io_uring_cancel_generic() should retry if any state changes like a
request is completed, however in case of a task exit it only goes for
another loop and avoids schedule() if any tracked (i.e. REQ_F_INFLIGHT)
request got completed.

Let's assume we have a non-tracked request executing in iowq and a
tracked request linked to it. Let's also assume
io_uring_cancel_generic() fails to find and cancel the request, i.e.
via io_run_local_work(), which may happen as io-wq has gaps.
Next, the request logically completes, io-wq still hold a ref but queues
it for completion via tw, which happens in
io_uring_try_cancel_requests(). After, right before prepare_to_wait()
io-wq puts the request, grabs the linked one and tries executes it, e.g.
arms polling. Finally the cancellation loop calls prepare_to_wait(),
there are no tw to run, no tracked request was completed, so the
tctx_inflight() check passes and the task is put to indefinite sleep.

Cc: stable@vger.kernel.org
Fixes: 3f48cf18

 ("io_uring: unify files and task cancel")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/acac7311f4e02ce3c43293f8f1fda9c705d158f1.1721819383.git.asml.silence@gmail.com


Signed-off-by: Jens Axboe <axboe@kernel.dk>

Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent
error handling in io_alloc_pbuf_ring().

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__io_remove_buffers+0xac/0x700 io_uring/kbuf.c:341
Call Trace:
 <TASK>
 io_put_bl io_uring/kbuf.c:378 [inline]
 io_destroy_buffers+0x14e/0x490 io_uring/kbuf.c:392
 io_ring_ctx_free+0xa00/0x1070 io_uring/io_uring.c:2613
 io_ring_exit_work+0x80f/0x8a0 io_uring/io_uring.c:2844
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Cc: stable@vger.kernel.org
Reported-by:  <syzbot+2074b1a3d447915c6f1c@syzkaller.appspotmail.com>
Fixes: 87585b05 ("io_uring/kbuf: use vm_insert_pages() for mmap'ed pbuf ring")
Signed-off-by: Pave...

There is a report that iowq executed getsockopt never completes. The
reason being that io_uring_cmd_sock() can return a positive result, and
io_uring_cmd() propagates it back to core io_uring, instead of IOU_OK.
In case of io_wq_submit_work(), the request will be dropped without
completing it.

The offending code was introduced by a hack in
a9c3eda7 ("io_uring: fix submission-failure handling for uring-cmd"),
however it was fine until getsockopt was introduced and started
returning positive results.

The right solution is to always return IOU_OK, since
e0b23d99 ("io_uring: optimise ltimeout for inline execution"),
we should be able to do it without problems, however for the sake of
backporting and minimising side effects, let's keep returning negative
return codes and otherwise do IOU_OK.

Link: https://github.com/axboe/liburing/issues/1181
Cc: stable@vger.kernel.org
Fixes: 8e9fad0e

 ("io_uring: Add io_uring command support for sockets")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://lore.kernel.org/r/ff349cf0654018189b6077e85feed935f0f8839e.1721149870.git.asml.silence@gmail.com


Signed-off-by: Jens Axboe <axboe@kernel.dk>

Pull RISC-V updates from Palmer Dabbelt:

 - Support for various new ISA extensions:
     * The Zve32[xf] and Zve64[xfd] sub-extensios of the vector
       extension
     * Zimop and Zcmop for may-be-operations
     * The Zca, Zcf, Zcd and Zcb sub-extensions of the C extension
     * Zawrs

 - riscv,cpu-intc is now dtschema

 - A handful of performance improvements and cleanups to text patching

 - Support for memory hot{,un}plug

 - The highest user-allocatable virtual address is now visible in
   hwprobe

* tag 'riscv-for-linus-6.11-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (58 commits)
  riscv: lib: relax assembly constraints in hweight
  riscv: set trap vector earlier
  KVM: riscv: selftests: Add Zawrs extension to get-reg-list test
  KVM: riscv: Support guest wrs.nto
  riscv: hwprobe: export Zawrs ISA extension
  riscv: Add Zawrs support for spinlocks
  dt-bindings: riscv: Add Zawrs ISA extension description
  riscv: Provide a definition for 'pause'
  riscv: hwprobe: export highest virtual userspace address
  riscv: Improve sbi_ecall() code generation by reordering arguments
  riscv: Add tracepoints for SBI calls and returns
  riscv: Optimize crc32 with Zbc extension
  riscv: Enable DAX VMEMMAP optimization
  riscv: mm: Add support for ZONE_DEVICE
  virtio-mem: Enable virtio-mem for RISC-V
  riscv: Enable memory hotplugging for RISC-V
  riscv: mm: Take memory hotplug read-lock during kernel page table dump
  riscv: mm: Add memory hotplugging support
  riscv: mm: Add pfn_to_kaddr() implementation
  riscv: mm: Refactor create_linear_mapping_range() for memory hot add
  ...

Pull MIPS updates from Thomas Bogendoerfer:

 - add support for Realtek RTL9302C

 - add support for Mobileye EyeQ6H

 - add support for Mobileye EyeQ OLB system controller

 - improve r4k clocksource

 - add mode for emulating ieee754 NAN2008

 - rework for BMIPS CBR address handling

 - fixes for Loongson 2K1000

 - defconfig updates

 - cleanups and fixes

* tag 'mips_6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (58 commits)
  MIPS: config: Add ip30_defconfig
  MIPS: config: lemote2f: Regenerate defconfig
  MIPS: config: generic: Add board-litex
  MIPS: config: Enable MSA and virtualization for MIPS64R6
  MIPS: Fix fallback march for SB1
  mips: dts: realtek: Add RTL9302C board
  mips: generic: add fdt fixup for Realtek reference board
  mips: select REALTEK_OTTO_TIMER for Realtek platforms
  dt-bindings: interrupt-controller: realtek,rtl-intc: Add rtl9300-intc
  dt-bindings: mips: realtek: Add rtl930x-soc compatible
  dt-bindings: vendor-prefixes: Add Cameo Communications
  mips: dts: realtek: add device_type property to cpu node
  mips: dts: realtek: use "serial" instead of "uart" in node name
  MIPS: Implement ieee754 NAN2008 emulation mode
  MIPS: lantiq: improve USB initialization
  MIPS: GIC: Generate redirect block accessors
  MIPS: CPS: Add a couple of multi-cluster utility functions
  MIPS: Octeron: remove source file executable bit
  MAINTAINERS: Mobileye: add OLB drivers and dt-bindings
  MIPS: mobileye: eyeq5: add OLB system-controller node
  ...

