  pinctrl: renesas: rzg2l: Replace of_node_to_fwnode() with more suitable API
  pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
  pinctrl: sunxi: Use devm_clk_get_enabled() helpers
  pinctrl: sophgo: cv18xx: fix missed __iomem type identifier
  pinctrl: stmfx: Use string_choices API instead of ternary operator
  pinctrl: nomadik: Use kmemdup_array instead of kmemdup for multiple allocation
  pinctrl: intel: Introduce for_each_intel_gpio_group() helper et al.
  pinctrl: intel: Constify intel_get_community() returned object
  pinctrl: intel: Implement high impedance support
  pinctrl: intel: Add __intel_gpio_get_direction() helper
  ...

Pull PCIe non-transparent bridge updates from Jon Mason:
 "Bug fixes for intel ntb driver debugfs, use after free in switchtec
  driver, ntb transport rx ring buffers. Also, cleanups in printks,
  kernel-docs, and idt driver comment"

* tag 'ntb-6.12' of https://github.com/jonmason/ntb:
  ntb: Force physically contiguous allocation of rx ring buffers
  ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
  ntb: idt: Fix the cacography in ntb_hw_idt.c
  NTB: epf: don't misuse kernel-doc marker
  NTB: ntb_transport: fix all kernel-doc warnings
  ntb: Constify struct bus_type
  ntb_perf: Fix printk format
  ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()

Merge tag 'firewire-updates-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire updates from Takashi Sakamoto:
 "In the FireWire subsystem, tasklets have been used as the bottom half
  of 1394 OHCi hardIRQ. In recent kernel updates, BH workqueues have
  become available, and some developers have proposed replacing the
  tasklet with a BH workqueue.

  As a first step towards dropping tasklet use, the 1394 OHCI
  isochronous context can use regular workqueues. In this context, the
  batch of packets is processed in the specific queue, thus the timing
  jitter caused by task scheduling is not so critical.

  Additionally, DMA transmission can be scheduled per-packet basis,
  therefore the context can be sleep between the operation of
  transmissions. Furthermore, in-kernel protocol implementation involves
  some CPU-bound tasks, which can sometimes consumes CPU time so long.
  These characteristics suggest that normal workqueues are suitable,
  through BH workqueues are not.

  The replacement with a workqueue allows unit drivers to process the
  content of packets in non-atomic context. It brings some reliefs to
  some drivers in sound subsystem that spin-lock is not mandatory
  anymore during isochronous packet processing.

  Summary:

   - Replace tasklet with workqueue for isochronous context

   - Replace IDR with XArray

   - Utilize guard macro where possible

   - Print deprecation warning when enabling debug parameter of
     firewire-ohci module

   - Switch to nonatomic PCM operation"

* tag 'firewire-updates-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (55 commits)
  firewire: core: rename cause flag of tracepoints event
  firewire: core: update documentation of kernel APIs for flushing completions
  firewire: core: add helper function to retire descriptors
  Revert "firewire: core: move workqueue handler from 1394 OHCI driver to core function"
  Revert "firewire: core: use mutex to coordinate concurrent calls to flush completions"
  firewire: core: use mutex to coordinate concurrent calls to flush completions
  firewire: core: move workqueue handler from 1394 OHCI driver to core function
  firewire: core: fulfill documentation of fw_iso_context_flush_completions()
  firewire: core: expose kernel API to schedule work item to process isochronous context
  firewire: core: use WARN_ON_ONCE() to avoid superfluous dumps
  ALSA: firewire: use nonatomic PCM operation
  firewire: core: non-atomic memory allocation for isochronous event to user client
  firewire: ohci: operate IT/IR events in sleepable work process instead of tasklet softIRQ
  firewire: core: add local API to queue work item to workqueue specific to isochronous contexts
  firewire: core: allocate workqueue to handle isochronous contexts in card
  firewire: ohci: obsolete direct usage of printk_ratelimit()
  firewire: ohci: deprecate debug parameter
  firewire: core: update fw_device outside of device_find_child()
  firewire: ohci: fix error path to detect initiated reset in TI TSB41BA3D phy
  firewire: core/ohci: minor refactoring for computation of configuration ROM size
  ...

