Pull networking fixes from Jakub Kicinski:
 "Including fixes from CAN, netfilter, wireguard and IPsec.

  I'd like to highlight [ lowlight? - Linus ] Florian W stepping down as
  a netfilter maintainer due to constant stream of bug reports. Not sure
  what we can do but IIUC this is not the first such case.

  Current release - regressions:

   - rxrpc: fix use of page_frag_alloc_align(), it changed semantics and
     we added a new caller in a different subtree

   - xfrm: allow UDP encapsulation only in offload modes

  Current release - new code bugs:

   - tcp: fix refcnt handling in __inet_hash_connect()

   - Revert "net: Re-use and set mono_delivery_time bit for userspace
     tstamp packets", conflicted with some expectations in BPF uAPI

  Previous releases - regressions:

   - ipv4: raw: fix sending packets from raw sockets via IPsec tunnels

   - devlink: fix devlink's parallel command processing

   - veth: do not manipulate GRO when using XDP

   - esp: fix bad handling of pages from page_pool

  Previous releases - always broken:

   - report RCU QS for busy network kthreads (with Paul McK's blessing)

   - tcp/rds: fix use-after-free on netns with kernel TCP reqsk

   - virt: vmxnet3: fix missing reserved tailroom with XDP

  Misc:

   - couple of build fixes for Documentation"

* tag 'net-6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (59 commits)
  selftests: forwarding: Fix ping failure due to short timeout
  MAINTAINERS: step down as netfilter maintainer
  netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
  net: dsa: mt7530: fix handling of all link-local frames
  net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports
  bpf: report RCU QS in cpumap kthread
  net: report RCU QS on threaded NAPI repolling
  rcu: add a helper to report consolidated flavor QS
  ionic: update documentation for XDP support
  lib/bitmap: Fix bitmap_scatter() and bitmap_gather() kernel doc
  netfilter: nf_tables: do not compare internal table flags on updates
  netfilter: nft_set_pipapo: release elements in clone only from destroy path
  octeontx2-af: Use separate handlers for interrupts
  octeontx2-pf: Send UP messages to VF only when VF is up.
  octeontx2-pf: Use default max_active works instead of one
  octeontx2-pf: Wait till detach_resources msg is complete
  octeontx2: Detect the mbox up or down message via register
  devlink: fix port new reply cmd type
  tcp: Clear req->syncookie in reqsk_alloc().
  net/bnx2x: Prevent access to a freed page in page_pool
  ...

Pull more ARM SoC updates from Arnd Bergmann:
 "These are changes that for some reason ended up not making it into the
  first four branches but that should still make it into 6.9:

   - A rework of the omap clock support that touches both drivers and
     device tree files

   - The reset controller branch changes that had a dependency on late
     bugfixes. Merging them here avoids a backmerge of 6.8-rc5 into the
     drivers branch

   - The RISC-V/starfive, RISC-V/microchip and ARM/Broadcom devicetree
     changes that got delayed and needed some extra time in linux-next
     for wider testing"

* tag 'soc-late-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (31 commits)
  soc: fsl: dpio: fix kcalloc() argument order
  bus: ts-nbus: Improve error reporting
  bus: ts-nbus: Convert to atomic pwm API
  riscv: dts: starfive: jh7110: Add camera subsystem nodes
  ARM: bcm: stop selecing CONFIG_TICK_ONESHOT
  ARM: dts: omap3: Update clksel clocks to use reg instead of ti,bit-shift
  ARM: dts: am3: Update clksel clocks to use reg instead of ti,bit-shift
  clk: ti: Improve clksel clock bit parsing for reg property
  clk: ti: Handle possible address in the node name
  dt-bindings: pwm: opencores: Add compatible for StarFive JH8100
  dt-bindings: riscv: cpus: reg matches hart ID
  reset: Instantiate reset GPIO controller for shared reset-gpios
  reset: gpio: Add GPIO-based reset controller
  cpufreq: do not open-code of_phandle_args_equal()
  of: Add of_phandle_args_equal() helper
  reset: simple: add support for Sophgo SG2042
  dt-bindings: reset: sophgo: support SG2042
  riscv: dts: microchip: add specific compatible for mpfs pdma
  riscv: dts: microchip: add missing CAN bus clocks
  ARM: brcmstb: Add debug UART entry for 74165
  ...