Pull powerpc updates from Michael Ellerman:

 - Remove support for 40x CPUs & platforms

 - Add support to the 64-bit BPF JIT for cpu v4 instructions

 - Fix PCI hotplug driver crash on powernv

 - Fix doorbell emulation for KVM on PAPR guests (nestedv2)

 - Fix KVM nested guest handling of some less used SPRs

 - Online NUMA nodes with no CPU/memory if they have a PCI device
   attached

 - Reduce memory overhead of enabling kfence on 64-bit Radix MMU kernels

 - Reimplement the iommu table_group_ops for pseries for VFIO SPAPR TCE

Thanks to: Anjali K, Artem Savkov, Athira Rajeev, Breno Leitao, Brian
King, Celeste Liu, Christophe Leroy, Esben Haabendal, Gaurav Batra,
Gautam Menghani, Haren Myneni, Hari Bathini, Jeff Johnson, Krishna
Kumar, Krzysztof Kozlowski, Nathan Lynch, Nicholas Piggin, Nick Bowler,
Nilay Shroff, Rob Herring (Arm), Shawn Anastasio, Shivaprasad G Bhat,
Sourabh Jain, Srikar Dronamraju, Timothy Pea...

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Define PCIE_RESET_CONFIG_DEVICE_WAIT_MS for the generic 100ms
     required after reset before config access (Kevin Xie)

   - Define PCIE_T_RRS_READY_MS for the generic 100ms required after
     reset before config access (probably should be unified with
     PCIE_RESET_CONFIG_DEVICE_WAIT_MS) (Damien Le Moal)

  Resource management:

   - Rename find_resource() to find_resource_space() to be more
     descriptive (Ilpo Järvinen)

   - Export find_resource_space() for use by PCI core, which needs to
     learn whether there is available space for a bridge window (Ilpo
     Järvinen)

   - Prevent double counting of resources so window size doesn't grow on
     each remove/rescan cycle (Ilpo Järvinen)

   - Relax bridge window sizing algorithm so a device doesn't break
     simply because it was removed and rescanned (Ilpo Järvinen)

   - Evaluate the ACPI PRE...

Pull input updates from Dmitry Torokhov:

 - streamlined logic in input core for handling normal input handlers vs
   input filters

 - updates to input drivers to allocate memory with sizeof(*pointer)
   instead of sizeof(type)

 - change to ads7846 touchscreen driver to use hsync GPIO instead of
   requiring platform data with special method (which is not compatible
   with boards using device tree)

 - update to adc-joystick driver to handle inverted axes

 - cleanups in various drivers switching them to use the new "guard" and
   "__free()" facilities

 - changes to several drivers (adxl34x, atmel_mxt_ts, ati-remote2,
   omap-keypad, yealink) to stop creating driver-specific device
   attributes manually and use driver core facilities for this

 - update to Cypress PS/2 protocol driver to properly handle errors from
   the PS/2 transport as well as other cleanups

 - update to edt-ft5x06 driver to support ft542...

Pull i2c fixes from Wolfram Sang:
 "The I2C core gains documentation updates for the testunit, a cleanup
  regarding unneeded 'driver_data' and more sanity checks in the char
  device.

  For the host drivers, this release includes significant updates, with
  the primary change being the renaming from "master/slave" to
  "controller/target" to adhere to I2C v7 and SMBus 3.2 standards.

  New Support:

   - Added support for Intel Arrow Lake-H
   - Added I2C support in the Arioha SoC by linking the Mediatek I2C
     controller

  Cleanups:

   - Added the MODULE_DESCRIPTION() macro, resolving a modpost warning
     in the ALi 1563 Southbridge driver.
   - Constified the regmap_config declaration in the i2c-designware
     driver.
   - Improved the coding style in the Renesas R-Car driver by removing
     unnecessary semicolons after brackets.

  General improvements:

   - In the OMAP device, replaced NOIRQ_SYSTEM_SLEEP_PM_OPS with
     RUNTIME_PM_OPS to enable waking up the controller during suspend()
     before suspend_noirq() kicks in.
   - Improved logging in the Xilinx driver.
   - Added a warning (WARN()) in the Renesas R-Car driver for spurious
     interrupts.

  DTS Changes:

   - Removed address-cell and size-cell from the Atmel at91sam, nVidia
     Tegra 20, and Samsung S3c2410 devices.
   - Fixed Texas Instruments OMAP4 I2C controller to comply with the
     i2c-controller.yaml schema.
   - Improved indentation in DTS examples for several I2C devices.
   - Converted the NXP LPC1788 binding to the dt-schema.
   - Added documentation for the compatible string thead,th1520-i2c.
   - Added the "power-domains" property for the Meson I2C driver.