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Wait for device readiness after reset by polling Vendor ID and
     looking for Configuration RRS instead of polling the Command
     register and looking for non-error completions, to avoid hardware
     retries done for RRS on non-Vendor ID reads (Bjorn Helgaas)

   - Rename CRS Completion Status to RRS ('Request Retry Status') to
     match PCIe r6.0 spec usage (Bjorn Helgaas)

   - Clear LBMS bit after a manual link retrain so we don't try to
     retrain a link when there's no downstream device anymore (Maciej W.
     Rozycki)

   - Revert to the original link speed after retraining fails instead of
     leaving it restricted to 2.5GT/s, so a future device has a chance
     to use higher speeds (Maciej W. Rozycki)

   - Wait for each level of downstream bus, not just the first, to
     become accessible before restoring devices on that bus (Ilpo
     Järvinen)

   - Add ARCH_PCI_DEV_GROUPS so s390 can add its own attribute_groups
     without having to stomp on the core's pdev->dev.groups (Lukas
     Wunner)

  Driver binding:

   - Export pcim_request_region(), a managed counterpart of
     pci_request_region(), for use by drivers (Philipp Stanner)

   - Export pcim_iomap_region() and deprecate pcim_iomap_regions()
     (Philipp Stanner)

   - Request the PCI BAR used by xboxvideo (Philipp Stanner)

   - Request and map drm/ast BARs with pcim_iomap_region() (Philipp
     Stanner)

  MSI:

   - Add MSI_FLAG_NO_AFFINITY flag for devices that mux MSIs onto a
     single IRQ line and cannot set the affinity of each MSI to a
     specific CPU core (Marek Vasut)

   - Use MSI_FLAG_NO_AFFINITY and remove unnecessary .irq_set_affinity()
     implementations in aardvark, altera, brcmstb, dwc, mediatek-gen3,
     mediatek, mobiveil, plda, rcar, tegra, vmd, xilinx-nwl,
     xilinx-xdma, and xilinx drivers to avoid 'IRQ: set affinity failed'
     warnings (Marek Vasut)

  Power management:

   - Add pwrctl support for ATH11K inside the WCN6855 package (Konrad
     Dybcio)

  PCI device hotplug:

   - Remove unnecessary hpc_ops struct from shpchp (ngn)

   - Check for PCI_POSSIBLE_ERROR(), not 0xffffffff, in cpqphp
     (weiyufeng)

  Virtualization:

   - Mark Creative Labs EMU20k2 INTx masking as broken (Alex Williamson)

   - Add an ACS quirk for Qualcomm SA8775P, which doesn't advertise ACS
     but does provide ACS-like features (Subramanian Ananthanarayanan)

  IOMMU:

   - Add function 0 DMA alias quirk for Glenfly Arise audio function,
     which uses the function 0 Requester ID (WangYuli)

  NPEM:

   - Add Native PCIe Enclosure Management (NPEM) support for sysfs
     control of NVMe RAID storage indicators (ok/fail/locate/
     rebuild/etc) (Mariusz Tkaczyk)

   - Add support for the ACPI _DSM PCIe SSD status LED management, which
     is functionally similar to NPEM but mediated by platform firmware
     (Mariusz Tkaczyk)

  Device trees:

   - Drop minItems and maxItems from ranges in PCI generic host binding
     since host bridges may have several MMIO and I/O port apertures
     (Frank Li)

   - Add kirin, rcar-gen2, uniphier DT binding top-level constraints for
     clocks (Krzysztof Kozlowski)

  Altera PCIe controller driver:

   - Convert altera DT bindings from text to YAML (Matthew Gerlach)

   - Replace TLP_REQ_ID() with macro PCI_DEVID(), which does the same
     thing and is what other drivers use (Jinjie Ruan)

  Broadcom STB PCIe controller driver:

   - Add DT binding maxItems for reset controllers (Jim Quinlan)

   - Use the 'bridge' reset method if described in the DT (Jim Quinlan)

   - Use the 'swinit' reset method if described in the DT (Jim Quinlan)

   - Add 'has_phy' so the existence of a 'rescal' reset controller
     doesn't imply software control of it (Jim Quinlan)

   - Add support for many inbound DMA windows (Jim Quinlan)

   - Rename SoC 'type' to 'soc_base' express the fact that SoCs come in
     families of multiple similar devices (Jim Quinlan)