Pull more thermal control updates from Rafael Wysocki:
 "These update thermal drivers for ARM platforms by adding new hardware
  support (r8a779h0, H616 THS), addressing issues (Mediatek LVTS,
  Mediatek MT7896, thermal-of) and cleaning up code.

  Specifics:

   - Fix memory leak in the error path at probe time in the Mediatek
     LVTS driver (Christophe Jaillet)

   - Fix control buffer enablement regression on Meditek MT7896 (Frank
     Wunderlich)

   - Drop spaces before TABs in different places: thermal-of, ST drivers
     and Makefile (Geert Uytterhoeven)

   - Adjust DT binding for NXP as fsl,tmu-range min/maxItems can vary
     among several SoC versions (Fabio Estevam)

   - Add support for the H616 THS controller on Sun8i platforms (Martin
     Botka)

   - Don't fail probe due to zone registration failure because there is
     no trip points defined in the DT (Mark Brown)

   - Support variable TMU array size for new platforms (Peng Fan)

   - Adjust the DT binding for thermal-of and make the polling time not
     required and assume it is zero when not found in the DT (Konrad
     Dybcio)

   - Add r8a779h0 support in both the DT and the rcar_gen3 driver (Geert
     Uytterhoeven)"

* tag 'thermal-6.9-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  thermal/drivers/rcar_gen3: Add support for R-Car V4M
  dt-bindings: thermal: rcar-gen3-thermal: Add r8a779h0 support
  thermal/of: Assume polling-delay(-passive) 0 when absent
  dt-bindings: thermal-zones: Don't require polling-delay(-passive)
  thermal/drivers/qoriq: Fix getting tmu range
  thermal/drivers/sun8i: Don't fail probe due to zone registration failure
  thermal/drivers/sun8i: Add support for H616 THS controller
  thermal/drivers/sun8i: Add SRAM register access code
  thermal/drivers/sun8i: Extend H6 calibration to support 4 sensors
  thermal/drivers/sun8i: Explain unknown H6 register value
  dt-bindings: thermal: sun8i: Add H616 THS controller
  soc: sunxi: sram: export register 0 for THS on H616
  dt-bindings: thermal: qoriq-thermal: Adjust fsl,tmu-range min/maxItems
  thermal: Drop spaces before TABs
  thermal/drivers/mediatek: Fix control buffer enablement on MT7896
  thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path

Pull devicetree updates from Rob Herring:
 "DT core:

   - Add cleanup.h based auto release of struct device_node pointers via
     __free marking and new for_each_child_of_node_scoped() iterator to
     use it.

   - Always create a base skeleton DT when CONFIG_OF is enabled. This
     supports several usecases of adding DT data on non-DT booted
     systems.

   - Move around some /reserved-memory code in preparation for further
     improvements

   - Add a stub for_each_property_of_node() for !OF

   - Adjust the printk levels on some messages

   - Fix __be32 sparse warning

   - Drop RESERVEDMEM_OF_DECLARE usage from Freescale qbman driver
     (currently orphaned)

   - Add Saravana Kannan and drop Frank Rowand as DT maintainers

  DT bindings:

   - Convert Mediatek timer, Mediatek sysirq, fsl,imx6ul-tsc,
     fsl,imx6ul-pinctrl, Atmel AIC, Atmel HLCDC, FPGA region, and
     xlnx,sd-fec to DT schemas

   - Add existing, but undocumented fsl,imx-anatop binding

   - Add bunch of undocumented vendor prefixes used in compatible
     strings

   - Drop obsolete brcm,bcm2835-pm-wdt binding

   - Drop obsolete i2c.txt which as been replaced with schema in
     dtschema

   - Add DPS310 device and sort trivial-devices.yaml

   - Enable undocumented compatible checks on DT binding examples

   - More QCom maintainer fixes/updates

   - Updates to writing-schema.rst and DT submitting-patches.rst to
     cover some frequent review comments

   - Clean-up SPDX tags to use 'OR' rather than 'or'"

