Merge tag 'v6.17-rockchip-dts64-1' of https://git./linux/kernel/git/mmind/linux-rockchip into soc/dt

New boards: ROC-RK3588S-PC, Luckfox Omni3576, Radxa Rock 5T,
Sakura Pi RK3308B - all of them have the used soc in their name.

New overlays: RockPro64 screen, optional Sige5 Wifi/BT module,
ethernet-switch addon for Jaguar.

Added peripherals on rk3528 (spi, power-domain controller, gpu)
and sdio controller on rk3576.

DSI display support for the Gameforce-ACE handheld, a fix for the
cover-detection (closed/open) on the PineNote, camera support for
the Haikou Video Demo overlay on PX30 Ringneck as well as a number
of other newly enabled peripherals on a number of boards.

* tag 'v6.17-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (40 commits)
  arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C
  arm64: dts: rockchip: Add bluetooth support to ArmSoM Sige7
  arm64: dts: rockchip: enable PCIe on ROCK 4D
  arm64: dts: rockchip: Enable HDMI receiver on CM3588
  arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576
  arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576
  arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC
  dt-bindings: arm: rockchip: Add Firefly ROC-RK3588S-PC
  arm64: dts: rockchip: Enable GPU on Radxa E20C
  arm64: dts: rockchip: Add GPU node for RK3528
  arm64: dts: rockchip: support camera module on Haikou Video Demo on PX30 Ringneck
  arm64: dts: rockchip: add label to first port of ISP on px30
  arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP
  arm64: dts: rockchip: Add power controller for RK3528
  arm64: dts: rockchip: enable USB on Sige5
  arm64: dts: rockchip: add overlay for the WiFi/BT module on Sige5 v1.2
  arm64: dts: rockchip: add version-independent WiFi/BT nodes on Sige5
  arm64: dts: rockchip: add SDIO controller on RK3576
  arm64: dts: rockchip: Enable gpu on rk3576-evb1-v10
  arm64: dts: rockchip: Update the PinePhone Pro panel description
  ...

Link: https://lore.kernel.org/r/15465458.uLZWGnKmhe@phil
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: nuvoton: npcm8xx: Drop the GIC "ppi-partitions" node

The Arm GIC "ppi-partitions" node is only relevant to GICv3 and makes no
sense for GICv2 implementations which the GIC-400 is. PPIs in GICv2 have
no CPU affinity.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20250609203721.2852879-1-robh@kernel.org
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://lore.kernel.org/r/20250710-nuvoton-arm64-dt-v1-1-ec7db96ea507@codeconstruct.com.au
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'aspeed-6.17-devicetree-1' of https://git./linux/kernel/git/bmc/linux into soc/dt

ASPEED devicetree updates for 6.17

Removed platforms:

- IBM's Swift BMC

New platforms:

- Meta's Santabarbara

  Santabarbara is a compute node with an accelerator module

- NVIDIA's GB200NVL BMC

  NVIDIA GB200 NVL72 connects 36 Grace CPUs and 72 Blackwell GPUs in an NVIDIA
  NVLink-connected, liquid-cooled, rack-scale design.

Updated BMC platforms:

- Bletchley (Meta): GPIO hog names, remove ethernet-phy node, USB PD negotiation
- Catalina (Meta): Various sensors added, MCTP support for NIC management
- Harma (Meta): Various sensors added
- System1 (IBM): IPMB and various GPIO-related updates
- Yosemite4 (Meta): GPIO names for UART mux select lines

The System1 series includes a devicetree binding patch for IPMI IPMB devices.

* tag 'aspeed-6.17-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: (34 commits)
  ARM: dts: aspeed: yosemite4: add gpio name for uart mux sel
  ARM: dts: aspeed: santabarbara: Add Meta Santabarbara BMC
  dt-bindings: arm: aspeed: add Meta Santabarbara board
  ARM: dts: aspeed: bletchley: enable USB PD negotiation
  ARM: dts: aspeed: lanyang: Fix 'lable' typo in LED nodes
  ARM: dts: aspeed: harma: add mmc health
  ARM: dts: aspeed: Harma: revise gpio bride pin for battery
  ARM: dts: aspeed: harma: add ADC128D818 for voltage monitoring
  ARM: dts: aspeed: harma: add fan board I/O expander
  ARM: dts: aspeed: harma: add E1.S power monitor
  ARM: dts: aspeed: catalina: Enable MCTP for frontend NIC management
  ARM: dts: aspeed: Add device tree for Nvidia's GB200NVL BMC
  dt-bindings: arm: aspeed: add Nvidia's GB200NVL BMC
  ARM: dts: aspeed: catalina: Enable MCTP support for NIC management
  ARM: dts: aspeed: catalina: Update CBC FRU EEPROM I2C bus and address
  ARM: dts: aspeed: catalina: Enable multi-master on additional I2C buses
  ARM: dts: aspeed: catalina: Remove INA238 and INA230 nodes
  ARM: dts: aspeed: catalina: Add second source HSC node support
  ARM: dts: aspeed: catalina: Add second source fan controller support
  ARM: dts: aspeed: catalina: Add fan controller support
  ...

Link: https://lore.kernel.org/r/36d50489cac1fbae01ec699b742f6c6c459a01cb.camel@codeconstruct.com.au
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-dts-for-v6.17-tag2' of https://git./linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DTS updates for v6.17 (take two)

  - Add support for the Renesas Gray Hawk Single board with R-Car
    V4M-7 (R8A779H2),
  - Add eMMC and microSD expansion board support for the RZ/V2H and
    RZ/V2N EVK development boards,
  - Add GPIO keys and Ethernet support for the RZ/G3E SoM and SMARC
    Carrier-II EVK development board,
  - Add QSPI FLASH support for the RZ/V2H and RZ/V2N SoCs and their EVK
    development boards,
  - Miscellaneous fixes and improvements.

* tag 'renesas-dts-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable serial NOR FLASH
  arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable serial NOR FLASH
  arm64: dts: renesas: r9a09g057: Add XSPI node
  arm64: dts: renesas: r9a09g056: Add XSPI node
  arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Fix pinctrl node name for GBETH1
  arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Fix pinctrl node name for GBETH1
  arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target
  arm64: dts: renesas: rzg3e-smarc-som: Enable eth{0-1} (GBETH) interfaces
  arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys
  arm64: dts: renesas: Add CN15 eMMC and SD overlays for RZ/V2H and RZ/V2N EVKs
  arm64: dts: renesas: r8a779h2: Add Gray Hawk Single support
  arm64: dts: renesas: Add Renesas R8A779H2 SoC support
  arm64: dts: renesas: Factor out Gray Hawk Single board support
  dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock

Link: https://lore.kernel.org/r/cover.1752090401.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-dt-bindings-for-v6.17-tag2' of https://git./linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DT binding updates for v6.17 (take two)

  - Document support for the Renesas Gray Hawk Single board with R-Car
    V4M-7 (R8A779H2).

* tag 'renesas-dt-bindings-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  dt-bindings: soc: renesas: Document R-Car V4M-7 Gray Hawk Single

Link: https://lore.kernel.org/r/cover.1752090400.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'samsung-dt64-6.17' of https://git./linux/kernel/git/krzk/linux into soc/dt

Samsung DTS ARM64 changes for v6.17

1. New SoC - Exynos2200 SoC - with basic nodes, pin controllers,
   clock controllers and initial USB support.  Add board using it:
   Samsung Galaxy S22+ (SM-S906B), called G0S.

2. ExynosAutov920: Add CMU_HSI2 clock controller, remaining SPI nodes

3. Google GS101:
   - Prepare to switching to architected timer, instead of Exynos MCT as
     the primary one.
   - Add secondary Maxim MAX77759 PMIC to Pixel boards, managing USB Type-C and
     charger.
   - Add incomplete description of the primary Samsung S2MPG10 PMIC.
     Several bits, like regulators, are still missing, though.
   - Add also secondary reboot-mode, via MAX77759 NVMEM.
   - Switch the primary (SoC) reboot handler to Google specific
     google,gs101-reboot which gives additional GS101 features (cold and
     warm reboots).
     This change will affect other users of this DTS, but to our
     knowledge there is only Android, from which this change originates.

4. Exynos7870:
   - Fix speed problems in USB gadget mode.
   - Correct memory map to avoid crashes due to secure world.

* tag 'samsung-dt64-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount
  arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount
  arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode
  arm64: dts: exynos: gs101: switch to gs101 specific reboot
  arm64: dts: exynos: gs101-pixel-common: add main PMIC node
  arm64: dts: exynos: gs101: ufs: add dma-coherent property
  arm64: dts: exynos: gs101: add dm-verity-device-corrupted syscon-reboot-mode
  arm64: dts: exynos: gs101-pixel-common: add nvmem-reboot-mode
  arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 PMIC
  arm64: dts: exynos5433: Align i2c-gpio node names with dtschema
  arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes
  arm64: dts: exynosautov920: Add DT node for all SPI ports
  arm64: dts: exynosautov920: add CMU_HSI2 clock DT nodes
  MAINTAINERS: add entry for Samsung Exynos2200 SoC
  arm64: dts: exynos: add initial support for Samsung Galaxy S22+
  arm64: dts: exynos: add initial support for exynos2200 SoC
  dt-bindings: arm: samsung: document g0s board binding

Link: https://lore.kernel.org/r/20250709191523.171359-6-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'samsung-dt-6.17' of https://git./linux/kernel/git/krzk/linux into soc/dt

Samsung DTS ARM changes for v6.17

Just few cleanups based on dtbs_check.

* tag 'samsung-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
  ARM: dts: s5pv210: Align i2c-gpio node names with dtschema
  ARM: dts: exynos: Align i2c-gpio node names with dtschema

Link: https://lore.kernel.org/r/20250709191523.171359-5-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'dt-vt8500-6.17' of https://git./linux/kernel/git/krzk/linux-dt into soc/dt

VT8500 DTS ARM changes for v6.17

1. Several dtbs_check cleanups.
2. Add missing cache topology - L2 cache controller on WM8850/WM895.

* tag 'dt-vt8500-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt:
  ARM: dts: vt8500: Add L2 cache controller on WM8850/WM8950
  ARM: dts: vt8500: Fix the unit address of the VT8500 LCD controller
  ARM: dts: vt8500: Use generic node name for the SD/MMC controller
  ARM: dts: vt8500: Move memory nodes to board dts and fix addr/size
  ARM: dts: vt8500: Add node address and reg in CPU nodes

Link: https://lore.kernel.org/r/20250709184800.168462-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable serial NOR FLASH

Enable MT25QU512ABB8E12 FLASH connected to XSPI.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250704140823.163572-5-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable serial NOR FLASH

Enable MT25QU512ABB8E12 FLASH connected to XSPI.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250704140823.163572-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g057: Add XSPI node

Add XSPI node to RZ/V2H(P) ("R9A09G057") SoC DTSI.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250704140823.163572-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g056: Add XSPI node

Add XSPI node to RZ/V2N ("R9A09G056") SoC DTSI.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250704140823.163572-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

Merge tag 'renesas-r9a09g057-dt-binding-defs-tag4' into renesas-dts-for-v6.17

Renesas RZ/V2N and RZ/V2H XSPI Clock DT Binding Definitions

Expanded Serial Peripheral Interface (XSPI) clock DT binding definitions
for the Renesas RZ/V2N (R9A09G056) and RZ/V2H (R9A09G057) SoCs, shared
by driver and DT source files.

arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Fix pinctrl node name for GBETH1

Rename the GBETH1 pinctrl node from "eth0" to "eth1" to avoid duplicate
node names in the DT and correctly reflect the label "eth1_pins".