   - Add Broadcom 7712 DT description and driver support (Jim Quinlan)

   - Sort enums, pcie_offsets[], pcie_cfg_data, .compatible strings for
     maintainability (Bjorn Helgaas)

  Freescale i.MX6 PCIe controller driver:

   - Add imx6q-pcie 'dbi2' and 'atu' reg-names for i.MX8M Endpoints
     (Richard Zhu)

   - Fix a code restructuring error that caused i.MX8MM and i.MX8MP
     Endpoints to fail to establish link (Richard Zhu)

   - Fix i.MX8MP Endpoint occasional failure to trigger MSI by enforcing
     outbound alignment requirement (Richard Zhu)

   - Call phy_power_off() in the .probe() error path (Frank Li)

   - Rename internal names from imx6_* to imx_* since i.MX7/8/9 are also
     supported (Frank Li)

   - Manage Refclk by using SoC-specific callbacks instead of switch
     statements (Frank Li)

   - Manage core reset by using SoC-specific callbacks instead of switch
     statements (Frank Li)

   - Expand comments for erratum ERR010728 workaround (Frank Li)

   - Use generic PHY APIs to configure mode, speed, and submode, which
     is harmless for devices that implement their own internal PHY
     management and don't set the generic imx_pcie->phy (Frank Li)

   - Add i.MX8Q (i.MX8QM, i.MX8QXP, and i.MX8DXL) DT binding and driver
     Root Complex support (Richard Zhu)

  Freescale Layerscape PCIe controller driver:

   - Replace layerscape-pcie DT binding compatible fsl,lx2160a-pcie with
     fsl,lx2160ar2-pcie (Frank Li)

   - Add layerscape-pcie DT binding deprecated 'num-viewport' property
     to address a DT checker warning (Frank Li)

   - Change layerscape-pcie DT binding 'fsl,pcie-scfg' to phandle-array
     (Frank Li)

  Loongson PCIe controller driver:

   - Increase max PCI hosts to 8 for Loongson-3C6000 and newer chipsets
     (Huacai Chen)

  Marvell Aardvark PCIe controller driver:

   - Fix issue with emulating Configuration RRS for two-byte reads of
     Vendor ID; previously it only worked for four-byte reads (Bjorn
     Helgaas)

  MediaTek PCIe Gen3 controller driver:

   - Add per-SoC struct mtk_gen3_pcie_pdata to support multiple SoC
     types (Lorenzo Bianconi)

   - Use reset_bulk APIs to manage PHY reset lines (Lorenzo Bianconi)

   - Add DT and driver support for Airoha EN7581 PCIe controller
     (Lorenzo Bianconi)

  Qualcomm PCIe controller driver:

   - Update qcom,pcie-sc7280 DT binding with eight interrupts (Rayyan
     Ansari)

   - Add back DT 'vddpe-3v3-supply', which was incorrectly removed
     earlier (Johan Hovold)

   - Drop endpoint redundant masking of global IRQ events (Manivannan
     Sadhasivam)

   - Clarify unknown global IRQ message and only log it once to avoid a
     flood (Manivannan Sadhasivam)

   - Add 'linux,pci-domain' property to endpoint DT binding (Manivannan
     Sadhasivam)

   - Assign PCI domain number for endpoint controllers (Manivannan
     Sadhasivam)

   - Add 'qcom_pcie_ep' and the PCI domain number to IRQ names for
     endpoint controller (Manivannan Sadhasivam)

   - Add global SPI interrupt for PCIe link events to DT binding
     (Manivannan Sadhasivam)

   - Add global RC interrupt handler to handle 'Link up' events and
     automatically enumerate hot-added devices (Manivannan Sadhasivam)

   - Avoid mirroring of DBI and iATU register space so it doesn't
     overlap BAR MMIO space (Prudhvi Yarlagadda)

   - Enable controller resources like PHY only after PERST# is
     deasserted to partially avoid the problem that the endpoint SoC
     crashes when accessing things when Refclk is absent (Manivannan
     Sadhasivam)

   - Add 16.0 GT/s equalization and RX lane margining settings (Shashank
     Babu Chinta Venkata)

   - Pass domain number to pci_bus_release_domain_nr() explicitly to
     avoid a NULL pointer dereference (Manivannan Sadhasivam)