* tag 'devicetree-for-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (56 commits)
  dt-bindings: soc: imx: fsl,imx-anatop: add imx6q regulators
  of: unittest: Use for_each_child_of_node_scoped()
  of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling
  of: Add cleanup.h based auto release via __free(device_node) markings
  of: Move all FDT reserved-memory handling into of_reserved_mem.c
  of: Add KUnit test to confirm DTB is loaded
  of: unittest: treat missing of_root as error instead of fixing up
  x86/of: Unconditionally call unflatten_and_copy_device_tree()
  um: Unconditionally call unflatten_device_tree()
  of: Create of_root if no dtb provided by firmware
  of: Always unflatten in unflatten_and_copy_device_tree()
  dt-bindings: timer: mediatek: Convert to json-schema
  dt-bindings: interrupt-controller: fsl,intmux: Include power-domains support
  soc: fsl: qbman: Remove RESERVEDMEM_OF_DECLARE usage
  dt-bindings: fsl-imx-sdma: fix HDMI audio index
  dt-bindings: soc: imx: fsl,imx-iomuxc-gpr: add imx6
  dt-bindings: soc: imx: fsl,imx-anatop: add binding
  dt-bindings: input: touchscreen: fsl,imx6ul-tsc convert to YAML
  dt-bindings: pinctrl: fsl,imx6ul-pinctrl: convert to YAML
  of: make for_each_property_of_node() available to to !OF
  ...

Merge additional thermal control changes for 6.9-rc1 from Daniel Lezcano:

"- Fix memory leak in the error path at probe time in the Mediatek LVTS
   driver (Christophe Jaillet)

 - Fix control buffer enablement regression on Meditek MT7896 (Frank
   Wunderlich)

 - Drop spaces before TABs in different places: thermal-of, ST drivers
   and Makefile (Geert Uytterhoeven)

 - Adjust DT binding for NXP as fsl,tmu-range min/maxItems can vary
   among several SoC versions (Fabio Estevam)

 - Add support for H616 THS controller for the Sun8i platforms. Note
   that this change relies on another change in the SoC specific code
   which is included in this branch (Martin Botka)

 - Don't fail probe due to zone registration failure because there is
   no trip points defined in the DT (Mark Brown)

 - Support variable TMU array size for new platforms (Peng Fan)

 - Adjust the DT binding for thermal-of and make the polling time not
   required and assume it is zero when not found in the DT (Konrad
   Dybcio)

 - Add r8a779h0 support in both the DT and the driver (Geert Uytterhoeven)"

* tag 'thermal-v6.9-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux:
  thermal/drivers/rcar_gen3: Add support for R-Car V4M
  dt-bindings: thermal: rcar-gen3-thermal: Add r8a779h0 support
  thermal/of: Assume polling-delay(-passive) 0 when absent
  dt-bindings: thermal-zones: Don't require polling-delay(-passive)
  thermal/drivers/qoriq: Fix getting tmu range
  thermal/drivers/sun8i: Don't fail probe due to zone registration failure
  thermal/drivers/sun8i: Add support for H616 THS controller
  thermal/drivers/sun8i: Add SRAM register access code
  thermal/drivers/sun8i: Extend H6 calibration to support 4 sensors
  thermal/drivers/sun8i: Explain unknown H6 register value
  dt-bindings: thermal: sun8i: Add H616 THS controller
  soc: sunxi: sram: export register 0 for THS on H616
  dt-bindings: thermal: qoriq-thermal: Adjust fsl,tmu-range min/maxItems
  thermal: Drop spaces before TABs
  thermal/drivers/mediatek: Fix control buffer enablement on MT7896
  thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path

A previous bugfix added a call to kcalloc(), which starting in gcc-14
causes a harmless warning about the argument order:

drivers/soc/fsl/dpio/dpio-service.c: In function 'dpaa2_io_service_enqueue_multiple_desc_fq':
drivers/soc/fsl/dpio/dpio-service.c:526:29: error: 'kcalloc' sizes specified with 'sizeof' in the earlier argument and not in the later argument [-Werror=calloc-transposed-args]
  526 |         ed = kcalloc(sizeof(struct qbman_eq_desc), 32, GFP_KERNEL);
      |                             ^~~~~~
drivers/soc/fsl/dpio/dpio-service.c:526:29: note: earlier argument should specify number of elements, later size of each element

Since the two are only multiplied, the order does not change the
behavior, so just fix it now to shut up the compiler warning.

Dmity independently came up with the same fix.

