Pull SoC fixes from Arnd Bergmann:
 "A few last minute fixes came in this week:

   - interrupt and gpio numbers in foud separate i.MX8 specific
     devicetree files were wrong

   - The vector length property in the C906 CPU description used the
     wrong unit

   - Two bugs with uninitialized stack variables in the tee subsystem

   - Alexander Stein now maintains additional devicetree files"

* tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  riscv: dts: allwinner: d1: fix vlenb property
  MAINTAINERS: Add entry for TQ-Systems AM335 device trees
  tee: qcomtee: initialize result before use in release worker
  arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
  tee: qcomtee: fix uninitialized pointers with free attribute
  ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos
  arm64: dts: imx8dxl: Correct pcie-ep interrupt number

Pull arm64 fixes from Will Deacon:
 "We've got a revert due to one of the recent CCA commits breaking ACPI
  firmware-based error reporting, a fix for a hard-lockup introduced by
  a prior fix affecting non-default (CONFIG_EXPERT) configurations and
  another ACPI fix for systems using MMIO-based timers.

  Other than that, we're looking pretty good.

   - Avoid hardlockup when CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=n

   - Fix regression in APEI/GHES error handling

   - Fix MMIO timers when probed via ACPI"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: proton-pack: Fix hard lockup when !MITIGATE_SPECTRE_BRANCH_HISTORY
  ACPI: GTDT: Correctly number platform devices for MMIO timers
  Revert "arm64: acpi: Enable ACPI CCEL support"

The "drop print" commit removed the whole branch and not just the print.
For some ARM64 cpus, this leads to hard lockup when
CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not enabled.

Fixes: 62e72463ca71 ("arm64: proton-pack: Drop print when !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY")
Signed-off-by: Jonathan Marek <jonathan@marek.ca>
Signed-off-by: Will Deacon <will@kernel.org>

This reverts commit d02c2e45b1e7767b177f6854026e4ad0d70b4a4d.

Mauro reports that this breaks APEI notifications on his QEMU setup
because the "reserved for firmware" region still needs to be writable
by Linux in order to signal _back_ to the firmware after processing
the reported error:

  | {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
  | ...
  | [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
  | Unable to handle kernel write to read-only memory at virtual address ffff800080035018
  | Mem abort info:
  |   ESR = 0x000000009600004f
  |   EC = 0x25: DABT (current EL), IL = 32 bits
  |   SET = 0, FnV = 0
  |   EA = 0, S1PTW = 0
  |   FSC = 0x0f: level 3 permission fault
  | Data abort info:
  |   ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000
  |   CM = 0, WnR = 1, TnD = 0, TagAccess = 0
  |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
  | swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000505d7000
  | pgd=10000000510bc003, p4d=1000000100229403, pud=100000010022a403, pmd=100000010022b403, pte=0060000139b90483
  | Internal error: Oops: 000000009600004f [#1]  SMP

For now, revert the offending commit. We can presumably switch back to
PAGE_KERNEL when bringing this back in the future.

Link: https://lore.kernel.org/r/20251121224611.07efa95a@foz.lan
Reported-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>

i.MX fixes for 6.18, 2nd round:

- Correct i.MX8DXL's pcie-ep interrupt number (Frank Li)
- Swap interrupt numbers of eqos for imx8dxl-ss-conn (Frank Li)
- Correct SAI3 interrupt line for i.MX6UL (Maarten Zanders)
- Correct mux-controller select/enable-gpios polarity for imx8qm-mek
  board (Xu Yang)

* tag 'imx-fixes-6.18-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
  ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos
  arm64: dts: imx8dxl: Correct pcie-ep interrupt number

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Pull SoC fixes from Arnd Bergmann:
 "These are mainly devicetree fixes for the arm platforms from Rockchips
  NXP, ASpeed and Broadcom, addressing issues with accidental
  overclocking, pinctrl, network and dtc warnings.

  There are additional fixes for regressions with the i.MX reset and
  memory controller drivers as well as the Tegra memory controller
  driver.