  Renesas R-Car PCIe controller driver:

   - Make the read-only const array 'check_addr' static (Colin Ian King)

   - Add R-Car V4M (R8A779H0) PCIe host and endpoint to DT binding
     (Yoshihiro Shimoda)

  TI DRA7xx PCIe controller driver:

   - Request IRQF_ONESHOT for 'dra7xx-pcie-main' IRQ since the primary
     handler is NULL (Siddharth Vadapalli)

   - Handle IRQ request errors during root port and endpoint probe
     (Siddharth Vadapalli)

  TI J721E PCIe driver:

   - Add DT 'ti,syscon-acspcie-proxy-ctrl' and driver support to enable
     the ACSPCIE module to drive Refclk for the Endpoint (Siddharth
     Vadapalli)

   - Extract the cadence link setup from cdns_pcie_host_setup() so link
     setup can be done separately during resume (Thomas Richard)

   - Add T_PERST_CLK_US definition for the mandatory delay between
     Refclk becoming stable and PERST# being deasserted (Thomas Richard)

   - Add j721e suspend and resume support (Théo Lebrun)

  TI Keystone PCIe controller driver:

   - Fix NULL pointer checking when applying MRRS limitation quirk for
     AM65x SR 1.0 Errata #i2037 (Dan Carpenter)

  Xilinx NWL PCIe controller driver:

   - Fix off-by-one error in INTx IRQ handler that caused INTx
     interrupts to be lost or delivered as the wrong interrupt (Sean
     Anderson)

   - Rate-limit misc interrupt messages (Sean Anderson)

   - Turn off the clock on probe failure and device removal (Sean
     Anderson)

   - Add DT binding and driver support for enabling/disabling PHYs (Sean
     Anderson)

   - Add PCIe phy bindings for the ZCU102 (Sean Anderson)

  Xilinx XDMA PCIe controller driver:

   - Add support for Xilinx QDMA Soft IP PCIe Root Port Bridge to DT
     binding and xilinx-dma-pl driver (Thippeswamy Havalige)

  Miscellaneous:

   - Fix buffer overflow in kirin_pcie_parse_port() (Alexandra Diupina)

   - Fix minor kerneldoc issues and typos (Bjorn Helgaas)

   - Use PCI_DEVID() macro in aer_inject() instead of open-coding it
     (Jinjie Ruan)

   - Check pcie_find_root_port() return in x86 fixups to avoid NULL
     pointer dereferences (Samasth Norway Ananda)

   - Make pci_bus_type constant (Kunwu Chan)

   - Remove unused declarations of __pci_pme_wakeup() and
     pci_vpd_release() (Yue Haibing)

   - Remove any leftover .*.cmd files with make clean (zhang jiao)

   - Remove unused BILLION macro (zhang jiao)"

* tag 'pci-v6.12-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (132 commits)
  PCI: Fix typos
  dt-bindings: PCI: qcom: Allow 'vddpe-3v3-supply' again
  tools: PCI: Remove unused BILLION macro
  tools: PCI: Remove .*.cmd files with make clean
  PCI: Pass domain number to pci_bus_release_domain_nr() explicitly
  PCI: dra7xx: Fix error handling when IRQ request fails in probe
  PCI: dra7xx: Fix threaded IRQ request for "dra7xx-pcie-main" IRQ
  PCI: qcom: Add RX lane margining settings for 16.0 GT/s
  PCI: qcom: Add equalization settings for 16.0 GT/s
  PCI: dwc: Always cache the maximum link speed value in dw_pcie::max_link_speed
  PCI: dwc: Rename 'dw_pcie::link_gen' to 'dw_pcie::max_link_speed'
  PCI: qcom-ep: Enable controller resources like PHY only after refclk is available
  PCI: Mark Creative Labs EMU20k2 INTx masking as broken
  dt-bindings: PCI: imx6q-pcie: Add reg-name "dbi2" and "atu" for i.MX8M PCIe Endpoint
  dt-bindings: PCI: altera: msi: Convert to YAML
  PCI: imx6: Add i.MX8Q PCIe Root Complex (RC) support
  PCI: Rename CRS Completion Status to RRS
  PCI: aardvark: Correct Configuration RRS checking
  PCI: Wait for device readiness with Configuration RRS
  PCI: brcmstb: Sort enums, pcie_offsets[], pcie_cfg_data, .compatible strings
  ...