Fixes: 5c4a5999b245 ("soc: fsl: dpio: avoid stack usage warning")
Reported-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

smp_call_function always runs its callback in hard IRQ context, even on
PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock
for cgr_lock to ensure we aren't waiting on a sleeping task.

Although this bug has existed for a while, it was not apparent until
commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change")
which invokes smp_call_function_single via qman_update_cgr_safe every
time a link goes up or down.

Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()")
CC: stable@vger.kernel.org
Reported-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Closes: https://lore.kernel.org/all/20230323153935.nofnjucqjqnz34ej@skbuf/
Reported-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Closes: https://lore.kernel.org/linux-arm-kernel/87wmsyvclu.fsf@pengutronix.de/
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Reviewed-by: Camelia Groza <camelia.groza@nxp.com>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

smp_call_function_single disables IRQs when executing the callback. To
prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere.
This is already done by qman_update_cgr and qman_delete_cgr; fix the
other lockers.

Fixes: 96f413f47677 ("soc/fsl/qbman: fix issue in qman_delete_cgr_safe()")
CC: stable@vger.kernel.org
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Reviewed-by: Camelia Groza <camelia.groza@nxp.com>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull ARM SoC driver updates from Arnd Bergmann:
 "This is the usual mix of updates for drivers that are used on (mostly
  ARM) SoCs with no other top-level subsystem tree, including:

   - The SCMI firmware subsystem gains support for version 3.2 of the
     specification and updates to the notification code

   - Feature updates for Tegra and Qualcomm platforms for added hardware
     support

   - A number of platforms get soc_device additions for identifying
     newly added chips from Renesas, Qualcomm, Mediatek and Google

   - Trivial improvements for firmware and memory drivers amongst
     others, in particular 'const' annotations throughout multiple
     subsystems"

* tag 'soc-drivers-6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (96 commits)
  tee: make tee_bus_type const
  soc: qcom: aoss: add missing kerneldoc for qmp members
  soc: qcom: geni-se: drop unused kerneldoc struct geni_wrapper param
  soc: qcom: spm: fix building with CONFIG_REGULATOR=n
  bus: ti-sysc: constify the struct device_type usage
  memory: stm32-fmc2-ebi: keep power domain on
  memory: stm32-fmc2-ebi: add MP25 RIF support
  memory: stm32-fmc2-ebi: add MP25 support
  memory: stm32-fmc2-ebi: check regmap_read return value
  dt-bindings: memory-controller: st,stm32: add MP25 support
  dt-bindings: bus: imx-weim: convert to YAML
  watchdog: s3c2410_wdt: use exynos_get_pmu_regmap_by_phandle() for PMU regs
  soc: samsung: exynos-pmu: Add regmap support for SoCs that protect PMU regs
  MAINTAINERS: Update SCMI entry with HWMON driver
  MAINTAINERS: samsung: gs101: match patches touching Google Tensor SoC
  memory: tegra: Fix indentation
  memory: tegra: Add BPMP and ICC info for DLA clients
  memory: tegra: Correct DLA client names
  dt-bindings: memory: renesas,rpc-if: Document R-Car V4M support
  firmware: arm_scmi: Update the supported clock protocol version
  ...

The Allwinner H616 SoC contains a mysterious bit at register offset 0x0
in the SRAM control block. If bit 16 is set (the reset value), the
temperature readings of the THS are way off, leading to reports about
200C, at normal ambient temperatures. Clearing this bits brings the
reported values down to the expected values.
The BSP code clears this bit in firmware (U-Boot), and has an explicit
comment about this, but offers no real explanation.

Experiments in U-Boot show that register 0x0 has no effect on the SRAM C
visibility: all tested bit settings still allow full read and write
access by the CPU to the whole of SRAM C. Only bit 24 of the register at
offset 0x4 makes all of SRAM C inaccessible by the CPU. So modelling
the THS switch functionality as an SRAM region would not reflect reality.

Since we should not rely on firmware settings, allow other code (the THS
driver) to access this register, by exporting it through the already
existing regmap. This mimics what we already do for the LDO control and
the EMAC register.

To avoid concurrent accesses to the same register at the same time, by
the SRAM switch code and the regmap code, use the same lock to protect
the access. The regmap subsystem allows to use an existing lock, so we
just need to hook in there.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20240219153639.179814-2-andre.przywara@arm.com