  AT24 EEPROM driver changes:

   - add support for two new Microchip models
   - document even more new models in DT bindings (those use fallback
     compatibles so no code changes)"

* tag 'i2c-for-6.11-rc1-try2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (87 commits)
  i2c: document new callbacks in i2c_algorithm
  dt-bindings: i2c: amlogic,meson6-i2c: add optional power-domains
  dt-bindings: i2c: at91: Add sama7d65 compatible string
  i2c: st: reword according to newest specification
  i2c: cpm: reword according to newest specification
  i2c: virtio: reword according to newest specification
  i2c: nvidia-gpu: reword according to newest specification
  i2c: viai2c: reword according to newest specification
  i2c: viperboard: reword according to newest specification
  i2c: uniphier: reword according to newest specification
  i2c: uniphier-f: reword according to newest specification
  i2c: tiny-usb: reword according to newest specification
  i2c: thunderx-pcidrv: reword according to newest specification
  i2c: tegra-bpmp: reword according to newest specification
  i2c: taos-evm: reword according to newest specification
  i2c: sun6i-p2wi: reword according to newest specification
  i2c: stm32f4: reword according to newest specification
  i2c: sprd: reword according to newest specification
  i2c: sis5595: reword according to newest specification
  i2c: rzv2m: reword according to newest specification
  ...

Pull char / misc and other driver updates from Greg KH:
 "Here is the "big" set of char/misc and other driver subsystem changes
  for 6.11-rc1. Nothing major in here, just loads of new drivers and
  updates. Included in here are:

   - IIO api updates and new drivers added

   - wait_interruptable_timeout() api cleanups for some drivers

   - MODULE_DESCRIPTION() additions for loads of drivers

   - parport out-of-bounds fix

   - interconnect driver updates and additions

   - mhi driver updates and additions

   - w1 driver fixes

   - binder speedups and fixes

   - eeprom driver updates

   - coresight driver updates

   - counter driver update

   - new misc driver additions

   - other minor api updates

  All of these, EXCEPT for the final Kconfig build fix for 32bit
  systems, have been in linux-next for a while with no reported issues.
  The Kconfig fixup went in 29 hours ago, so might have missed the...

Pull staging driver updates from Greg KH:
 "This is the "big" staging driver update for 6.11-rc1. Not really all
  that much happened this release cycle, just lots of tiny cleanups,
  overall about 3000 lines removed, so the cleanups were worth it.

  Included in here are:

   - loads of rtl8723bs driver cleanups

   - lots of rtl8192e driver cleanups

   - vc04_services reworks and cleanups as that codebase gets slowly
     evolved into something that will make it into the "real" part of
     the kernel hopefully soon.

   - other tiny staging driver cleanups

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (124 commits)
  staging: rtl8723bs: Remove constant result function CheckNegative()
  staging: rtl8723bs: Remove unused macros in rtw_mlme_ext.h
  staging: rtl8723bs: Remove unused macros in hal_pwr_seq.h
  staging: rtl8723bs: Remove unused macros in rtw_efuse.h
  staging: rtl8723bs: Remove unused macros in rtw_mlme.h
  staging: rtl8723bs: Remove unused macros in HalPwrSeqCmd.h
  staging: rtl8723bs: Remove unused macros in Hal8723BReg.h
  staging: rtl8723bs: Remove unused macros in Hal8192CPhyReg.h
  staging: rtl8723bs: Delete file hal_phy_reg_8723b.h
  staging: rtl8723bs: Move last macro from hal_phy_reg_8723b.h
  staging: rtl8723bs: Remove unused macros in hal_phy_reg_8723b.h
  staging: rtl8723bs: Remove unused macros in hal_com_reg.h
  staging: rtl8723bs: Remove unused macros in rtw_ht.h
  staging: rtl8723bs: Remove unused macros in hal_com_h2c.h
  staging: vc04_services: vchiq_core: Stop kthreads on vchiq module unload
  staging: vchiq_core: Bubble up wait_event_interruptible() return value
  staging: nvec: Use x instead of x != NULL to improve readability.
  staging: rtl8192e: Fix conflicting types error with net_device.
  staging: rtl8723bs: Remove unused variable pwdev_priv
  staging: vc04_services: Update testing instructions
  ...

Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 6.11-rc1.

  Nothing earth-shattering in here, just constant forward progress in
  adding support for new hardware and better debugging functionalities
  for thunderbolt devices and the subsystem. Included in here are:

   - thunderbolt debugging update and driver additions

   - xhci driver updates

   - typec driver updates

   - kselftest device driver changes (acked by the relevant maintainers,
     depended on other changes in this tree.)

   - cdns3 driver updates

   - gadget driver updates

   - MODULE_DESCRIPTION() additions

   - dwc3 driver updates and fixes

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'usb-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (112 commits)
  kselftest: devices: Add test to detect device error logs
  kselftest: Move ksft...

Pull tty / serial updates from Greg KH:
 "Here is a small set of tty and serial driver updates for 6.11-rc1. Not
  much happened this cycle, unlike the previous kernel release which had
  lots of "excitement" in this part of the kernel. Included in here are
  the following changes:

   - dt binding updates for new platforms

   - 8250 driver updates

   - various small serial driver fixes and updates

   - printk/console naming and matching attempt #2 (was reverted for
     6.10-final, should be good to go this time around, acked by the
     relevant maintainers).

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'tty-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (22 commits)
  Documentation: kernel-parameters: Add DEVNAME:0.0 format for serial ports
  serial: core: Add serial_base_match_and_update_preferred_console()
  printk: Add match_devname_and_update_preferred_console()
  serial: sc16is7xx: hardware reset chip if reset-gpios is defined in DT
  dt-bindings: serial: sc16is7xx: add reset-gpios
  dt-bindings: serial: vt8500-uart: convert to json-schema
  serial: 8250_platform: Explicitly show we initialise ISA ports only once
  tty: add missing MODULE_DESCRIPTION() macros
  dt-bindings: serial: mediatek,uart: add MT7988
  serial: sh-sci: Add support for RZ/V2H(P) SoC
  dt-bindings: serial: Add documentation for Renesas RZ/V2H(P) (R9A09G057) SCIF support
  dt-bindings: serial: renesas,scif: Make 'interrupt-names' property as required
  dt-bindings: serial: renesas,scif: Validate 'interrupts' and 'interrupt-names'
  dt-bindings: serial: renesas,scif: Move ref for serial.yaml at the end
  riscv: dts: starfive: jh7110: Add the core reset and jh7110 compatible for uarts
  serial: 8250_dw: Use reset array API to get resets
  dt-bindings: serial: snps-dw-apb-uart: Add one more reset signal for StarFive JH7110 SoC
  serial: 8250: Extract platform driver
  serial: 8250: Extract RSA bits
  serial: imx: stop casting struct uart_port to struct imx_port
  ...