Pull nfsd updates from Chuck Lever:
 "Notable features of this release include:

   - Pre-requisites for automatically determining the RPC server thread
     count

   - Clean-up and preparation for supporting LOCALIO, which will be
     merged via the NFS client tree

   - Enhancements and fixes to NFSv4.2 COPY offload

   - A new Python-based tool for generating kernel SunRPC XDR encoding
     and decoding functions, added as an aid for prototyping features in
     protocols based on the Linux kernel's SunRPC implementation

  As always I am grateful to the NFSD contributors, reviewers, testers,
  and bug reporters who participated during this cycle"

* tag 'nfsd-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (57 commits)
  xdrgen: Prevent reordering of encoder and decoder functions
  xdrgen: typedefs should use the built-in string and opaque functions
  xdrgen: Fix return code checking in built-in XDR decoders
  tools: Add xdrgen
  nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
  nfsd: fix initial getattr on write delegation
  nfsd: untangle code in nfsd4_deleg_getattr_conflict()
  nfsd: enforce upper limit for namelen in __cld_pipe_inprogress_downcall()
  nfsd: return -EINVAL when namelen is 0
  NFSD: Wrap async copy operations with trace points
  NFSD: Clean up extra whitespace in trace_nfsd_copy_done
  NFSD: Record the callback stateid in copy tracepoints
  NFSD: Display copy stateids with conventional print formatting
  NFSD: Limit the number of concurrent async COPY operations
  NFSD: Async COPY result needs to return a write verifier
  nfsd: avoid races with wake_up_var()
  nfsd: use clear_and_wake_up_bit()
  sunrpc: xprtrdma: Use ERR_CAST() to return
  NFSD: Annotate struct pnfs_block_deviceaddr with __counted_by()
  nfsd: call cache_put if xdr_reserve_space returns NULL
  ...

Pull gfs2 update from Andreas Gruenbacher:

 - Convert the writepage address space operation to writepages (Matthew
   Wilcox)

 - A syzkaller fix (by Julian Sun) and a minor cleanup (Andreas
   Gruenbacher)

* tag 'gfs2-v6.10-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
  gfs2: Remove gfs2_aspace_writepage()
  gfs2: Remove gfs2_jdata_writepage()
  gfs2: Remove __gfs2_writepage()
  gfs2: Add gfs2_aspace_writepages()
  gfs2: fix double destroy_workqueue error
  gfs2: Minor gfs2_glock_cb cleanup

Pull btrfs fixes from David Sterba:

 - fix dangling pointer to rb-tree of defragmented inodes after cleanup

 - a followup fix to handle concurrent lseek on the same fd that could
   leak memory under some conditions

 - fix wrong root id reported in tree checker when verifying dref

* tag 'for-6.12-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix use-after-free on rbtree that tracks inodes for auto defrag
  btrfs: tree-checker: fix the wrong output of data backref objectid
  btrfs: fix race setting file private on concurrent lseek using same fd

Pull quota and isofs updates from Jan Kara:
 "A few small cleanups in quota and isofs"

* tag 'fs_for_v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  isofs: Annotate struct SL_component with __counted_by()
  quota: remove unnecessary error code translation in dquot_quota_enable
  quota: remove redundant return at end of void function
  quota: remove unneeded return value of register_quota_format
  quota: avoid missing put_quota_format when DQUOT_SUSPENDED is passed

Pull bcachefs updates from Kent Overstreet:

 - rcu_pending, btree key cache rework: this solves lock contenting in
   the key cache, eliminating the biggest source of the srcu lock hold
   time warnings, and drastically improving performance on some metadata
   heavy workloads - on multithreaded creates we're now 3-4x faster than
   xfs.

 - We're now using an rhashtable instead of the system inode hash table;
   this is another significant performance improvement on multithreaded
   metadata workloads, eliminating more lock contention.

 - for_each_btree_key_in_subvolume_upto(): new helper for iterating over
   keys within a specific subvolume, eliminating a lot of open coded
   "subvolume_get_snapshot()" and also fixing another source of srcu
   lock time warnings, by running each loop iteration in its own
   transaction (as the existing for_each_btree_key() does).