Fixes: f111192baa80 ("arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable GBETH")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250703235544.715433-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Fix pinctrl node name for GBETH1

Rename the GBETH1 pinctrl node from "eth0" to "eth1" to avoid duplicate
node names in the DT and correctly reflect the label "eth1_pins".

Fixes: 802292ee27a7 ("arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable GBETH")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250703235544.715433-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target

The target to consider the dtbo file for installation is missing, add
it.

Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support")
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/20250701112612.3957799-2-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: rzg3e-smarc-som: Enable eth{0-1} (GBETH) interfaces

Enable the Gigabit Ethernet Interfaces (GBETH) populated on the RZ/G3E SMARC EVK

Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250702005706.1200059-5-john.madieu.xa@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys

RZ/G3E SMARC EVK  has 3 user buttons called USER_SW1, USER_SW2 and
USER_SW3 and SLEEP button with NMI support. Add a DT node in device tree
to instantiate the gpio-keys driver for these buttons.

The system can enter into STR state by pressing the sleep button and
wakeup from STR is done by pressing power button. The USER_SW{1,2,3}
configured as wakeup-source, so it can wakeup the system during s2idle.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250702092755.70847-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount

The device is available in multiple variants with differing RAM
capacities. The memory range defined in the 0x80000000 bank exceeds the
address range of the memory controller, which eventually leads to ARM
SError crashes. Reduce the bank size to a value which is available to
all devices.

The bootloader must be responsible for identifying the RAM capacity and
editing the memory node accordingly.

Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870")
Cc: stable@vger.kernel.org # v6.16
Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-3-349987874d9a@disroot.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount

The device is available in multiple variants with differing RAM
capacities. The memory range defined in the 0x80000000 bank exceeds the
address range of the memory controller, which eventually leads to ARM
SError crashes. Reduce the bank size to a value which is available to
all devices.

The bootloader must be responsible for identifying the RAM capacity and
editing the memory node accordingly.

Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870")
Cc: stable@vger.kernel.org # v6.16
Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-2-349987874d9a@disroot.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode

In gadget mode, USB connections are sluggish. The device won't send
packets to the host unless the host sends packets to the device. For
instance, SSH-ing through the USB network would apparently not work
unless you're flood-pinging the device's IP.

Add the property snps,usb2-gadget-lpm-disable to the dwc3 node, which
seems to solve this issue.

Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870")
Cc: stable@vger.kernel.org # v6.16
Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-1-349987874d9a@disroot.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

ARM: dts: aspeed: yosemite4: add gpio name for uart mux sel

Add gpio line name to support multiplexed console

Signed-off-by: Marshall Zhan <marshall_zhan@wiwynn.com>
Link: https://patch.msgid.link/20250630073138.3315947-1-marshall_zhan@wiwynn.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: santabarbara: Add Meta Santabarbara BMC

Add linux device tree entry related to the Meta (Facebook) compute node
system using an AST2600 BMC.

This node is named "Santabarbara". It is a compute node with accelerator
module. The system monitors voltage and temperature for the CPU, switch,
and NIC components on the motherboard and switch board.

Signed-off-by: Fred Chen <fredchen.openbmc@gmail.com>
Link: https://patch.msgid.link/20250625073847.4054971-3-fredchen.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

dt-bindings: arm: aspeed: add Meta Santabarbara board

Document the new compatibles used on Facebook Santabarbara.

Signed-off-by: Fred Chen <fredchen.openbmc@gmail.com>
Link: https://patch.msgid.link/20250625073847.4054971-2-fredchen.openbmc@gmail.com
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: bletchley: enable USB PD negotiation

- Enable USB Power Delivery with revision 2.0 for all sleds
- Configure dual power/data roles with sink preference

Signed-off-by: Cosmo Chou <chou.cosmo@gmail.com>
Link: https://patch.msgid.link/20250622034247.3985727-1-chou.cosmo@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: lanyang: Fix 'lable' typo in LED nodes

Fix an obvious spelling error in the DTS file for the Lanyang BMC
("lable" -> "label"). This was reported by bugzilla a few years ago
but never got fixed.

Reported-by: Jens Schleusener <Jens.Schleusener@fossies.org>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=205891
Signed-off-by: Ankit Chauhan <ankitchauhan2065@gmail.com>
Link: https://patch.msgid.link/20250612075057.80433-1-ankitchauhan2065@gmail.com
[arj: Replace U+2192 with '->']
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: harma: add mmc health

Add a GPIO expander node at address 0x13 on i2c11 bus
to monitor MMC health status via a dedicated GPIO line.

Signed-off-by: Peter Yin <peteryin.openbmc@gmail.com>
Link: https://patch.msgid.link/20250611080514.3123335-6-peteryin.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: Harma: revise gpio bride pin for battery

Update the GPIO bridge pin configuration for the battery circuit
on the Harma platform to reflect the correct hardware design.

Signed-off-by: Peter Yin <peteryin.openbmc@gmail.com>
Link: https://patch.msgid.link/20250611080514.3123335-5-peteryin.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: harma: add ADC128D818 for voltage monitoring

Add the ADC128D818 device to I2C bus 29 to support voltage monitoring
on the Harma platform. This enables accurate measurement of system
voltages through the onboard ADC.

Signed-off-by: Peter Yin <peteryin.openbmc@gmail.com>
Link: https://patch.msgid.link/20250611080514.3123335-4-peteryin.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: harma: add fan board I/O expander

Add GPIO I/O expander node for the fan board to detect and monitor
fan board status.

Signed-off-by: Peter Yin <peteryin.openbmc@gmail.com>
Link: https://patch.msgid.link/20250611080514.3123335-3-peteryin.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: harma: add E1.S power monitor

Add the E1.S power monitor device node to the Harma device tree
to enable power monitoring functionality for E1.S drives.

Signed-off-by: Peter Yin <peteryin.openbmc@gmail.com>
Link: https://patch.msgid.link/20250611080514.3123335-2-peteryin.openbmc@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

ARM: dts: aspeed: catalina: Enable MCTP for frontend NIC management

Add the `mctp-controller` property and MCTP nodes to enable support for
frontend NIC management via PLDM over MCTP.

Signed-off-by: Potin Lai <potin.lai.pt@gmail.com>
Link: https://patch.msgid.link/20250611-catalina-mctp-i2c-10-15-v1-1-2a882e461ed9@gmail.com
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>

Merge tag 'arm-soc/for-6.17/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt

This pull request contains Broadcom ARM64-based SoCs Device Tree updates
for 6.17, please pull the following:

- Linus updates the 64-bit BCMBCA SoCs Device Tree with the common
  peripherals that exit as well as correct IRQ assignments

- Andrea adds support for the RP1 companion chip on the Raspberry Pi 5
  systems with clocks, gpios, pinctrl, all of that using an overlay to
  describe those peripherals

- Rob drops the interrupt-parent property from the GICv2M node on
  Northstar2 SoCs

* tag 'arm-soc/for-6.17/devicetree-arm64' of https://github.com/Broadcom/stblinux:
  arm64: dts: broadcom: northstar2: Drop GIC V2M "interrupt-parent"
  arm64: dts: broadcom: Add overlay for RP1 device
  arm64: dts: broadcom: Add board DTS for Rpi5 which includes RP1 node
  arm64: dts: bcm2712: Add external clock for RP1 chipset on Rpi5
  arm64: dts: rp1: Add support for RaspberryPi's RP1 device
  dt-bindings: misc: Add device specific bindings for RaspberryPi RP1
  dt-bindings: pinctrl: Add RaspberryPi RP1 gpio/pinctrl/pinmux bindings
  dt-bindings: clock: Add RaspberryPi RP1 clock bindings
  ARM64: dts: bcm63158: Add BCMBCA peripherals
  ARM64: dts: bcm6858: Add BCMBCA peripherals
  ARM64: dts: bcm6856: Add BCMBCA peripherals
  ARM64: dts: bcm4908: Add BCMBCA peripherals

Link: https://lore.kernel.org/r/20250630190216.1518354-3-florian.fainelli@broadcom.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

MAINTAINERS: Switch ASPEED tree to shared BMC repository

We now have a shared repo with write access provided to M:s for the
ASPEED SoCs.

Cc: Joel Stanley <joel@jms.id.au>
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

ARM: dts: lpc32xx: Add #pwm-cells property to the two SoC PWMs

If these PWMs are to be used, a #pwm-cells property is necessary. The
right location for that is in the SoC's dtsi file to not make
machine.dts files repeat the value for each usage. Currently the
machines based on nxp/lpc/lpc32xx.dtsi don't make use of the PWMs, so
there are no properties to drop there.

Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'arm-soc/for-6.17/devicetree' of https://github.com/Broadcom/stblinux into soc/dt

This pull request contains Broadcom ARM-based SoCs Device Tree updates
for 6.17, please pull the following:

- Linus makes a number of updates to the BCMBCA SoCs Device Tree files
  to correct UART interrupt numbers, add interrupts to the RNG block,
  and leverage the fact that all SoCs have the same peripherals at the
  same aperture

- Uwe corrects the Merakia MX6X DTS file to have #pwm-cells = 3 as per
  the binding

* tag 'arm-soc/for-6.17/devicetree' of https://github.com/Broadcom/stblinux:
  ARM: dts: bcm958625-meraki-mx6x: Use #pwm-cells = <3>
  ARM: dts: bcm63178: Add BCMBCA peripherals
  ARM: dts: bcm63148: Add BCMBCA peripherals
  ARM: dts: bcm63138: Add BCMBCA peripherals
  ARM: dts: bcm6878: Add BCMBCA peripherals
  ARM: dts: bcm6855: Add BCMBCA peripherals
  ARM: dts: bcm6846: Add interrupt to RNG
  dt-bindings: rng: r200: Add interrupt property
  ARM: dts: bcm6878: Correct UART0 IRQ number

Link: https://lore.kernel.org/r/20250630190216.1518354-2-florian.fainelli@broadcom.com
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-dts-for-v6.17-tag1' of https://git./linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DTS updates for v6.17

  - Add SPI FLASH, camera, and Ethernet support on the RZ/G3E SoC and/or
    the RZ/G3E SoM and SMARC Carrier-II EVK development board,
  - Add Ethernet, USB2, and PMIC support on the RZ/V2H and RZ/V2N SoCs
    and EVK boards,
  - Add timer, I2C, watchdog, and GPU support on the RZ/V2N SoC and the
    RZ/V2N EVK board,
  - Add debug LED support for the RZN1D-DB development board,
  - Improve PCIe clock description on the Retronix Sparrow Hawk board,
  - Miscellaneous fixes and improvements.