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Notably this includes fixes for a s390 build breakage.

  Current release - new code bugs:

   - eth: fbnic: fix s390 build

   - eth: airoha: fix NULL pointer dereference in
     airoha_qdma_cleanup_rx_queue()

  Previous releases - regressions:

   - flow_dissector: use DEBUG_NET_WARN_ON_ONCE

   - ipv4: fix incorrect TOS in route get reply

   - dsa: fix chip-wide frame size config in some drivers

  Previous releases - always broken:

   - netfilter: nf_set_pipapo: fix initial map fill

   - eth: gve: fix XDP TX completion handling when counters overflow"

* tag 'net-6.11-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net:
  eth: fbnic: don't build the driver when skb has more than 21 frags
  net: dsa: b53: Limit chip-wide jumbo frame config to CPU ports
  net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports
  net...

Pull btrfs fix from David Sterba:
 "A fix for build breakage on 32bit platforms"

* tag 'for-6.11-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: change BTRFS_MOUNT_* flags to 64bit type

Merge tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull uprobe fix from Masami Hiramatsu:

 - Add sys_uretprobe entry to scripts/syscall.tbl.

* tag 'probes-fixes-v6.11-pre-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  syscalls: Fix to add sys_uretprobe to syscall.tbl

Pull power sequencing fixes from Bartosz Golaszewski:
 "There's one fix for an invalid pointer dereference in error path
  reported by smatch and two patches that address the noisy config
  choices you reported earlier this week.

  Summary:

   - fix an invalid pointer dereference in error path in pwrseq core

   - reduce the Kconfig noise from PCI pwrctl choices"

* tag 'pwrseq-fixes-for-v6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  arm64: qcom: don't select HAVE_PWRCTL when PCI=n
  Kconfig: reduce the amount of power sequencing noise
  power: sequencing: fix an invalid pointer dereference in error path

Pull sound updates from Takashi Iwai:
 "Lots of changes in this cycle, but mostly for cleanups and
  refactoring.

  Significant amount of changes are about DT schema conversions for ASoC
  at this time while we see other usual suspects, too.

  Some highlights below:

  Core:
   - Re-introduction of PCM sync ID support API
   - MIDI2 time-base extension in ALSA sequencer API

  ASoC:
   - Syncing of features between simple-audio-card and the two
     audio-graph cards
   - Support for specifying the order of operations for components
     within cards to allow quirking for unusual systems
   - Lots of DT schema conversions
   - Continued SOF/Intel updates for topology, SoundWire, IPC3/4
   - New support for Asahi Kasei AK4619, Cirrus Logic CS530x, Everest
     Semiconductors ES8311, NXP i.MX95 and LPC32xx, Qualcomm LPASS v2.5
     and WCD937x, Realtek RT1318 and RT1320 and Texas Instruments
     PCM5242

  HD-audio:
 ...

Pull clk updates from Stephen Boyd:
 "This a large collection of clk driver updates and a handful of new SoC
  clk driver support.

  We have the usual Qualcomm clk drivers, along with clk drivers for the
  Sophgo and T-Head vendors, all to support some new SoCs.

  Nothing in particular stands out to me in the updates. There's the
  interconnect clk driver which exposes clks as interconnects, crossing
  subsystems. There's a bunch of janitorial things that are improving
  drivers in general like kmemdup_array() or fixing error paths. But
  overall the updates look normal to fix the description data which is
  usually the stuff that's wrong and/or untested.

  Core:
   - Skip gate basic type KUnit tests on s390 due to lack of MMIO
     emulation

  New Drivers:
   - AP sub-system clock controller in the T-Head TH1520
   - Sophgo Sophon sg2042 clk driver
   - Qualcomm SM7150 camera, display and video clk drivers
   - Qualc...

Pull virtio updates from Michael Tsirkin:
 "Several new features here:

   - Virtio find vqs API has been reworked (required to fix the
     scalability issue we have with adminq, which I hope to merge later
     in the cycle)

   - vDPA driver for Marvell OCTEON

   - virtio fs performance improvement

   - mlx5 migration speedups

  Fixes, cleanups all over the place"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (56 commits)
  virtio: rename virtio_find_vqs_info() to virtio_find_vqs()
  virtio: remove unused virtio_find_vqs() and virtio_find_vqs_ctx() helpers
  virtio: convert the rest virtio_find_vqs() users to virtio_find_vqs_info()
  virtio_balloon: convert to use virtio_find_vqs_info()
  virtiofs: convert to use virtio_find_vqs_info()
  scsi: virtio_scsi: convert to use virtio_find_vqs_info()
  virtio_net: convert to use virtio_find_vqs_info()
  virtio_crypto: convert to use virtio_find_vqs_info()
  virtio_console: convert to use virtio_find_vqs_info()
  virtio_blk: convert to use virtio_find_vqs_info()
  virtio: rename find_vqs_info() op to find_vqs()
  virtio: remove the original find_vqs() op
  virtio: call virtio_find_vqs_info() from virtio_find_single_vq() directly
  virtio: convert find_vqs() op implementations to find_vqs_info()
  virtio_pci: convert vp_*find_vqs() ops to find_vqs_info()
  virtio: introduce virtio_queue_info struct and find_vqs_info() config op
  virtio: make virtio_find_single_vq() call virtio_find_vqs()
  virtio: make virtio_find_vqs() call virtio_find_vqs_ctx()
  caif_virtio: use virtio_find_single_vq() for single virtqueue finding
  vdpa/mlx5: Don't enable non-active VQs in .set_vq_ready()
  ...