 - More work on btree_trans locking asserts; we now assert that we don't
   hold btree node locks when trans->locked is false, which is important
   because we don't use lockdep for tracking individual btree node
   locks.

 - Some cleanups and improvements in the bset.c btree node lookup code,
   from Alan.

 - Rework of btree node pinning, which we use in backpointers fsck. The
   old hacky implementation, where the shrinker just skipped over nodes
   in the pinned range, was causing OOMs; instead we now use another
   shrinker with a much higher seeks number for pinned nodes.

 - Rebalance now uses BCH_WRITE_ONLY_SPECIFIED_DEVS; this fixes an issue
   where rebalance would sometimes fall back to allocating from the full
   filesystem, which is not what we want when it's trying to move data
   to a specific target.

 - Use __GFP_ACCOUNT, GFP_RECLAIMABLE for btree node, key cache
   allocations.

 - Idmap mounts are now supported (Hongbo Li)

 - Rename whiteouts are now supported (Hongbo Li)

 - Erasure coding can now handle devices being marked as failed, or
   forcibly removed. We still need the evacuate path for erasure coding,
   but it's getting very close to ready for people to start using.

* tag 'bcachefs-2024-09-21' of git://evilpiepirate.org/bcachefs: (99 commits)
  bcachefs: return err ptr instead of null in read sb clean
  bcachefs: Remove duplicated include in backpointers.c
  bcachefs: Don't drop devices with stripe pointers
  bcachefs: bch2_ec_stripe_head_get() now checks for change in rw devices
  bcachefs: bch_fs.rw_devs_change_count
  bcachefs: bch2_dev_remove_stripes()
  bcachefs: bch2_trigger_ptr() calculates sectors even when no device
  bcachefs: improve error messages in bch2_ec_read_extent()
  bcachefs: improve error message on too few devices for ec
  bcachefs: improve bch2_new_stripe_to_text()
  bcachefs: ec_stripe_head.nr_created
  bcachefs: bch_stripe.disk_label
  bcachefs: stripe_to_mem()
  bcachefs: EIO errcode cleanup
  bcachefs: Rework btree node pinning
  bcachefs: split up btree cache counters for live, freeable
  bcachefs: btree cache counters should be size_t
  bcachefs: Don't count "skipped access bit" as touched in btree cache scan
  bcachefs: Failed devices no longer require mounting in degraded mode
  bcachefs: bch2_dev_rcu_noerror()
  ...

Pull 'struct fd' updates from Al Viro:
 "Just the 'struct fd' layout change, with conversion to accessor
  helpers"

* tag 'pull-stable-struct_fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  add struct fd constructors, get rid of __to_fd()
  struct fd: representation change
  introduce fd_file(), convert all accessors to it.

The merge resolution to deal with the conflict between commits
ea72ce5d ("x86/kaslr: Expose and use the end of the physical memory
address space") and 99185c10 ("resource, kunit: add test case for
region_intersects()") ended up being broken in configurations didn't
define a MAX_PHYSMEM_BITS and that had a 32-bit 'phys_addr_t'.

The fallback to using all bits set (ie "(-1ULL)") ended up causing a
build error:

    kernel/resource.c: In function ‘gfr_start’:
    include/linux/minmax.h:93:30: error: conversion from ‘long long unsigned int’ to ‘resource_size_t’ {aka ‘unsigned int’} changes value from ‘18446744073709551615’ to ‘4294967295’ [-Werror=overflow]

this was reported by Geert for m68k, but he points out that it happens
on other 32-bit architectures too, eg mips, xtensa, parisc, and powerpc.

Limiting 'PHYSMEM_END' to a 'phys_addr_t' (which is the same as
'resource_size_t') fixes the build, but Geert points out that it will
then cause a silent overflow in mm/sparse.c:

	unsigned long max_sparsemem_pfn = (PHYSMEM_END + 1) >> PAGE_SHIFT;

so we actually do want PHYSMEM_END to be defined a 64-bit type - just
not all ones, and not larger than 'phys_addr_t'.

The proper fix is probably to not have some kind of default fallback at
all, but just make sure every architecture has a valid MAX_PHYSMEM_BITS.
But in the meantime, this just applies the rule that PHYSMEM_END is the
largest value that fits in a 'phys_addr_t', but does not have the high
bit set in 64 bits.