* tag 'renesas-dts-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (34 commits)
  arm64: dts: renesas: r9a09g047: Add GBETH nodes
  arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Rename fixed regulator node names
  arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add RAA215300 PMIC
  arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add RAA215300 PMIC
  arm64: dts: renesas: rcar-gen3: Add bootph-all to sysinfo EEPROMs
  arm64: dts: renesas: sparrow-hawk: Describe split PCIe clock
  arm64: dts: renesas: r8a779g0: Describe PCIe root ports
  arm64: dts: renesas: ebisu: Add CAN0 support
  ARM: dts: renesas: r9a06g032: Add second clock input to RTC
  arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable USB2.0 support
  arm64: dts: renesas: r9a09g056: Add USB2.0 support
  arm64: dts: renesas: r8a779g3-sparrow-hawk: Sort DTS
  ARM: dts: renesas: r9a06g032-rzn1d400-db: Describe debug LEDs
  arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable USB2.0 support
  PCI/pwrctrl: Add optional slot clock for PCI slots
  arm64: dts: renesas: r9a09g057: Add USB2.0 support
  arm64: dts: renesas: r9a09g047e57-smarc: Enable CRU, CSI support
  arm64: dts: renesas: renesas-smarc2: Enable I2C0 node
  arm64: dts: renesas: r9a09g047e57-smarc: Add I2C0 pincontrol
  arm64: dts: renesas: r9a09g047: Add CRU, CSI2 nodes
  ...

Link: https://lore.kernel.org/r/cover.1751026664.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-dt-bindings-for-v6.17-tag1' of https://git./linux/kernel/git/geert/renesas-devel into soc/dt

Renesas DT binding updates for v6.17

  - Document more board part numbers.

* tag 'renesas-dt-bindings-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  dt-bindings: soc: renesas: Document RZ/T2H Evaluation Board part number
  dt-bindings: soc: renesas: Document RZ/V2H EVK board part number

Link: https://lore.kernel.org/r/cover.1751026663.git.geert+renesas@glider.be
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: cavium: thunder2: Add missing PL011 "uartclk"

The PL011 IP has 2 clock inputs for UART core/baud and APB bus. The
Thunder2 SoC is missing the core "uartclk". In this case, the Linux
driver uses single clock for both clock inputs. Let's assume that's how
the h/w is wired and make the DT reflect that.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20250609215706.3009692-2-robh@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: lg: Add missing PL011 "uartclk"

The PL011 IP has 2 clock inputs for UART core/baud and APB bus. The
LG131x SoCs are missing the core "uartclk". In this case, the Linux
driver uses single clock for both clock inputs. Let's assume that's how
the h/w is wired and make the DT reflect that.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Chanho Min <chanho.min@lge.com>
Link: https://lore.kernel.org/r/20250609-dt-lg-fixes-v1-2-e210e797c2d7@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: lg: Refactor common LG1312 and LG1313 parts

The LG1312 and LG1313 DT are almost identical with the exception of the
ethernet node. Refactor the common parts into a separate .dtsi file and
include it.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Acked-by: Chanho Min <chanho.min@lge.com>
Link: https://lore.kernel.org/r/20250609-dt-lg-fixes-v1-1-e210e797c2d7@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

arm64: dts: renesas: Add CN15 eMMC and SD overlays for RZ/V2H and RZ/V2N EVKs

Introduce device tree overlays for supporting the eMMC (RTK0EF0186B02000BJ)
and microSD (RTK0EF0186B01000BJ) sub-boards connected via the CN15
connector on the RZ/V2H and RZ/V2N evaluation kits.

These overlays enable SDHI0 with appropriate pin control settings, power
regulators, and GPIO handling. Both sub-boards are supported using shared
overlay files that can be applied to either EVK due to their identical
connector layout and interface support.

To support this, new DT overlay files are added:
- `rzv2-evk-cn15-emmc.dtso` for eMMC
- `rzv2-evk-cn15-sd.dtso` for microSD

Additionally, the base DTS files for both EVKs are updated to include a
fixed 1.8V regulator (`reg_1p8v`) needed by the eMMC sub-board and
potential future use cases such as HDMI output.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250627193742.110818-1-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r8a779h2: Add Gray Hawk Single support

The Gray Hawk Single board with R-Car V4M-7 (R8A779H2) uses an updated
version of the R-Car V4M (R8A779H0) SoC.

For now, there are no visible differences compared to the variant
equipped with an R-Car V4M (R8A779H0) SoC.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/d2e0e7b746063368b83148100aa553cff55b8b60.1750931027.git.geert+renesas@glider.be

arm64: dts: renesas: Add Renesas R8A779H2 SoC support

Add support for the Renesas R-Car V4M-7 (R8A779H2) SoC, which is
an updated version of the R-Car V4M (R8A779H0) SoC.

Signed-off-by: Tam Nguyen <tam.nguyen.xa@renesas.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/294ca4211c5a73942dc2ca04ae6d3c384d534f2b.1750931027.git.geert+renesas@glider.be

arm64: dts: renesas: Factor out Gray Hawk Single board support

Move the common parts for the Renesas Gray Hawk Single board to
gray-hawk-single.dtsi, to enable future reuse.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/a3e89836fde8073ac320734cec67f89ddfa8879a.1750931027.git.geert+renesas@glider.be

dt-bindings: soc: renesas: Document R-Car V4M-7 Gray Hawk Single

Document the compatible values for the Renesas R-Car V4M-7
(R8A779H2) SoC, as used on the Renesas Gray Hawk Single board.
R-Car V4M-7 is an updated version of R-Car V4M (R8A779H0).

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: "Rob Herring (Arm)" <robh@kernel.org>
Link: https://lore.kernel.org/b4283a68aa01c82d4435ee8334093dcbdf5bd4d2.1750931027.git.geert+renesas@glider.be

dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock

Add XSPI core clock definitions to the clock bindings for the Renesas
R9A09G056 and R9A09G057 SoCs. These clocks IDs are used to support XSPI
interface.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250627204237.214635-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C

eMMC HS200 mode (1.8V I/O) is supported by the MMC host controller on
RK3528 and works with the optional on-board eMMC module on Radxa E20C.

Be explicit about HS200 support in the device tree for Radxa E20C.

Fixes: 3a01b5f14a8a ("arm64: dts: rockchip: Enable onboard eMMC on Radxa E20C")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20250621165832.2226160-1-jonas@kwiboo.se
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Add bluetooth support to ArmSoM Sige7

ArmSoM Sige7 has onboard AP6275P Wi-Fi6 (PCIe) and BT5 (UART) module
which is similar with Khadas Edge2. This commit enables bluetooth
at uart6.

Signed-off-by: Jianfeng Liu <liujianfeng1994@gmail.com>
Link: https://lore.kernel.org/r/20250621135319.61766-1-liujianfeng1994@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: enable PCIe on ROCK 4D

The RADXA ROCK 4D board has a PCIe controller connected to a flat flex
connector, compatible with the one the RPi5 uses.

Enable the associated combphy and pcie controller node, as well as add
the remaining pinctrl definition for the reset.

Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://lore.kernel.org/r/20250621-rk3576-rock4d-pcie-v1-1-2b33c9f12955@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Enable HDMI receiver on CM3588

Enable support for the HDMI input port found on FriendlyElec CM3588 and
CM3588 Plus.

Signed-off-by: Valentin Hăloiu <valentin.haloiu@gmail.com>
Link: https://lore.kernel.org/r/20250622185814.35031-1-valentin.haloiu@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576

Since commit c871a311edf0 ("phy: rockchip: samsung-hdptx: Setup TMDS
char rate via phy_configure_opts_hdmi"), the workaround of passing the
rate from DW HDMI QP bridge driver via phy_set_bus_width() became
partially broken, as it cannot reliably handle mode switches anymore.

Attempting to fix this up at PHY level would not only introduce
additional hacks, but it would also fail to adequately resolve the
display issues that are a consequence of the system CRU limitations.

Instead, proceed with the solution already implemented for RK3588: make
use of the HDMI PHY PLL as a better suited DCLK source for VOP2. This
will not only address the aforementioned problem, but it should also
facilitate the proper operation of display modes up to 4K@60Hz.

It's worth noting that anything above 4K@30Hz still requires high TMDS
clock ratio and scrambling support, which hasn't been mainlined yet.

Fixes: d74b842cab08 ("arm64: dts: rockchip: Add vop for rk3576")
Cc: stable@vger.kernel.org
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Tested-By: Detlev Casanova <detlev.casanova@collabora.com>
Tested-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://lore.kernel.org/r/20250612-rk3576-hdmitx-fix-v1-3-4b11007d8675@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576

As with the RK3588 SoC, the HDMI PHY PLL on RK3576 can be used as a more
accurate pixel clock source for VOP2, which is actually mandatory to
ensure proper support for display modes handling.

Add the missing #clock-cells property to allow using the clock provider
functionality of HDMI PHY.

Fixes: ad0ea230ab2a ("arm64: dts: rockchip: Add hdmi for rk3576")
Cc: stable@vger.kernel.org
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Tested-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Link: https://lore.kernel.org/r/20250612-rk3576-hdmitx-fix-v1-2-4b11007d8675@collabora.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: exynos: gs101: switch to gs101 specific reboot

gs101 (Google Pixel 6 and Pixel 6 Pro) supports cold- and warm-reboot.
Cold-reset is useful because it is more secure, e.g. wiping all RAM
contents, while the warm-reboot allows RAM contents to be retained
across the reboot, e.g. to collect potential crash information.

Add the required DT changes to switch to the gs101-specific reboot
method, which knows how to issue either reset as requested by the OS.

The PMIC plays a role in this as well, so mark it as
'system-power-controller', which in this case ensures that the device
will wake up again after a cold-reboot, ensuring the full power-cycle
is successful.

Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://lore.kernel.org/r/20250627-gs101-reboot3-v1-3-c3ae49657b1f@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos: gs101-pixel-common: add main PMIC node

On Pixel 6 (and Pro), a Samsung S2MPG10 is used as main PMIC, which
contains the following functional blocks:
    * common / speedy interface
    * regulators
    * 3 clock outputs
    * RTC
    * power meters
    * GPIO interfaces

This change enables the PMIC itself and the RTC. We're still working on
the remaining parts or waiting for bindings to be merged, hence only a
small subset of the functional is being enabled.

The regulators fall into the same category (still being finalised), but
since the binding requires a 'regulators' node, an empty node is being
added to avoid validation errors at this stage.

Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://lore.kernel.org/r/20250627-gs101-reboot3-v1-2-c3ae49657b1f@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos: gs101: ufs: add dma-coherent property

ufs-exynos driver configures the sysreg shareability as
cacheable for gs101 so we need to set the dma-coherent
property so the descriptors are also allocated cacheable.

This fixes the UFS stability issues we have seen with
the upstream UFS driver on gs101.

Fixes: 4c65d7054b4c ("arm64: dts: exynos: gs101: Add ufs and ufs-phy dt nodes")
Cc: stable@vger.kernel.org
Suggested-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Tested-by: Will McVicker <willmcvicker@google.com>
Tested-by: André Draszik <andre.draszik@linaro.org>
Reviewed-by: André Draszik <andre.draszik@linaro.org>
Link: https://lore.kernel.org/r/20250314-ufs-dma-coherent-v1-1-bdf9f9be2919@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos: gs101: add dm-verity-device-corrupted syscon-reboot-mode

On gs101, the boot mode is stored both in a syscon register, and in
nvmem.

Add the dm-verity-device-corrupted reboot mode to the syscon-reboot-
based boot mode as well, as both (nvmem & syscon) modes should be in
sync.

Signed-off-by: André Draszik <andre.draszik@linaro.org>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-4-b479542eb97d@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos: gs101-pixel-common: add nvmem-reboot-mode

Add the 'nvmem-reboot-mode' which is used to communicate a requested
boot mode to the boot loader.

Signed-off-by: André Draszik <andre.draszik@linaro.org>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-3-b479542eb97d@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 PMIC

On Pixel 6 (and Pro), a MAX77759 companion PMIC for USB Type-C
applications is used, which contains four functional blocks (at
distinct I2C addresses):
  * top (including GPIO & NVMEM)
  * charger
  * fuel gauge
  * TCPCi

This change adds the PMIC and the subnodes for the GPIO expander and
NVMEM, and defines the NVMEM layout.

The NVMEM layout is declared such that it matches downstream's
open-coded configuration [1].

Note:
The pinctrl nodes are kept sorted by the 'samsung,pins' property rather
than node name, as I think that makes it easier to look at and to add
new nodes unambiguously in the future. Its label is prefixed with 'if'
(for interface), because there are three PMICs in total in use on
Pixel 6 (Pro).

Link: https://android.googlesource.com/kernel/google-modules/bms/+/96e729a83817/max77759_maxq.c#67
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Reviewed-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-2-b479542eb97d@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

arm64: dts: renesas: r9a09g047: Add GBETH nodes

Add GBETH nodes to RZ/G3E (R9A09G047) SoC DTSI.

Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com>
Link: https://lore.kernel.org/20250623080405.355083-3-john.madieu.xa@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Rename fixed regulator node names

Rename "regulator0" to "regulator-0p8v" and "regulator1" to
"regulator-3p3v" for consistency as done in the RZ/V2N EVK.

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250620121045.56114-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add RAA215300 PMIC

Add support for the Renesas RAA215300 PMIC to the RZ/V2N EVK. The PMIC is
connected to I2C8 and uses a 32.768kHz fixed clock source (x6).

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250619135539.207828-3-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add RAA215300 PMIC

Add support for the Renesas RAA215300 PMIC to the RZ/V2H EVK. The PMIC is
connected to I2C8 and uses a 32.768kHz fixed clock source (x6).

Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/20250619135539.207828-2-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

arm64: dts: exynos5433: Align i2c-gpio node names with dtschema

New dtschema v2025.6 enforces different naming on I2C nodes thus new
dtbs_check warnings appeared for I2C GPIO nodes:

  exynos5433-tm2.dtb: i2c-gpio-0 (i2c-gpio):
    $nodename:0: 'i2c-gpio-0' does not match '^i2c(@.+|-[a-z0-9]+)?$'
  exynos5433-tm2.dtb: i2c-gpio-0 (i2c-gpio):
    Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'amplifier@31' were unexpected)

Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing
the SoC I2C controller indexing (3 controllers) for simplicity and
obviousness, even if the SoC I2C controller is not enabled on given
board.  The names anyway would not conflict with SoC ones because of
unit addresses.

Verified with comparing two fdt (after fdtdump).

Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/
Link: https://lore.kernel.org/r/20250612095549.77954-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

ARM: dts: s5pv210: Align i2c-gpio node names with dtschema

New dtschema v2025.6 enforces different naming on I2C nodes thus new
dtbs_check warnings appeared for I2C GPIO nodes:

  s5pv210-fascinate4g.dtb: i2c-gpio-0 (i2c-gpio):
    $nodename:0: 'i2c-gpio-0' does not match '^i2c(@.+|-[a-z0-9]+)?$'
  s5pv210-fascinate4g.dtb: i2c-gpio-0 (i2c-gpio):
    Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'audio-codec@1a' were unexpected)

Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing
the SoC I2C controller indexing (3 controllers) for simplicity and
obviousness, even if the SoC I2C controller is not enabled on given
board.  The names anyway would not conflict with SoC ones because of
unit addresses.

Verified with comparing two fdt (after fdtdump).

Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/
Link: https://lore.kernel.org/r/20250612094807.62532-4-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

ARM: dts: exynos: Align i2c-gpio node names with dtschema

New dtschema v2025.6 enforces different naming on I2C nodes thus new
dtbs_check warnings appeared for I2C GPIO nodes:

  exynos4212-tab3-lte8.dtb: i2c-gpio-3 (i2c-gpio):
    $nodename:0: 'i2c-gpio-3' does not match '^i2c(@.+|-[a-z0-9]+)?$'
  exynos4212-tab3-lte8.dtb: i2c-gpio-3 (i2c-gpio):
    Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'magnetometer@2e' were unexpected)

Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing
the SoC I2C controller indexing (Exynos3250: 8 controllers, Exynos4: 9
controllers) for simplicity and obviousness, even if the SoC I2C
controller is not enabled on given board.  The names anyway would not
conflict with SoC ones because of unit addresses.

Verified with comparing two fdt (after fdtdump).

Reported-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/
Link: https://lore.kernel.org/r/20250612094807.62532-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>

dt-bindings: soc: renesas: Document RZ/T2H Evaluation Board part number

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/0703ecbc355164e35b90a9fe088438c821f13cd3.1749741263.git.geert+renesas@glider.be

Linux 6.16-rc3

Merge tag 'i2c-for-6.16-rc3' of git://git./linux/kernel/git/wsa/linux

Pull i2c fixes from Wolfram Sang:

 - subsystem: convert drivers to use recent callbacks of struct
   i2c_algorithm A typical after-rc1 cleanup, which I couldn't send in
   time for rc2

 - tegra: fix YAML conversion of device tree bindings

 - k1: re-add a check which got lost during upstreaming

* tag 'i2c-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: k1: check for transfer error
  i2c: use inclusive callbacks in struct i2c_algorithm
  dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties

Merge tag 'x86_urgent_for_v6.16_rc3' of git://git./linux/kernel/git/tip/tip

Pull x86 fixes from Borislav Petkov:

 - Make sure the array tracking which kernel text positions need to be
   alternatives-patched doesn't get mishandled by out-of-order
   modifications, leading to it overflowing and causing page faults when
   patching

 - Avoid an infinite loop when early code does a ranged TLB invalidation
   before the broadcast TLB invalidation count of how many pages it can
   flush, has been read from CPUID

 - Fix a CONFIG_MODULES typo

 - Disable broadcast TLB invalidation when PTI is enabled to avoid an
   overflow of the bitmap tracking dynamic ASIDs which need to be
   flushed when the kernel switches between the user and kernel address
   space

 - Handle the case of a CPU going offline and thus reporting zeroes when
   reading top-level events in the resctrl code

* tag 'x86_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/alternatives: Fix int3 handling failure from broken text_poke array
  x86/mm: Fix early boot use of INVPLGB
  x86/its: Fix an ifdef typo in its_alloc()
  x86/mm: Disable INVLPGB when PTI is enabled
  x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem

Merge tag 'irq_urgent_for_v6.16_rc3' of git://git./linux/kernel/git/tip/tip

Pull irq fixes from Borislav Petkov:

 - Fix missing prototypes warnings

 - Properly initialize work context when allocating it

 - Remove a method tracking when managed interrupts are suspended during
   hotplug, in favor of the code using a IRQ disable depth tracking now,
   and have interrupts get properly enabled again on restore

 - Make sure multiple CPUs getting hotplugged don't cause wrong tracking
   of the managed IRQ disable depth

* tag 'irq_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/ath79-misc: Fix missing prototypes warnings
  genirq/irq_sim: Initialize work context pointers properly
  genirq/cpuhotplug: Restore affinity even for suspended IRQ
  genirq/cpuhotplug: Rebalance managed interrupts across multi-CPU hotplug

Merge tag 'perf_urgent_for_v6.16_rc3' of git://git./linux/kernel/git/tip/tip

Pull perf fixes from Borislav Petkov:

 - Avoid a crash on a heterogeneous machine where not all cores support
   the same hw events features

 - Avoid a deadlock when throttling events

 - Document the perf event states more

 - Make sure a number of perf paths switching off or rescheduling events
   call perf_cgroup_event_disable()

 - Make sure perf does task sampling before its userspace mapping is
   torn down, and not after

* tag 'perf_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Fix crash in icl_update_topdown_event()
  perf: Fix the throttle error of some clock events
  perf: Add comment to enum perf_event_state
  perf/core: Fix WARN in perf_cgroup_switch()
  perf: Fix dangling cgroup pointer in cpuctx
  perf: Fix cgroup state vs ERROR
  perf: Fix sample vs do_exit()

Merge tag 'locking_urgent_for_v6.16_rc3' of git://git./linux/kernel/git/tip/tip

Pull locking fixes from Borislav Petkov:

 - Make sure the switch to the global hash is requested always under a
   lock so that two threads requesting that simultaneously cannot get to
   inconsistent state

 - Reject negative NUMA nodes earlier in the futex NUMA interface
   handling code

 - Selftests fixes

* tag 'locking_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Verify under the lock if hash can be replaced
  futex: Handle invalid node numbers supplied by user
  selftests/futex: Set the home_node in futex_numa_mpol
  selftests/futex: getopt() requires int as return value.

Merge tag 'edac_urgent_for_v6.16_rc3' of git://git./linux/kernel/git/ras/ras

Pull EDAC fixes from Borislav Petkov:

 - amd64: Correct the number of memory controllers on some AMD Zen
   clients

 - igen6: Handle firmware-disabled memory controllers properly

* tag 'edac_urgent_for_v6.16_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/igen6: Fix NULL pointer dereference
  EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh

Merge tag 'for-linus' of git://git./virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "ARM:

   - Fix another set of FP/SIMD/SVE bugs affecting NV, and plugging some
     missing synchronisation

   - A small fix for the irqbypass hook fixes, tightening the check and
     ensuring that we only deal with MSI for both the old and the new
     route entry

   - Rework the way the shadow LRs are addressed in a nesting
     configuration, plugging an embarrassing bug as well as simplifying
     the whole process

   - Add yet another fix for the dreaded arch_timer_edge_cases selftest

  RISC-V:

   - Fix the size parameter check in SBI SFENCE calls

   - Don't treat SBI HFENCE calls as NOPs

  x86 TDX:

   - Complete API for handling complex TDVMCALLs in userspace.