Pull VFIO updates from Alex Williamson:

 - Add support for 8-byte accesses when using read/write through the
   device regions.  This fills a gap for userspace drivers that might
   not be able to use access through mmap to perform native register
   width accesses (Gerd Bayer)

 - Add missing MODULE_DESCRIPTION to vfio-mdev sample drivers and
   replace a non-standard MODULE_INFO usage (Jeff Johnson)

* tag 'vfio-v6.11-rc1' of https://github.com/awilliam/linux-vfio:
  vfio-mdev: add missing MODULE_DESCRIPTION() macros
  vfio/pci: Fix typo in macro to declare accessors
  vfio/pci: Support 8-byte PCI loads and stores
  vfio/pci: Extract duplicated code into macro

Pull SCSI updates from James Bottomley:
 "Updates to the usual drivers (ufs, lpfc, qla2xxx, mpi3mr) plus some
  misc small fixes.

  The only core changes are to both bsg and scsi to pass in the device
  instead of setting it afterwards as q->queuedata, so no functional
  change"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (69 commits)
  scsi: aha152x: Use DECLARE_COMPLETION_ONSTACK for non-constant completion
  scsi: qla2xxx: Convert comma to semicolon
  scsi: qla2xxx: Update version to 10.02.09.300-k
  scsi: qla2xxx: Use QP lock to search for bsg
  scsi: qla2xxx: Reduce fabric scan duplicate code
  scsi: qla2xxx: Fix optrom version displayed in FDMI
  scsi: qla2xxx: During vport delete send async logout explicitly
  scsi: qla2xxx: Complete command early within lock
  scsi: qla2xxx: Fix flash read failure
  scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for ELS cmds
  scsi: qla2xx...

Merge tag 'for-6.11/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper updates from Mikulas Patocka:

 - Optimize processing of flush bios in the dm-linear and dm-stripe
   targets

 - Dm-io cleansups and refactoring

 - Remove unused 'struct thunk' in dm-cache

 - Handle minor device numbers > 255 in dm-init

 - Dm-verity refactoring & enabling platform keyring

 - Fix warning in dm-raid

 - Improve dm-crypt performance - split bios to smaller pieces, so that
   They could be processed concurrently

 - Stop using blk_limits_io_{min,opt}

 - Dm-vdo cleanup and refactoring

 - Remove max_write_zeroes_granularity and max_secure_erase_granularity

 - Dm-multipath cleanup & refactoring

 - Add dm-crypt and dm-integrity support for non-power-of-2 sector size

 - Fix reshape in dm-raid

 - Make dm_block_validator const

* tag 'for-6.11/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (33 commits)
  dm vdo: fix a minor formatting issue in vdo.rst
  dm vdo int-map: fix kerneldoc formatting
  dm vdo repair: add missing kerneldoc fields
  dm: Constify struct dm_block_validator
  dm-integrity: introduce the Inline mode
  dm: introduce the target flag mempool_needs_integrity
  dm raid: fix stripes adding reshape size issues
  dm raid: move _get_reshape_sectors() as prerequisite to fixing reshape size issues
  dm-crypt: support for per-sector NVMe metadata
  dm mpath: don't call dm_get_device in multipath_message
  dm: factor out helper function from dm_get_device
  dm-verity: fix dm_is_verity_target() when dm-verity is builtin
  dm: Remove max_secure_erase_granularity
  dm: Remove max_write_zeroes_granularity
  dm vdo indexer: use swap() instead of open coding it
  dm vdo: remove unused struct 'uds_attribute'
  dm: stop using blk_limits_io_{min,opt}
  dm-crypt: limit the size of encryption requests
  dm verity: add support for signature verification with platform keyring
  dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume
  ...

Pull dma-mapping updates from Christoph Hellwig:

 - reduce duplicate swiotlb pool lookups (Michael Kelley)

 - minor small fixes (Yicong Yang, Yang Li)

* tag 'dma-mapping-6.11-2024-07-19' of git://git.infradead.org/users/hch/dma-mapping:
  swiotlb: fix kernel-doc description for swiotlb_del_transient
  swiotlb: reduce swiotlb pool lookups
  dma-mapping: benchmark: Don't starve others when doing the test

Pull iommu updates from Will Deacon:
 "Core:

   - Support for the "ats-supported" device-tree property

   - Removal of the 'ops' field from 'struct iommu_fwspec'

   - Introduction of iommu_paging_domain_alloc() and partial conversion
     of existing users

   - Introduce 'struct iommu_attach_handle' and provide corresponding
     IOMMU interfaces which will be used by the IOMMUFD subsystem

   - Remove stale documentation

   - Add missing MODULE_DESCRIPTION() macro

   - Misc cleanups

  Allwinner Sun50i:

   - Ensure bypass mode is disabled on H616 SoCs

   - Ensure page-tables are allocated below 4GiB for the 32-bit
     page-table walker

   - Add new device-tree compatible strings

  AMD Vi:

   - Use try_cmpxchg64() instead of cmpxchg64() when updating pte

  Arm SMMUv2:

   - Print much more useful information on context faults

   - Fix Qualcomm TBU probing when CONFIG_ARM_SMMU_QCOM_DEBUG=n

   - Add new Qualcomm device-tree bindings

  Arm SMMUv3:

   - Support for hardware update of access/dirty bits and reporting via
     IOMMUFD

   - More driver rework from Jason, this time updating the PASID/SVA
     support to prepare for full IOMMUFD support

   - Add missing MODULE_DESCRIPTION() macro

   - Minor fixes and cleanups

  NVIDIA Tegra:

   - Fix for benign fwspec initialisation issue exposed by rework on the
     core branch

  Intel VT-d:

   - Use try_cmpxchg64() instead of cmpxchg64() when updating pte

   - Use READ_ONCE() to read volatile descriptor status

   - Remove support for handling Execute-Requested requests

   - Avoid calling iommu_domain_alloc()

   - Minor fixes and refactoring

  Qualcomm MSM:

   - Updates to the device-tree bindings"

* tag 'iommu-updates-v6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (72 commits)
  iommu/tegra-smmu: Pass correct fwnode to iommu_fwspec_init()
  iommu/vt-d: Fix identity map bounds in si_domain_init()
  iommu: Move IOMMU_DIRTY_NO_CLEAR define
  dt-bindings: iommu: Convert msm,iommu-v0 to yaml
  iommu/vt-d: Fix aligned pages in calculate_psi_aligned_address()
  iommu/vt-d: Limit max address mask to MAX_AGAW_PFN_WIDTH
  docs: iommu: Remove outdated Documentation/userspace-api/iommu.rst
  arm64: dts: fvp: Enable PCIe ATS for Base RevC FVP
  iommu/of: Support ats-supported device-tree property
  dt-bindings: PCI: generic: Add ats-supported property
  iommu: Remove iommu_fwspec ops
  OF: Simplify of_iommu_configure()
  ACPI: Retire acpi_iommu_fwspec_ops()
  iommu: Resolve fwspec ops automatically
  iommu/mediatek-v1: Clean up redundant fwspec checks
  RDMA/usnic: Use iommu_paging_domain_alloc()
  wifi: ath11k: Use iommu_paging_domain_alloc()
  wifi: ath10k: Use iommu_paging_domain_alloc()
  drm/msm: Use iommu_paging_domain_alloc()
  vhost-vdpa: Use iommu_paging_domain_alloc()
  ...

Pull rdma updates from Jason Gunthorpe:
 "Usual collection of small improvements and fixes:

   - Bug fixes and minor improvments in efa, irdma, mlx4, mlx5, rxe,
     hf1, qib, ocrdma

   - bnxt_re support for MSN, which is a new retransmit logic

   - Initial mana support for RC qps

   - Use after free bug and cleanups in iwcm

   - Reduce resource usage in mlx5 when RDMA verbs features are not used

   - New verb to drain shared recieve queues, similar to normal recieve
     queues. This is necessary to allow ULPs a clean shutdown. Used in
     the iscsi rdma target

   - mlx5 support for more than 16 bits of doorbell indexes

   - Doorbell moderation support for bnxt_re

   - IB multi-plane support for mlx5

   - New EFA adaptor PCI IDs

   - RDMA_NAME_ASSIGN_TYPE_USER to hint to userspace that it shouldn't
     rename the device

   - A collection of hns bugs

   - Fix long standing bug in bnxt_re with incorrect endian handling of
     immediate data"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (65 commits)
  IB/hfi1: Constify struct flag_table
  RDMA/mana_ib: Set correct device into ib
  bnxt_re: Fix imm_data endianness
  RDMA: Fix netdev tracker in ib_device_set_netdev
  RDMA/hns: Fix mbx timing out before CMD execution is completed
  RDMA/hns: Fix insufficient extend DB for VFs.
  RDMA/hns: Fix undifined behavior caused by invalid max_sge
  RDMA/hns: Fix shift-out-bounds when max_inline_data is 0
  RDMA/hns: Fix missing pagesize and alignment check in FRMR
  RDMA/hns: Fix unmatch exception handling when init eq table fails
  RDMA/hns: Fix soft lockup under heavy CEQE load
  RDMA/hns: Check atomic wr length
  RDMA/ocrdma: Don't inline statistics functions
  RDMA/core: Introduce "name_assign_type" for an IB device
  RDMA/qib: Fix truncation compilation warnings in qib_verbs.c
  RDMA/qib: Fix truncation compilation warnings in qib_init.c
  RDMA/efa: Add EFA 0xefa3 PCI ID
  RDMA/mlx5: Support per-plane port IB counters by querying PPCNT register
  net/mlx5: mlx5_ifc update for accessing ppcnt register of plane ports
  RDMA/mlx5: Add plane index support when querying PTYS registers
  ...

Pull iommufd updates from Jason Gunthorpe:

 - The iova_bitmap logic for efficiently reporting dirty pages back to
   userspace has a few more tricky corner case bugs that have been
   resolved and backed with new tests.

   The revised version has simpler logic.

 - Shared branch with iommu for handle support when doing domain attach.

   Handles allow the domain owner to include additional private data on
   a per-device basis.

 - IO Page Fault Reporting to userspace via iommufd. Page faults can be
   generated on fault capable HWPTs when a translation is not present.

   Routing them to userspace would allow a VMM to be able to virtualize
   them into an emulated vIOMMU. This is the next step to fully enabling
   vSVA support.

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (26 commits)
  iommufd: Put constants for all the uAPI enums
  iommufd: Fix error pointer checking
  iommufd: Add check on user response code
  iommufd: Remove IOMMUFD_PAGE_RESP_FAILURE
  iommufd: Require drivers to supply the cache_invalidate_user ops
  iommufd/selftest: Add coverage for IOPF test
  iommufd/selftest: Add IOPF support for mock device
  iommufd: Associate fault object with iommufd_hw_pgtable
  iommufd: Fault-capable hwpt attach/detach/replace
  iommufd: Add iommufd fault object
  iommufd: Add fault and response message definitions
  iommu: Extend domain attach group with handle support
  iommu: Add attach handle to struct iopf_group
  iommu: Remove sva handle list
  iommu: Introduce domain attachment handle
  iommufd/iova_bitmap: Remove iterator logic
  iommufd/iova_bitmap: Dynamic pinning on iova_bitmap_set()
  iommufd/iova_bitmap: Consolidate iova_bitmap_set exit conditionals
  iommufd/iova_bitmap: Move initial pinning to iova_bitmap_for_each()
  iommufd/iova_bitmap: Cache mapped length in iova_bitmap_map struct
  ...