Ugly, ugly.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Huang Ying <ying.huang@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Replace a comma between expression statements by a semicolon.
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://lore.kernel.org/r/20240902085019.4111445-1-nichen@iscas.ac.cnSigned-off-by: Lee Jones <lee@kernel.org>

Document the compatible for sa8775p SoC.
Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20240830133908.2246139-1-quic_mojha@quicinc.comSigned-off-by: Lee Jones <lee@kernel.org>

Add Intel Panther Lake-H/P PCI IDs.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240829095719.1557-3-ilpo.jarvinen@linux.intel.comSigned-off-by: Lee Jones <lee@kernel.org>

Add Intel Arrow Lake-H PCI IDs.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240829095719.1557-2-ilpo.jarvinen@linux.intel.comSigned-off-by: Lee Jones <lee@kernel.org>

Document rk3576 compatible for QoS registers.
Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/01020191998a2fd4-4d7b091c-9c4c-4067-b8d9-fe7482074d6d-000000@eu-west-1.amazonses.comSigned-off-by: Lee Jones <lee@kernel.org>

Allow parsing GPIO controller children nodes with GPIO hogs.
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240828030405.2851611-1-haibo.chen@nxp.comSigned-off-by: Lee Jones <lee@kernel.org>

There's no need to list "tc3589x" in the DT match table. The I2C core
will strip any vendor prefix and match against the i2c_device_id table
which has an "tc3589x" entry.

Probably "tc3589x" and TC3589X_UNKNOWN could be removed altogether.
Use of that compatible was only on some STE platforms and was dropped
in 2013. There were ABI breaks in 2014 claiming no DTs in the wild. See
commit 1637d480 ("pinctrl: nomadik: force-convert to generic config
bindings").
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20240826191300.1410222-1-robh@kernel.orgSigned-off-by: Lee Jones <lee@kernel.org>

Avoids the need for manual cleanup of_node_put() in early exits
from the loop.
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20240826092734.2899562-3-ruanjinjie@huawei.comSigned-off-by: Lee Jones <lee@kernel.org>

Avoids the need for manual cleanup of_node_put() in early exits
from the loop.
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20240826092734.2899562-2-ruanjinjie@huawei.comSigned-off-by: Lee Jones <lee@kernel.org>

There are 2G and 4G RAM versions of the Lenovo Yoga Tab 3 X90F and it
turns out that the 2G version has a DMI product name of
"CHERRYVIEW D1 PLATFORM" where as the 4G version has
"CHERRYVIEW C0 PLATFORM". The sys-vendor + product-version check are
unique enough that the product-name check is not necessary.

Drop the product-name check so that the existing DMI match for the 4G
RAM version also matches the 2G RAM version.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20240825132617.8809-1-hdegoede@redhat.comSigned-off-by: Lee Jones <lee@kernel.org>

The module description can be backtracked to commit e7c256fb
("platform/chrome: Add Chrome OS EC userspace device interface").

The description became out-of-date after a bunch of changes e.g:

- commit 5668bfdd ("platform/chrome: cros_ec_dev - Register cros-ec sensors").
- commit ea01a31b ("cros_ec: Split cros_ec_devs module").
- commit 5e011558 ("cros_ec: Move cros_ec_dev module to drivers/mfd").

Update the description.
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/20240822121539.4265-1-tzungbi@kernel.orgSigned-off-by: Lee Jones <lee@kernel.org>

Simplify cros_ec_dev_init() by the following changes:
- Get rid of label `failed_devreg`.
- Remove a redundant space and comment.
- Use `if (ret)` instead of `if (ret < 0)`.
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/20240819102326.5235-1-tzungbi@kernel.orgSigned-off-by: Lee Jones <lee@kernel.org>

Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded
based on the alias from of_device_id table.
Signed-off-by: Liao Chen <liaochen4@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240814025710.3875859-1-liaochen4@huawei.comSigned-off-by: Lee Jones <lee@kernel.org>

The ArmSoM Sige 5 board connects the rk806 PMIC on an i2c bus.
Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
Link: https://lore.kernel.org/r/20240802134736.283851-1-detlev.casanova@collabora.comSigned-off-by: Lee Jones <lee@kernel.org>