     This was delayed because the spec lacked a way for userspace to
     deny supporting these calls; the new exit code is now approved"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: TDX: Exit to userspace for GetTdVmCallInfo
  KVM: TDX: Handle TDG.VP.VMCALL<GetQuote>
  KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs
  KVM: arm64: VHE: Centralize ISBs when returning to host
  KVM: arm64: Remove cpacr_clear_set()
  KVM: arm64: Remove ad-hoc CPTR manipulation from kvm_hyp_handle_fpsimd()
  KVM: arm64: Remove ad-hoc CPTR manipulation from fpsimd_sve_sync()
  KVM: arm64: Reorganise CPTR trap manipulation
  KVM: arm64: VHE: Synchronize CPTR trap deactivation
  KVM: arm64: VHE: Synchronize restore of host debug registers
  KVM: arm64: selftests: Close the GIC FD in arch_timer_edge_cases
  KVM: arm64: Explicitly treat routing entry type changes as changes
  KVM: arm64: nv: Fix tracking of shadow list registers
  RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
  RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls

Merge tag 'v6.16-rc2-smb3-client-fixes-v2' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Multichannel channel allocation fix for Kerberos mounts

 - Two reconnect fixes

 - Fix netfs_writepages crash with smbdirect/RDMA

 - Directory caching fix

 - Three minor cleanup fixes

 - Log error when close cached dirs fails

* tag 'v6.16-rc2-smb3-client-fixes-v2' of git://git.samba.org/sfrench/cifs-2.6:
  smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size
  smb: minor fix to use sizeof to initialize flags_string buffer
  smb: Use loff_t for directory position in cached_dirents
  smb: Log an error when close_all_cached_dirs fails
  cifs: Fix prepare_write to negotiate wsize if needed
  smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
  smb: client: fix first command failure during re-negotiation
  cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
  smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels

i2c: k1: check for transfer error

If spacemit_i2c_xfer_msg() times out waiting for a message transfer to
complete, or if the hardware reports an error, it returns a negative
error code (-ETIMEDOUT, -EAGAIN, -ENXIO. or -EIO).

The sole caller of spacemit_i2c_xfer_msg() is spacemit_i2c_xfer(),
which is the i2c_algorithm->xfer callback function.  It currently
does not save the value returned by spacemit_i2c_xfer_msg().

The result is that transfer errors go unreported, and a caller
has no indication anything is wrong.

When this code was out for review, the return value *was* checked
in early versions.  But for some reason, that assignment got dropped
between versions 5 and 6 of the series, perhaps related to reworking
the code to merge spacemit_i2c_xfer_core() into spacemit_i2c_xfer().

Simply assigning the value returned to "ret" fixes the problem.

Fixes: 5ea558473fa31 ("i2c: spacemit: add support for SpacemiT K1 SoC")
Signed-off-by: Alex Elder <elder@riscstar.com>
Cc: <stable@vger.kernel.org> # v6.15+
Reviewed-by: Troy Mitchell <troymitchell988@gmail.com>
Link: https://lore.kernel.org/r/20250616125137.1555453-1-elder@riscstar.com
Signed-off-by: Andi Shyti <andi@smida.it>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>

arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC

The Firefly ROC-RK3588S-PC is a SBC based on the Rockchip RK3588s SoC.

Link: https://wiki.t-firefly.com/en/Station-M3/index.html
The device contains the following hardware that is tested/working:
 - 32 or 64GB eMMC
 - SDMMC card slot
 - Realtek USB WiFi 5/BT
 - NVME 2242 socket
 - 4 or 8GB of RAM
 - RTL8211 GbE
 - USB 3.0 port
 - USB 2.0 port
 - HDMI port

Signed-off-by: Hsun Lai <i@chainsx.cn>
Link: https://lore.kernel.org/r/20250609113044.8846-3-i@chainsx.cn
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

dt-bindings: arm: rockchip: Add Firefly ROC-RK3588S-PC

This documents Firefly ROC-RK3588S-PC which is a SBC based on RK3588S SoC.

Link: https://wiki.t-firefly.com/en/Station-M3/index.html
Signed-off-by: Hsun Lai <i@chainsx.cn>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20250609113044.8846-2-i@chainsx.cn
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Enable GPU on Radxa E20C

Enable the Mali-450 MP2 GPU on the Radxa E20C.

Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20250518225418.682182-4-jonas@kwiboo.se
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

arm64: dts: rockchip: Add GPU node for RK3528

Add a GPU node and a opp-table for the Mali-450 MP2 in the RK3528 SoC.

Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20250518225418.682182-3-jonas@kwiboo.se
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

Merge tag 'nfsd-6.16-1' of git://git./linux/kernel/git/cel/linux

Pull nfsd fixes from Chuck Lever:

 - Two fixes for commits in the nfsd-6.16 merge

 - One fix for the recently-added NFSD netlink facility

 - One fix for a remote SunRPC crasher

* tag 'nfsd-6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
  sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
  nfsd: use threads array as-is in netlink interface
  SUNRPC: Cleanup/fix initial rq_pages allocation
  NFSD: Avoid corruption of a referring call list

Merge tag 'erofs-for-6.16-rc3-fixes' of git://git./linux/kernel/git/xiang/erofs

Pull erofs fixes from Gao Xiang:

 - Use the mounter’s credentials for file-backed mounts to resolve
   Android SELinux permission issues

 - Remove the unused trace event `erofs_destroy_inode`

 - Error out on crafted out-of-file-range encoded extents

 - Remove an incorrect check for encoded extents

* tag 'erofs-for-6.16-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: remove a superfluous check for encoded extents
  erofs: refuse crafted out-of-file-range encoded extents
  erofs: remove unused trace event erofs_destroy_inode
  erofs: impersonate the opener's credentials when accessing backing file

smb: minor fix to use SMB2_NTLMV2_SESSKEY_SIZE for auth_key size

Replaced hardcoded value 16 with SMB2_NTLMV2_SESSKEY_SIZE
in the auth_key definition and memcpy call.

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

smb: minor fix to use sizeof to initialize flags_string buffer

Replaced hardcoded length with sizeof(flags_string).

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

smb: Use loff_t for directory position in cached_dirents

Change the pos field in struct cached_dirents from int to loff_t
to support large directory offsets. This avoids overflow and
matches kernel conventions for directory positions.

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

smb: Log an error when close_all_cached_dirs fails

Under low-memory conditions, close_all_cached_dirs() can't move the
dentries to a separate list to dput() them once the locks are dropped.
This will result in a "Dentry still in use" error, so add an error
message that makes it clear this is what happened:

[  495.281119] CIFS: VFS: \\otters.example.com\share Out of memory while dropping dentries
[  495.281595] ------------[ cut here ]------------
[  495.281887] BUG: Dentry ffff888115531138{i=78,n=/}  still in use (2) [unmount of cifs cifs]
[  495.282391] WARNING: CPU: 1 PID: 2329 at fs/dcache.c:1536 umount_check+0xc8/0xf0

Also, bail out of looping through all tcons as soon as a single
allocation fails, since we're already in trouble, and kmalloc() attempts
for subseqeuent tcons are likely to fail just like the first one did.

Signed-off-by: Paul Aurich <paul@darkrain42.org>
Acked-by: Bharath SM <bharathsm@microsoft.com>
Suggested-by: Ruben Devos <rdevos@oxya.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

cifs: Fix prepare_write to negotiate wsize if needed

Fix cifs_prepare_write() to negotiate the wsize if it is unset.

Reviewed-by: Shyam Prasad N <nspmangalore@gmail.com>
Reviewed-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()

This fixes the following problem:

[  749.901015] [   T8673] run fstests cifs/001 at 2025-06-17 09:40:30
[  750.346409] [   T9870] ==================================================================
[  750.346814] [   T9870] BUG: KASAN: slab-out-of-bounds in smb_set_sge+0x2cc/0x3b0 [cifs]
[  750.347330] [   T9870] Write of size 8 at addr ffff888011082890 by task xfs_io/9870
[  750.347705] [   T9870]
[  750.348077] [   T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Not tainted 6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary)
[  750.348082] [   T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  750.348085] [   T9870] Call Trace:
[  750.348086] [   T9870]  <TASK>
[  750.348088] [   T9870]  dump_stack_lvl+0x76/0xa0
[  750.348106] [   T9870]  print_report+0xd1/0x640
[  750.348116] [   T9870]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  750.348120] [   T9870]  ? kasan_complete_mode_report_info+0x26/0x210
[  750.348124] [   T9870]  kasan_report+0xe7/0x130
[  750.348128] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]
[  750.348262] [   T9870]  ? smb_set_sge+0x2cc/0x3b0 [cifs]
[  750.348377] [   T9870]  __asan_report_store8_noabort+0x17/0x30
[  750.348381] [   T9870]  smb_set_sge+0x2cc/0x3b0 [cifs]
[  750.348496] [   T9870]  smbd_post_send_iter+0x1990/0x3070 [cifs]
[  750.348625] [   T9870]  ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs]
[  750.348741] [   T9870]  ? update_stack_state+0x2a0/0x670
[  750.348749] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]
[  750.348870] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]
[  750.348990] [   T9870]  ? update_stack_state+0x2a0/0x670
[  750.348995] [   T9870]  smbd_send+0x58c/0x9c0 [cifs]
[  750.349117] [   T9870]  ? __pfx_smbd_send+0x10/0x10 [cifs]
[  750.349231] [   T9870]  ? unwind_get_return_address+0x65/0xb0
[  750.349235] [   T9870]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  750.349242] [   T9870]  ? arch_stack_walk+0xa7/0x100
[  750.349250] [   T9870]  ? stack_trace_save+0x92/0xd0
[  750.349254] [   T9870]  __smb_send_rqst+0x931/0xec0 [cifs]
[  750.349374] [   T9870]  ? kernel_text_address+0x173/0x190
[  750.349379] [   T9870]  ? kasan_save_stack+0x39/0x70
[  750.349382] [   T9870]  ? kasan_save_track+0x18/0x70
[  750.349385] [   T9870]  ? __kasan_slab_alloc+0x9d/0xa0
[  750.349389] [   T9870]  ? __pfx___smb_send_rqst+0x10/0x10 [cifs]
[  750.349508] [   T9870]  ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs]
[  750.349626] [   T9870]  ? cifs_call_async+0x277/0xb00 [cifs]
[  750.349746] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]
[  750.349867] [   T9870]  ? netfs_do_issue_write+0xc2/0x340 [netfs]
[  750.349900] [   T9870]  ? netfs_advance_write+0x45b/0x1270 [netfs]
[  750.349929] [   T9870]  ? netfs_write_folio+0xd6c/0x1be0 [netfs]
[  750.349958] [   T9870]  ? netfs_writepages+0x2e9/0xa80 [netfs]
[  750.349987] [   T9870]  ? do_writepages+0x21f/0x590
[  750.349993] [   T9870]  ? filemap_fdatawrite_wbc+0xe1/0x140
[  750.349997] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.350002] [   T9870]  smb_send_rqst+0x22e/0x2f0 [cifs]
[  750.350131] [   T9870]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]
[  750.350255] [   T9870]  ? local_clock_noinstr+0xe/0xd0
[  750.350261] [   T9870]  ? kasan_save_alloc_info+0x37/0x60
[  750.350268] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.350271] [   T9870]  ? _raw_spin_lock+0x81/0xf0
[  750.350275] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.350278] [   T9870]  ? smb2_setup_async_request+0x293/0x580 [cifs]
[  750.350398] [   T9870]  cifs_call_async+0x477/0xb00 [cifs]
[  750.350518] [   T9870]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
[  750.350636] [   T9870]  ? __pfx_cifs_call_async+0x10/0x10 [cifs]
[  750.350756] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.350760] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.350763] [   T9870]  ? __smb2_plain_req_init+0x933/0x1090 [cifs]
[  750.350891] [   T9870]  smb2_async_writev+0x15ff/0x2460 [cifs]
[  750.351008] [   T9870]  ? sched_clock_noinstr+0x9/0x10
[  750.351012] [   T9870]  ? local_clock_noinstr+0xe/0xd0
[  750.351018] [   T9870]  ? __pfx_smb2_async_writev+0x10/0x10 [cifs]
[  750.351144] [   T9870]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  750.351150] [   T9870]  ? _raw_spin_unlock+0xe/0x40
[  750.351154] [   T9870]  ? cifs_pick_channel+0x242/0x370 [cifs]
[  750.351275] [   T9870]  cifs_issue_write+0x256/0x610 [cifs]
[  750.351554] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]
[  750.351677] [   T9870]  netfs_do_issue_write+0xc2/0x340 [netfs]
[  750.351710] [   T9870]  netfs_advance_write+0x45b/0x1270 [netfs]
[  750.351740] [   T9870]  ? rolling_buffer_append+0x12d/0x440 [netfs]
[  750.351769] [   T9870]  netfs_write_folio+0xd6c/0x1be0 [netfs]
[  750.351798] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.351804] [   T9870]  netfs_writepages+0x2e9/0xa80 [netfs]
[  750.351835] [   T9870]  ? __pfx_netfs_writepages+0x10/0x10 [netfs]
[  750.351864] [   T9870]  ? exit_files+0xab/0xe0
[  750.351867] [   T9870]  ? do_exit+0x148f/0x2980
[  750.351871] [   T9870]  ? do_group_exit+0xb5/0x250
[  750.351874] [   T9870]  ? arch_do_signal_or_restart+0x92/0x630
[  750.351879] [   T9870]  ? exit_to_user_mode_loop+0x98/0x170
[  750.351882] [   T9870]  ? do_syscall_64+0x2cf/0xd80
[  750.351886] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.351890] [   T9870]  do_writepages+0x21f/0x590
[  750.351894] [   T9870]  ? __pfx_do_writepages+0x10/0x10
[  750.351897] [   T9870]  filemap_fdatawrite_wbc+0xe1/0x140
[  750.351901] [   T9870]  __filemap_fdatawrite_range+0xba/0x100
[  750.351904] [   T9870]  ? __pfx___filemap_fdatawrite_range+0x10/0x10
[  750.351912] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.351916] [   T9870]  filemap_write_and_wait_range+0x7d/0xf0
[  750.351920] [   T9870]  cifs_flush+0x153/0x320 [cifs]
[  750.352042] [   T9870]  filp_flush+0x107/0x1a0
[  750.352046] [   T9870]  filp_close+0x14/0x30
[  750.352049] [   T9870]  put_files_struct.part.0+0x126/0x2a0
[  750.352053] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.352058] [   T9870]  exit_files+0xab/0xe0
[  750.352061] [   T9870]  do_exit+0x148f/0x2980
[  750.352065] [   T9870]  ? __pfx_do_exit+0x10/0x10
[  750.352069] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.352072] [   T9870]  ? _raw_spin_lock_irq+0x8a/0xf0
[  750.352076] [   T9870]  do_group_exit+0xb5/0x250
[  750.352080] [   T9870]  get_signal+0x22d3/0x22e0
[  750.352086] [   T9870]  ? __pfx_get_signal+0x10/0x10
[  750.352089] [   T9870]  ? fpregs_assert_state_consistent+0x68/0x100
[  750.352101] [   T9870]  ? folio_add_lru+0xda/0x120
[  750.352105] [   T9870]  arch_do_signal_or_restart+0x92/0x630
[  750.352109] [   T9870]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  750.352115] [   T9870]  exit_to_user_mode_loop+0x98/0x170
[  750.352118] [   T9870]  do_syscall_64+0x2cf/0xd80
[  750.352123] [   T9870]  ? __kasan_check_read+0x11/0x20
[  750.352126] [   T9870]  ? count_memcg_events+0x1b4/0x420
[  750.352132] [   T9870]  ? handle_mm_fault+0x148/0x690
[  750.352136] [   T9870]  ? _raw_spin_lock_irq+0x8a/0xf0
[  750.352140] [   T9870]  ? __kasan_check_read+0x11/0x20
[  750.352143] [   T9870]  ? fpregs_assert_state_consistent+0x68/0x100
[  750.352146] [   T9870]  ? irqentry_exit_to_user_mode+0x2e/0x250
[  750.352151] [   T9870]  ? irqentry_exit+0x43/0x50
[  750.352154] [   T9870]  ? exc_page_fault+0x75/0xe0
[  750.352160] [   T9870]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.352163] [   T9870] RIP: 0033:0x7858c94ab6e2
[  750.352167] [   T9870] Code: Unable to access opcode bytes at 0x7858c94ab6b8.
[  750.352175] [   T9870] RSP: 002b:00007858c9248ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000022
[  750.352179] [   T9870] RAX: fffffffffffffdfe RBX: 00007858c92496c0 RCX: 00007858c94ab6e2
[  750.352182] [   T9870] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  750.352184] [   T9870] RBP: 00007858c9248d10 R08: 0000000000000000 R09: 0000000000000000
[  750.352185] [   T9870] R10: 0000000000000000 R11: 0000000000000246 R12: fffffffffffffde0
[  750.352187] [   T9870] R13: 0000000000000020 R14: 0000000000000002 R15: 00007ffc072d2230
[  750.352191] [   T9870]  </TASK>
[  750.352195] [   T9870]
[  750.395206] [   T9870] Allocated by task 9870 on cpu 0 at 750.346406s:
[  750.395523] [   T9870]  kasan_save_stack+0x39/0x70
[  750.395532] [   T9870]  kasan_save_track+0x18/0x70
[  750.395536] [   T9870]  kasan_save_alloc_info+0x37/0x60
[  750.395539] [   T9870]  __kasan_slab_alloc+0x9d/0xa0
[  750.395543] [   T9870]  kmem_cache_alloc_noprof+0x13c/0x3f0
[  750.395548] [   T9870]  mempool_alloc_slab+0x15/0x20
[  750.395553] [   T9870]  mempool_alloc_noprof+0x135/0x340
[  750.395557] [   T9870]  smbd_post_send_iter+0x63e/0x3070 [cifs]
[  750.395694] [   T9870]  smbd_send+0x58c/0x9c0 [cifs]
[  750.395819] [   T9870]  __smb_send_rqst+0x931/0xec0 [cifs]
[  750.395950] [   T9870]  smb_send_rqst+0x22e/0x2f0 [cifs]
[  750.396081] [   T9870]  cifs_call_async+0x477/0xb00 [cifs]
[  750.396232] [   T9870]  smb2_async_writev+0x15ff/0x2460 [cifs]
[  750.396359] [   T9870]  cifs_issue_write+0x256/0x610 [cifs]
[  750.396492] [   T9870]  netfs_do_issue_write+0xc2/0x340 [netfs]
[  750.396544] [   T9870]  netfs_advance_write+0x45b/0x1270 [netfs]
[  750.396576] [   T9870]  netfs_write_folio+0xd6c/0x1be0 [netfs]
[  750.396608] [   T9870]  netfs_writepages+0x2e9/0xa80 [netfs]
[  750.396639] [   T9870]  do_writepages+0x21f/0x590
[  750.396643] [   T9870]  filemap_fdatawrite_wbc+0xe1/0x140
[  750.396647] [   T9870]  __filemap_fdatawrite_range+0xba/0x100
[  750.396651] [   T9870]  filemap_write_and_wait_range+0x7d/0xf0
[  750.396656] [   T9870]  cifs_flush+0x153/0x320 [cifs]
[  750.396787] [   T9870]  filp_flush+0x107/0x1a0
[  750.396791] [   T9870]  filp_close+0x14/0x30
[  750.396795] [   T9870]  put_files_struct.part.0+0x126/0x2a0
[  750.396800] [   T9870]  exit_files+0xab/0xe0
[  750.396803] [   T9870]  do_exit+0x148f/0x2980
[  750.396808] [   T9870]  do_group_exit+0xb5/0x250
[  750.396813] [   T9870]  get_signal+0x22d3/0x22e0
[  750.396817] [   T9870]  arch_do_signal_or_restart+0x92/0x630
[  750.396822] [   T9870]  exit_to_user_mode_loop+0x98/0x170
[  750.396827] [   T9870]  do_syscall_64+0x2cf/0xd80
[  750.396832] [   T9870]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.396836] [   T9870]
[  750.397150] [   T9870] The buggy address belongs to the object at ffff888011082800
                           which belongs to the cache smbd_request_0000000008f3bd7b of size 144
[  750.397798] [   T9870] The buggy address is located 0 bytes to the right of
                           allocated 144-byte region [ffff888011082800, ffff888011082890)
[  750.398469] [   T9870]
[  750.398800] [   T9870] The buggy address belongs to the physical page:
[  750.399141] [   T9870] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11082
[  750.399148] [   T9870] flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
[  750.399155] [   T9870] page_type: f5(slab)
[  750.399161] [   T9870] raw: 000fffffc0000000 ffff888022d65640 dead000000000122 0000000000000000
[  750.399165] [   T9870] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
[  750.399169] [   T9870] page dumped because: kasan: bad access detected
[  750.399172] [   T9870]
[  750.399505] [   T9870] Memory state around the buggy address:
[  750.399863] [   T9870]  ffff888011082780: fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  750.400247] [   T9870]  ffff888011082800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[  750.400618] [   T9870] >ffff888011082880: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  750.400982] [   T9870]                          ^
[  750.401370] [   T9870]  ffff888011082900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  750.401774] [   T9870]  ffff888011082980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  750.402171] [   T9870] ==================================================================
[  750.402696] [   T9870] Disabling lock debugging due to kernel taint
[  750.403202] [   T9870] BUG: unable to handle page fault for address: ffff8880110a2000
[  750.403797] [   T9870] #PF: supervisor write access in kernel mode
[  750.404204] [   T9870] #PF: error_code(0x0003) - permissions violation
[  750.404581] [   T9870] PGD 5ce01067 P4D 5ce01067 PUD 5ce02067 PMD 78aa063 PTE 80000000110a2021
[  750.404969] [   T9870] Oops: Oops: 0003 [#1] SMP KASAN PTI
[  750.405394] [   T9870] CPU: 0 UID: 0 PID: 9870 Comm: xfs_io Kdump: loaded Tainted: G    B               6.16.0-rc2-metze.02+ #1 PREEMPT(voluntary)
[  750.406510] [   T9870] Tainted: [B]=BAD_PAGE
[  750.406967] [   T9870] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[  750.407440] [   T9870] RIP: 0010:smb_set_sge+0x15c/0x3b0 [cifs]
[  750.408065] [   T9870] Code: 48 83 f8 ff 0f 84 b0 00 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 e1 48 c1 e9 03 80 3c 11 00 0f 85 69 01 00 00 49 8d 7c 24 08 <49> 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f
[  750.409283] [   T9870] RSP: 0018:ffffc90005e2e758 EFLAGS: 00010246
[  750.409803] [   T9870] RAX: ffff888036c53400 RBX: ffffc90005e2e878 RCX: 1ffff11002214400
[  750.410323] [   T9870] RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: ffff8880110a2008
[  750.411217] [   T9870] RBP: ffffc90005e2e798 R08: 0000000000000001 R09: 0000000000000400
[  750.411770] [   T9870] R10: ffff888011082800 R11: 0000000000000000 R12: ffff8880110a2000
[  750.412325] [   T9870] R13: 0000000000000000 R14: ffffc90005e2e888 R15: ffff88801a4b6000
[  750.412901] [   T9870] FS:  0000000000000000(0000) GS:ffff88812bc68000(0000) knlGS:0000000000000000
[  750.413477] [   T9870] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  750.414077] [   T9870] CR2: ffff8880110a2000 CR3: 000000005b0a6005 CR4: 00000000000726f0
[  750.414654] [   T9870] Call Trace:
[  750.415211] [   T9870]  <TASK>
[  750.415748] [   T9870]  smbd_post_send_iter+0x1990/0x3070 [cifs]
[  750.416449] [   T9870]  ? __pfx_smbd_post_send_iter+0x10/0x10 [cifs]
[  750.417128] [   T9870]  ? update_stack_state+0x2a0/0x670
[  750.417685] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]
[  750.418380] [   T9870]  ? cifs_flush+0x153/0x320 [cifs]
[  750.419055] [   T9870]  ? update_stack_state+0x2a0/0x670
[  750.419624] [   T9870]  smbd_send+0x58c/0x9c0 [cifs]
[  750.420297] [   T9870]  ? __pfx_smbd_send+0x10/0x10 [cifs]
[  750.420936] [   T9870]  ? unwind_get_return_address+0x65/0xb0
[  750.421456] [   T9870]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  750.421954] [   T9870]  ? arch_stack_walk+0xa7/0x100
[  750.422460] [   T9870]  ? stack_trace_save+0x92/0xd0
[  750.422948] [   T9870]  __smb_send_rqst+0x931/0xec0 [cifs]
[  750.423579] [   T9870]  ? kernel_text_address+0x173/0x190
[  750.424056] [   T9870]  ? kasan_save_stack+0x39/0x70
[  750.424813] [   T9870]  ? kasan_save_track+0x18/0x70
[  750.425323] [   T9870]  ? __kasan_slab_alloc+0x9d/0xa0
[  750.425831] [   T9870]  ? __pfx___smb_send_rqst+0x10/0x10 [cifs]
[  750.426548] [   T9870]  ? smb2_mid_entry_alloc+0xb4/0x7e0 [cifs]
[  750.427231] [   T9870]  ? cifs_call_async+0x277/0xb00 [cifs]
[  750.427882] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]
[  750.428909] [   T9870]  ? netfs_do_issue_write+0xc2/0x340 [netfs]
[  750.429425] [   T9870]  ? netfs_advance_write+0x45b/0x1270 [netfs]
[  750.429882] [   T9870]  ? netfs_write_folio+0xd6c/0x1be0 [netfs]
[  750.430345] [   T9870]  ? netfs_writepages+0x2e9/0xa80 [netfs]
[  750.430809] [   T9870]  ? do_writepages+0x21f/0x590
[  750.431239] [   T9870]  ? filemap_fdatawrite_wbc+0xe1/0x140
[  750.431652] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.432041] [   T9870]  smb_send_rqst+0x22e/0x2f0 [cifs]
[  750.432586] [   T9870]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]
[  750.433108] [   T9870]  ? local_clock_noinstr+0xe/0xd0
[  750.433482] [   T9870]  ? kasan_save_alloc_info+0x37/0x60
[  750.433855] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.434214] [   T9870]  ? _raw_spin_lock+0x81/0xf0
[  750.434561] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.434903] [   T9870]  ? smb2_setup_async_request+0x293/0x580 [cifs]
[  750.435394] [   T9870]  cifs_call_async+0x477/0xb00 [cifs]
[  750.435892] [   T9870]  ? __pfx_smb2_writev_callback+0x10/0x10 [cifs]
[  750.436388] [   T9870]  ? __pfx_cifs_call_async+0x10/0x10 [cifs]
[  750.436881] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.437237] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.437579] [   T9870]  ? __smb2_plain_req_init+0x933/0x1090 [cifs]
[  750.438062] [   T9870]  smb2_async_writev+0x15ff/0x2460 [cifs]
[  750.438557] [   T9870]  ? sched_clock_noinstr+0x9/0x10
[  750.438906] [   T9870]  ? local_clock_noinstr+0xe/0xd0
[  750.439293] [   T9870]  ? __pfx_smb2_async_writev+0x10/0x10 [cifs]
[  750.439786] [   T9870]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  750.440143] [   T9870]  ? _raw_spin_unlock+0xe/0x40
[  750.440495] [   T9870]  ? cifs_pick_channel+0x242/0x370 [cifs]
[  750.440989] [   T9870]  cifs_issue_write+0x256/0x610 [cifs]
[  750.441492] [   T9870]  ? cifs_issue_write+0x256/0x610 [cifs]
[  750.441987] [   T9870]  netfs_do_issue_write+0xc2/0x340 [netfs]
[  750.442387] [   T9870]  netfs_advance_write+0x45b/0x1270 [netfs]
[  750.442969] [   T9870]  ? rolling_buffer_append+0x12d/0x440 [netfs]
[  750.443376] [   T9870]  netfs_write_folio+0xd6c/0x1be0 [netfs]
[  750.443768] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.444145] [   T9870]  netfs_writepages+0x2e9/0xa80 [netfs]
[  750.444541] [   T9870]  ? __pfx_netfs_writepages+0x10/0x10 [netfs]
[  750.444936] [   T9870]  ? exit_files+0xab/0xe0
[  750.445312] [   T9870]  ? do_exit+0x148f/0x2980
[  750.445672] [   T9870]  ? do_group_exit+0xb5/0x250
[  750.446028] [   T9870]  ? arch_do_signal_or_restart+0x92/0x630
[  750.446402] [   T9870]  ? exit_to_user_mode_loop+0x98/0x170
[  750.446762] [   T9870]  ? do_syscall_64+0x2cf/0xd80
[  750.447132] [   T9870]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.447499] [   T9870]  do_writepages+0x21f/0x590
[  750.447859] [   T9870]  ? __pfx_do_writepages+0x10/0x10
[  750.448236] [   T9870]  filemap_fdatawrite_wbc+0xe1/0x140
[  750.448595] [   T9870]  __filemap_fdatawrite_range+0xba/0x100
[  750.448953] [   T9870]  ? __pfx___filemap_fdatawrite_range+0x10/0x10
[  750.449336] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.449697] [   T9870]  filemap_write_and_wait_range+0x7d/0xf0
[  750.450062] [   T9870]  cifs_flush+0x153/0x320 [cifs]
[  750.450592] [   T9870]  filp_flush+0x107/0x1a0
[  750.450952] [   T9870]  filp_close+0x14/0x30
[  750.451322] [   T9870]  put_files_struct.part.0+0x126/0x2a0
[  750.451678] [   T9870]  ? __pfx__raw_spin_lock+0x10/0x10
[  750.452033] [   T9870]  exit_files+0xab/0xe0
[  750.452401] [   T9870]  do_exit+0x148f/0x2980
[  750.452751] [   T9870]  ? __pfx_do_exit+0x10/0x10
[  750.453109] [   T9870]  ? __kasan_check_write+0x14/0x30
[  750.453459] [   T9870]  ? _raw_spin_lock_irq+0x8a/0xf0
[  750.453787] [   T9870]  do_group_exit+0xb5/0x250
[  750.454082] [   T9870]  get_signal+0x22d3/0x22e0
[  750.454406] [   T9870]  ? __pfx_get_signal+0x10/0x10
[  750.454709] [   T9870]  ? fpregs_assert_state_consistent+0x68/0x100
[  750.455031] [   T9870]  ? folio_add_lru+0xda/0x120
[  750.455347] [   T9870]  arch_do_signal_or_restart+0x92/0x630
[  750.455656] [   T9870]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  750.455967] [   T9870]  exit_to_user_mode_loop+0x98/0x170
[  750.456282] [   T9870]  do_syscall_64+0x2cf/0xd80
[  750.456591] [   T9870]  ? __kasan_check_read+0x11/0x20
[  750.456897] [   T9870]  ? count_memcg_events+0x1b4/0x420
[  750.457280] [   T9870]  ? handle_mm_fault+0x148/0x690
[  750.457616] [   T9870]  ? _raw_spin_lock_irq+0x8a/0xf0
[  750.457925] [   T9870]  ? __kasan_check_read+0x11/0x20
[  750.458297] [   T9870]  ? fpregs_assert_state_consistent+0x68/0x100
[  750.458672] [   T9870]  ? irqentry_exit_to_user_mode+0x2e/0x250
[  750.459191] [   T9870]  ? irqentry_exit+0x43/0x50
[  750.459600] [   T9870]  ? exc_page_fault+0x75/0xe0
[  750.460130] [   T9870]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  750.460570] [   T9870] RIP: 0033:0x7858c94ab6e2
[  750.461206] [   T9870] Code: Unable to access opcode bytes at 0x7858c94ab6b8.
[  750.461780] [   T9870] RSP: 002b:00007858c9248ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000022
[  750.462327] [   T9870] RAX: fffffffffffffdfe RBX: 00007858c92496c0 RCX: 00007858c94ab6e2
[  750.462653] [   T9870] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[  750.462969] [   T9870] RBP: 00007858c9248d10 R08: 0000000000000000 R09: 0000000000000000
[  750.463290] [   T9870] R10: 0000000000000000 R11: 0000000000000246 R12: fffffffffffffde0
[  750.463640] [   T9870] R13: 0000000000000020 R14: 0000000000000002 R15: 00007ffc072d2230
[  750.463965] [   T9870]  </TASK>
[  750.464285] [   T9870] Modules linked in: siw ib_uverbs ccm cmac nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm ib_core cifs_md4 netfs softdog vboxsf vboxguest cpuid intel_rapl_msr intel_rapl_common intel_uncore_frequency_common intel_pmc_core pmt_telemetry pmt_class intel_pmc_ssram_telemetry intel_vsec polyval_clmulni ghash_clmulni_intel sha1_ssse3 aesni_intel rapl i2c_piix4 i2c_smbus joydev input_leds mac_hid sunrpc binfmt_misc kvm_intel kvm irqbypass sch_fq_codel efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vmw_vmci dmi_sysfs ip_tables x_tables autofs4 hid_generic vboxvideo usbhid drm_vram_helper psmouse vga16fb vgastate drm_ttm_helper serio_raw hid ahci libahci ttm pata_acpi video wmi [last unloaded: vboxguest]
[  750.467127] [   T9870] CR2: ffff8880110a2000