  Minor updates to the MAINTAINERS file, tee documentation and
  defconfigs bring those up to date with recent changes elsewhere"

* tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (29 commits)
  MAINTAINERS: sync omap devicetree maintainers with omap platform
  MAINTAINERS: Update Krzysztof Kozlowski's email
  arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
  arm64: dts: rockchip: disable HS400 on RK3588 Tiger
  arm64: dts: rockchip: drop reset from rk3576 i2c9 node
  tee: <uapi/linux/tee.h: fix all kernel-doc issues
  arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2
  arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias
  arm64: dts: broadcom: Assign clock rates in eth node for RPi5
  reset: imx8mp-audiomix: Fix bad mask values
  ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
  arm64: defconfig: Fix V3D deferred probe timeout
  arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2
  arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1
  arm64: dts: imx8mp-kontron: Fix USB OTG role switching
  arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes
  arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred
  arm: imx_v6_v7_defconfig: enable ext4 directly
  memory: tegra210: Fix incorrect client ids
  arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso
  ...

Regulator/supply fixes for a number of boards, removed too fast
cpu OPPs from rk3576 (not supported in newer vendor TF-A and never
supported in upstream TF-A). As well as some DTS validation fixes
and one pinctrl fix for the odroid-m1.

* tag 'v6.18-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
  arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
  arm64: dts: rockchip: disable HS400 on RK3588 Tiger
  arm64: dts: rockchip: drop reset from rk3576 i2c9 node
  arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2
  arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2
  arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1
  arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso
  arm64: dts: rockchip: Make RK3588 GPU OPP table naming less generic
  arm64: dts: rockchip: Drop 'rockchip,grf' prop from tsadc on rk3328
  arm64: dts: rockchip: Remove non-functioning CPU OPPs from RK3576
  arm64: dts: rockchip: Fix PCIe power enable pin for BigTreeTech CB2 and Pi2
  arm64: dts: rockchip: Set correct pinctrl for I2S1 8ch TX on odroid-m1

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Pull kvm fixes from Paolo Bonzini:
 "Arm:

   - Only adjust the ID registers when no irqchip has been created once
     per VM run, instead of doing it once per vcpu, as this otherwise
     triggers a pretty bad conbsistency check failure in the sysreg code

   - Make sure the per-vcpu Fine Grain Traps are computed before we load
     the system registers on the HW, as we otherwise start running
     without anything set until the first preemption of the vcpu

  x86:

   - Fix selftests failure on AMD, checking for an optimization that was
     not happening anymore"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: SVM: Fix redundant updates of LBR MSR intercepts
  KVM: arm64: VHE: Compute fgt traps before activating them
  KVM: arm64: Finalize ID registers only once per VM

KVM/arm64 fixes for 6.18, take #3

- Only adjust the ID registers when no irqchip has been created once
  per VM run, instead of doing it once per vcpu, as this otherwise
  triggers a pretty bad conbsistency check failure in the sysreg code.

- Make sure the per-vcpu Fine Grain Traps are computed before we load
  the system registers on the HW, as we otherwise start running without
  anything set until the first preemption of the vcpu.

The recent fix to properly initialize the tags of the huge zero folio
had an unfortunate not-so-subtle side effect: it caused the actual
*contents* of the huge zero folio to not be initialized at all when the
hardware didn't support the memory tagging.

The reason was the unfortunate semantics of tag_clear_highpage(): on
hardware that didn't do the tagging, it would silently just not do
anything at all.  And since this is done only on arm64 with MTE support,
that basically meant most hardware.

It wasn't necessarily immediately obvious since the huge zero page isn't
necessarily very heavily used - or because it might already be zero
because all-zeroes is the most common pattern.  But it ends up causing
random odd user space failures when you do hit it.

The unfortunate semantics have been around for a while, but became a
real bug only when we started actively using __GFP_ZEROTAGS in the
generic get_huge_zero_folio() function - before that, it had only ever
been used in code that checked that the hardware supported it.

Fix this by simply changing the semantics of tag_clear_highpage() to
return whether it actually successfully did something or not.  While at
it, also make it initialize multiple pages in one go, since that's
actually what the only caller wants it to do and it simplifies the whole
logic.

Fixes: adfb6609c680 ("mm/huge_memory: initialise the tags of the huge zero folio")
Link: https://lore.kernel.org/all/20251117082023.90176-1-00107082@163.com/
Reviewed-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reported-and-tested-by: David Wang <00107082@163.com>
Reported-and-tested-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>