Merge tag 'tpmdd-next-6.11-rc1-roundtwo' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull tpm fix from Jarkko Sakkinen:
 "An additional fix that supplements my earlier fixes for handling auth,
  which I unfortunately missed last time"

* tag 'tpmdd-next-6.11-rc1-roundtwo' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm: Use auth only after NULL check in tpm_buf_check_hmac_response()

Pull crypto update from Herbert Xu:
 "API:
   - Test setkey in no-SIMD context
   - Add skcipher speed test for user-specified algorithm

  Algorithms:
   - Add x25519 support on ppc64le
   - Add VAES and AVX512 / AVX10 optimized AES-GCM on x86
   - Remove sm2 algorithm

  Drivers:
   - Add Allwinner H616 support to sun8i-ce
   - Use DMA in stm32
   - Add Exynos850 hwrng support to exynos"

* tag 'v6.11-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (81 commits)
  hwrng: core - remove (un)register_miscdev()
  crypto: lib/mpi - delete unnecessary condition
  crypto: testmgr - generate power-of-2 lengths more often
  crypto: mxs-dcp - Ensure payload is zero when using key slot
  hwrng: Kconfig - Do not enable by default CN10K driver
  crypto: starfive - Fix nent assignment in rsa dec
  crypto: starfive - Align rsa input data to 32-bit
  crypto: qat - fix unintentional re-enabling of error inter...

Currently the BTRFS_MOUNT_* flags are already beyond 32 bits, this is
going to cause compilation errors for some 32 bit systems, as their
unsigned long is only 32 bits long, thus flag
BTRFS_MOUNT_IGNORESUPERFLAGS overflows and can lead to errors.

Fix the problem by:

- Migrate all existing BTRFS_MOUNT_* flags to unsigned long long
- Migrate all mount option related variables to unsigned long long
  * btrfs_fs_info::mount_opt
  * btrfs_fs_context::mount_opt
  * mount_opt parameter of btrfs_check_options()
  * old_opts parameter of btrfs_remount_begin()
  * old_opts parameter of btrfs_remount_cleanup()
  * mount_opt parameter of btrfs_check_mountopts_zoned()
  * mount_opt and opt parameters of check_ro_option()

Fixes: 32e62165

 ("btrfs: introduce new "rescue=ignoresuperflags" mount option")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

- Remove unused struct 'acpi_handle_node' (Dr. David Alan Gilbert)

- Use array notation for portdrv .id_table consistently (Masahiro Yamada)

- Switch to new Intel CPU model defines (Tony Luck)

- Add missing MODULE_DESCRIPTION() macros (Jeff Johnson)

* pci/misc:
  PCI: controller: Add missing MODULE_DESCRIPTION() macros
  PCI: Add missing MODULE_DESCRIPTION() macros
  PCI/PM: Switch to new Intel CPU model defines
  PCI: Use array for .id_table consistently
  ACPI: PCI: Remove unused struct 'acpi_handle_node'

- Make switchtec_class constant (Greg Kroah-Hartman)

* pci/switchtec:
  PCI: switchtec: Make switchtec_class constant

- Create "domain" symlink for vmd before adding devices below the VMD
  bridge so it's available when mdadm assembles RAID devices from them
  (Jiwei Sun)

* pci/controller/vmd:
  PCI: vmd: Create domain symlink before pci_bus_add_devices()

- Ensure Tegra194 and Tegra234 inbound ATU entries are 64KB-aligned to
  match the hardware restriction (Jon Hunter)

- Remove unused struct 'tegra_pcie_soc' (Dr. David Alan Gilbert)

* pci/controller/tegra194:
  PCI: tegra: Remove unused struct 'tegra_pcie_soc'
  PCI: tegra194: Set EP alignment restriction for inbound ATU

- Use dev_err_probe() in dw-rockchip probe error path so the failures
  aren't silent (Uwe Kleine-König)

- Sleep PCIE_T_PVPERL_MS (100ms) before deasserting PERST# (Damien Le Moal)

- Sleep PCIE_T_RRS_READY_MS (100ms) after conventional reset, before a
  config access (Damien Le Moal)

- Request the PERST# GPIO with GPIOD_OUT_LOW so it matches the POR value,
  which avoids a spurious PERST# assertion and fixes a Qcom modem firmware
  crash and issues with WLAN controllers, e.g., RTL8822CE (Manivannan
  Sadhasivam for rockchip, Niklas Cassel for dw-rockchip)

- Refactor dw-rockchip and add support for Endpoint mode for rk3568 and
  rk3588 (Niklas Cassel)

* pci/controller/rockchip:
  PCI: dw-rockchip: Use pci_epc_init_notify() directly
  PCI: dw-rockchip: Add endpoint mode support
  PCI: dw-rockchip: Refactor the driver to prepare for EP mode
  PCI: dw-rockchip: Add rockchip_pcie_get_ltssm() helper
  PCI: dw-rockchip: Fix weird indentation
  PCI: dw-rockchip: Fix initial PERST# GPIO value
  PCI: dw-rockchip: Add error messages in .probe() error paths
  PCI: rockchip: Use GPIOD_OUT_LOW flag while requesting ep_gpio
  PCI: rockchip-host: Wait 100ms after reset before starting configuration
  PCI: rockchip-host: Fix rockchip_pcie_host_init_port() PERST# handling

- Add Synopsys DWC macros for lane skew configuration (Yoshihiro Shimoda)

- Add struct rcar_gen4_pcie_drvdata to provide for future SoCs with
  different initialization requirements (Yoshihiro Shimoda)

- Add .ltssm_control() method for SoC dependencies (Yoshihiro Shimoda)