cc: Tom Talpey <tom@talpey.com>
cc: linux-cifs@vger.kernel.org
Reviewed-by: David Howells <dhowells@redhat.com>
Reviewed-by: Tom Talpey <tom@talpey.com>
Fixes: c45ebd636c32 ("cifs: Provide the capability to extract from ITER_FOLIOQ to RDMA SGEs")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

smb: client: fix first command failure during re-negotiation

after fabc4ed200f9, server_unresponsive add a condition to check whether client
need to reconnect depending on server->lstrp. When client failed to reconnect
for some time and abort connection, server->lstrp is updated for the last time.
In the following scene, server->lstrp is too old. This cause next command
failure in re-negotiation rather than waiting for re-negotiation done.

1. mount -t cifs -o username=Everyone,echo_internal=10 //$server_ip/export /mnt
2. ssh $server_ip "echo b > /proc/sysrq-trigger &"
3. ls /mnt
4. sleep 21s
5. ssh $server_ip "service firewalld stop"
6. ls # return EHOSTDOWN

If the interval between 5 and 6 is too small, 6 may trigger sending negotiation
request. Before backgrounding cifsd thread try to receive negotiation response
from server in cifs_readv_from_socket, server_unresponsive may trigger
cifs_reconnect which cause 6 to be failed:

ls thread
----------------
  smb2_negotiate
    server->tcpStatus = CifsInNegotiate
    compound_send_recv
      wait_for_compound_request

cifsd thread
----------------
  cifs_readv_from_socket
    server_unresponsive
      server->tcpStatus == CifsInNegotiate && jiffies > server->lstrp + 20s
        cifs_reconnect
          cifs_abort_connection: mid_state = MID_RETRY_NEEDED

ls thread
----------------
      cifs_sync_mid_result return EAGAIN
  smb2_negotiate return EHOSTDOWN

Though server->lstrp means last server response time, it is updated in
cifs_abort_connection and cifs_get_tcp_session. We can also update server->lstrp
before switching into CifsInNegotiate state to avoid failure in 6.

Fixes: 7ccc1465465d ("smb: client: fix hang in wait_for_response() for negproto")
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Acked-by: Meetakshi Setiya <msetiya@microsoft.com>
Signed-off-by: zhangjian <zhangjian496@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Merge tag 'io_uring-6.16-20250621' of git://git.kernel.dk/linux

Pull io_uring fix from Jens Axboe:
 "A single fix to hopefully wrap up the saga of receive bundles"

* tag 'io_uring-6.16-20250621' of git://git.kernel.dk/linux:
  io_uring/net: always use current transfer count for buffer put

Merge tag 'acpi-6.16-rc3' of git://git./linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "Fix a crash in ACPICA while attempting to evaluate a control method
  that expects more arguments than are being passed to it, which was
  exposed by a defective firmware update from a prominent OEM on
  multiple systems (Rafael Wysocki)"

* tag 'acpi-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPICA: Refuse to evaluate a method if arguments are missing

Merge tag 'pci-v6.16-fixes-1' of git://git./linux/kernel/git/pci/pci

Pull PCI fixes from Bjorn Helgaas:

 - Set up runtime PM even for devices that lack a PM Capability as we
   did before 4d4c10f763d7 ("PCI: Explicitly put devices into D0 when
   initializing"), which broke resume in some VFIO scenarios (Mario
   Limonciello)

 - Ignore pciehp Presence Detect Changed events caused by DPC, even if
   they occur after a Data Link Layer State Changed event, to fix a VFIO
   GPU passthrough regression in v6.13 (Lukas Wunner)

* tag 'pci-v6.16-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: pciehp: Ignore belated Presence Detect Changed caused by DPC
  PCI/PM: Set up runtime PM even for devices without PCI PM

Merge tag 'rcu/fixes-for-6.16-rc3' of git://git./linux/kernel/git/rcu/linux

Pull RCU fix from Joel Fernandes:
 "We recently got a report of a crash [1] with misuse of call_rcu().

  Instead of crashing the kernel, a warning and graceful return is
  better:

   - rcu: Return early if callback is not specified (Uladzislau Rezki)"

Link: https://lore.kernel.org/all/aEnVuzK7VhGSizWj@pc636/
* tag 'rcu/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:
  rcu: Return early if callback is not specified

Merge tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git./linux/kernel/git/perf/perf-tools

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix some file descriptor leaks that stand out with recent changes to
   'perf list'

 - Fix prctl include to fix building 'perf bench futex' hash with musl
   libc

 - Restrict 'perf test' uniquifying entry to machines with 'uncore_imc'
   PMUs

 - Document new output fields (op, cache, mem, dtlb, snoop) used with
   'perf mem'

 - Synchronize kernel header copies

* tag 'perf-tools-fixes-for-v6.16-1-2025-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  tools headers x86 cpufeatures: Sync with the kernel sources
  perf bench futex: Fix prctl include in musl libc
  perf test: Directory file descriptor leak
  perf evsel: Missed close() when probing hybrid core PMUs
  tools headers: Synchronize linux/bits.h with the kernel sources
  tools arch amd ibs: Sync ibs.h with the kernel sources
  tools arch x86: Sync the msr-index.h copy with the kernel sources
  tools headers: Syncronize linux/build_bug.h with the kernel sources
  tools headers: Update the copy of x86's mem{cpy,set}_64.S used in 'perf bench'
  tools headers UAPI: Sync linux/kvm.h with the kernel sources
  tools headers UAPI: Sync the drm/drm.h with the kernel sources
  perf beauty: Update copy of linux/socket.h with the kernel sources
  tools headers UAPI: Sync kvm header with the kernel sources
  tools headers x86 svm: Sync svm headers with the kernel sources
  tools headers UAPI: Sync KVM's vmx.h header with the kernel sources
  tools kvm headers arm64: Update KVM header from the kernel sources
  tools headers UAPI: Sync linux/prctl.h with the kernel sources to pick FUTEX knob
  perf mem: Document new output fields (op, cache, mem, dtlb, snoop)
  tools headers: Update the fs headers with the kernel sources
  perf test: Restrict uniquifying test to machines with 'uncore_imc'

Merge tag 'mtd/fixes-for-6.16-rc3' of git://git./linux/kernel/git/mtd/linux

Pull mtd fixes from Miquel Raynal:
 "The main fix that really needs to get in is the revert of the patch
  adding the new mtd_master class, because it entirely fails the
  partitioning if a specific Kconfig option is set. We need to think how
  to handle that differently, so let's revert it as we need to get back
  to the pen and paper situation again.

  Otherwise the definition of some Winbond SPI NAND chips are receiving
  some fixes (geometry and maximum frequency, mostly).

  And finally a small memory leak gets also fixed"

* tag 'mtd/fixes-for-6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
  mtd: spinand: fix memory leak of ECC engine conf
  mtd: spinand: winbond: Prevent unsupported frequencies on dual/quad I/O variants
  mtd: spinand: winbond: Increase maximum frequency on an octal operation
  mtd: spinand: winbond: Fix W35N number of planes/LUN
  Revert "mtd: core: always create master device"

Merge tag 'scsi-fixes' of git://git./linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Two small and obvious driver fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
  scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()

irqchip/ath79-misc: Fix missing prototypes warnings

ath79_misc_irq_init() was defined but unused since commit 51fa4f8912c0
("MIPS: ath79: drop legacy IRQ code"), so it's time to drop it.

The build also warns about a missing prototype of get_c0_perfcount_int().

Remove the stale leftover function and add the missing include.

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/OSBPR01MB167032D2017645200787AAEBBC72A@OSBPR01MB1670.jpnprd01.prod.outlook.com

rcu: Return early if callback is not specified

Currently the call_rcu() API does not check whether a callback
pointer is NULL. If NULL is passed, rcu_core() will try to invoke
it, resulting in NULL pointer dereference and a kernel crash.

To prevent this and improve debuggability, this patch adds a check
for NULL and emits a kernel stack trace to help identify a faulty
caller.

Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>

KVM: TDX: Exit to userspace for GetTdVmCallInfo

Exit to userspace for TDG.VP.VMCALL<GetTdVmCallInfo> via KVM_EXIT_TDX,
to allow userspace to provide information about the support of
TDVMCALLs when r12 is 1 for the TDVMCALLs beyond the GHCI base API.

GHCI spec defines the GHCI base TDVMCALLs: <GetTdVmCallInfo>, <MapGPA>,
<ReportFatalError>, <Instruction.CPUID>, <#VE.RequestMMIO>,
<Instruction.HLT>, <Instruction.IO>, <Instruction.RDMSR> and
<Instruction.WRMSR>. They must be supported by VMM to support TDX guests.

For GetTdVmCallInfo
- When leaf (r12) to enumerate TDVMCALL functionality is set to 0,
  successful execution indicates all GHCI base TDVMCALLs listed above are
  supported.

  Update the KVM TDX document with the set of the GHCI base APIs.

- When leaf (r12) to enumerate TDVMCALL functionality is set to 1, it
  indicates the TDX guest is querying the supported TDVMCALLs beyond
  the GHCI base TDVMCALLs.
  Exit to userspace to let userspace set the TDVMCALL sub-function bit(s)
  accordingly to the leaf outputs.  KVM could set the TDVMCALL bit(s)
  supported by itself when the TDVMCALLs don't need support from userspace
  after returning from userspace and before entering guest. Currently, no
  such TDVMCALLs implemented, KVM just sets the values returned from
  userspace.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
[Adjust userspace API. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>