- Add r8a779g0 (R-Car V4H) support (Yoshihiro Shimoda)

* pci/controller/rcar-gen4:
  PCI: rcar-gen4: Add support for R-Car V4H
  PCI: rcar-gen4: Add .ltssm_control() for other SoC support
  PCI: rcar-gen4: Add struct rcar_gen4_pcie_drvdata
  PCI: dwc: Add PCIE_PORT_{FORCE,LANE_SKEW} macros

- Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup() to avoid
  excessive warnings when the driver is confused about link state when
  resuming (Marek Vasut)

* pci/controller/rcar:
  PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()

- Use devm_clk_bulk_get_all() to get all the clocks from DT to avoid
  writing out all the clock names (Manivannan Sadhasivam)

- Add DT binding and driver support for the SA8775P SoC (Mrinmay Sarkar)

- Refactor dw_pcie_edma_find_chip() to enable adding support for Hyper DMA
  (HDMA) (Manivannan Sadhasivam)

- Enable drivers to supply the eDMA channel count since some can't auto
  detect this (Manivannan Sadhasivam)

- Add HDMA support for the SA8775P SoC (Mrinmay Sarkar)

- Override the SA8775P NO_SNOOP default to avoid possible memory corruption
  (Mrinmay Sarkar)

- Make sure resources are disabled during PERST# assertion, even if the
  link is already disabled (Manivannan Sadhasivam)

- Vote for the CPU-PCIe ICC (interconnect) path to ensure it stays active
  even if other drivers don't vote for it (Krishna chaitanya chundru)

- Add Operating Performance Points (OPP) to scale performance state based
  on aggregate link bandwidth to improve SoC power efficiency (Krishna
  chaitanya chundru)

- Return failure instead of success if dev_pm_opp_find_freq_floor() fails
  (Dan Carpenter)

- Avoid an error pointer dereference if dev_pm_opp_find_freq_exact() fails
  (Dan Carpenter)

- Prevent use of uninitialized data in qcom_pcie_suspend_noirq() (Dan
  Carpenter)

* pci/controller/qcom:
  PCI: qcom: Prevent use of uninitialized data in qcom_pcie_suspend_noirq()
  PCI: qcom: Prevent potential error pointer dereference
  PCI: qcom: Fix missing error code in qcom_pcie_probe()
  PCI: qcom: Add OPP support to scale performance
  PCI: Bring the PCIe speed to MBps logic to new pcie_dev_speed_mbps()
  PCI: qcom: Add ICC bandwidth vote for CPU to PCIe path
  PCI: qcom-ep: Disable resources unconditionally during PERST# assert
  PCI: qcom-ep: Override NO_SNOOP attribute for SA8775P EP
  PCI: qcom: Override NO_SNOOP attribute for SA8775P RC
  PCI: epf-mhi: Enable HDMA for SA8775P SoC
  PCI: qcom-ep: Add HDMA support for SA8775P SoC
  PCI: dwc: Pass the eDMA mapping format flag directly from glue drivers
  PCI: dwc: Skip finding eDMA channels count for HDMA platforms
  PCI: dwc: Refactor dw_pcie_edma_find_chip() API
  PCI: qcom-ep: Add support for SA8775P SOC
  dt-bindings: PCI: qcom-ep: Add support for SA8775P SoC
  PCI: qcom: Use devm_clk_bulk_get_all() API

- Move PLDA XpressRICH generic DT binding properties to
  plda,xpressrich3-axi-common.yaml where they can be shared across
  PLDA-based drivers (Minda Chen)

- Create a drivers/pci/controller/plda/ directory for PLDA-based drivers
  and move pcie-microchip-host.c there (Minda Chen)

- Move PLDA generic macros to pcie-plda.h where they can be shared across
  drivers (Minda Chen)

- Extract PLDA generic structures from pcie-microchip-host.c, rename them
  to be generic, and move them to pcie-plda-host.c where they can be shared
  across drivers (Minda Chen)

- Add a .request_event_irq() callback for requesting device-specific
  interrupts in addition to PLDA-generic interrupts (Minda Chen)

- Add DT binding and driver for the StarFive JH7110 SoC, based on PLDA IP
  (Minda Chen)

* pci/controller/microchip:
  PCI: starfive: Add JH7110 PCIe controller
  dt-bindings: PCI: Add StarFive JH7110 PCIe controller
  PCI: Add PCIE_RESET_CONFIG_DEVICE_WAIT_MS waiting time value
  PCI: plda: Pass pci_host_bridge to plda_pcie_setup_iomems()
  PCI: plda: Add host init/deinit and map bus functions
  PCI: plda: Add event bitmap field to struct plda_pcie_rp
  PCI: microchip: Move IRQ functions to pcie-plda-host.c
  PCI: microchip: Add event irqchip field to host port and add PLDA irqchip
  PCI: microchip: Add get_events() callback and PLDA get_event()
  PCI: microchip: Add INTx and MSI event num to struct plda_event
  PCI: microchip: Add request_event_irq() callback function
  PCI: microchip: Add num_events field to struct plda_pcie_rp
  PCI: microchip: Rename interrupt related functions
  PCI: microchip: Move PLDA functions to pcie-plda-host.c
  PCI: microchip: Rename PLDA functions to be generic
  PCI: microchip: Move PLDA structures to plda-pcie.h
  PCI: microchip: Rename PLDA structures to be generic
  PCI: microchip: Add bridge_addr field to struct mc_pcie
  PCI: microchip: Move PLDA IP register macros to pcie-plda.h
  PCI: microchip: Move pcie-microchip-host.c to PLDA directory
  dt-bindings: PCI: Add PLDA XpressRICH PCIe host common properties

# Conflicts:
#	drivers/pci/pci.h

* pci/controller/loongson:
  PCI: loongson: Enable MSI in LS7A Root Complex