Pull SoC fixes from Arnd Bergmann:
 "The driver fixes are all for simple mistakes: a use-after-free bug on
  Samsung Exynos, error handling and reference counting on Arm SCMI
  firmware and a problem dealing with inconsistent firmware information.

  The rest are devicetree fixes for arm64 platforms from Altera, Renesas
  and Amlogic. On the Renesas platform, one patch addresses a boot time
  regression, the rest address minor performance and correctness issues"

* tag 'soc-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (21 commits)
  soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
  arm64: dts: renesas: r8a779f0: Set UFS lane count
  firmware: arm_scmi: Fix typo "upto" in comment
  arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR
  firmware: arm_ffa: Tear down driver during shutdown
  clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq
  clk: scpi: register scpi-cpufreq once and clear on failure
  clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
  firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
  firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id
  arm64: dts: socfpga: change access permission from 755 to 644
  ARM: socfpga: select the PL310 erratum 753970 workaround
  arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM
  arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies
  arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs
  arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled
  ...

Pull arm64 fixes from Will Deacon:
 "In this batch we've got a couple of hibernation fixes, a couple of
  minor MTE fixes, some per-cpu codegen fixes (which were found as part
  of Mark's series adding preemptible this_cpu_*() operations) and a fix
  for the Arm CMN PMU driver.

  Summary:

   - Fix hypercall arguments when resetting EL2 vectors during
     hibernation

   - Fix hibernation with 52-bit capable kernels on machines without
     52-bit addressing, similarly to the recent kexec fix

   - Fix a bunch of clumsy codegen issues with our per-cpu accessors

   - Fix MTE ptrace documentation to reflect the de-facto ABI behaviour

   - Fix pthread_join() usage in MTE selftest

   - Fix port selection in the Arm CMN PMU driver"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: mte: Fix PTRACE_{PEEK,POKE}MTETAGS error documentation
  kselftest/arm64: Fix size of thread_data values for pthread_join()
  arm64: percpu: Fix LSE operations on {8,16}-bit types
  arm64: percpu: Fix this_cpu_and() mask generation
  arm64: percpu: Fix this_cpu_write() casting
  arm64: hibernate: clone only the linear map that exists at runtime
  perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
  arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

Renesas fixes for v7.3 (take two)

  - Fix UFS regression on R-Car S4.

* tag 'renesas-fixes-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: r8a779f0: Set UFS lane count

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Amlogic DT Fixes for v7.3:
- Set of fixes for Amlogic T7:
 - use the real UART pclk
 - allow the SD card to be power cycled by dropping regulator-always-on
 - fix the pin groups of two PWM outputs
 - add the CPU cores PWM-driven supplies to fix runtime crashes
 - fix the pin groups of the vsync PWM using non-existing pin group

* tag 'amlogic-fixes-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux:
  arm64: dts: amlogic: t7: fix the pin groups of the vsync PWM
  arm64: dts: amlogic: t7: khadas-vim4: add the PWM-driven supplies
  arm64: dts: amlogic: t7: fix the pin groups of two PWM outputs
  arm64: dts: amlogic: t7: khadas-vim4: allow the SD card to be power cycled
  arm64: dts: amlogic: t7: use the real UART pclk

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Renesas fixes for v7.3

  - Fix Ethernet stalls on RZ/V2H, RZ/V2N, RZ/G3E, RZ/T2H, and RZ/N2H.

* tag 'renesas-fixes-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel:
  arm64: dts: renesas: r9a09g087: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g077: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g047: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g056: Switch GBETH TX queue scheduling to WRR
  arm64: dts: renesas: r9a09g057: Switch GBETH TX queue scheduling to WRR

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

SoCFPGA DTS fix for v7.3
- Fix DTS file access permissions

* tag 'socfpga_dts_fix_for_v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  arm64: dts: socfpga: change access permission from 755 to 644

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Since commit e72323f3b09f ("scsi: ufs: core: Configure only active lanes
during link"), the following error is observed on R-Car S4:

    ufshcd-renesas e6860000.ufs: Tx lane mismatch [config,reported] [2,1]
    ufshcd-renesas e6860000.ufs: link startup failed -67
    ufshcd-renesas e6860000.ufs: error -ENOLINK: Initialization failed with error -67
    ufshcd-renesas e6860000.ufs: probe with driver ufshcd-renesas failed with error -67

R-Car S4 has one UFS lane per direction, as described in section 152.1
of its hardware manual.  Without lanes-per-direction, the UFS platform
driver defaults to two lanes.

Previously, the core used PA_CONNECTEDRXDATALANES and
PA_CONNECTEDTXDATALANES to configure the link without checking them
against lanes-per-direction, so the missing property did not prevent
initialization.

Explicitly set lanes-per-direction to 1, now that the validation is in
place.

Fixes: 5235d551779d ("arm64: dts: renesas: r8a779f0: Add UFS node")
Cc: stable@vger.kernel.org # 7.2+
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260911073058.253000-1-den@valinux.co.jp
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

PTRACE_{PEEK,POKE}MTETAGS return -EIO rather than -EOPNOTSUPP (as
documented) when no tags are copied from/to a mapping without PROT_MTE.
This has been the behaviour since the interface was introduced, though
the original intent was to distinguish between address not being
accessible and mapped as untagged.

Update the documentation to match the implementation (de-facto ABI).
Since -EOPNOTSUPP was never returned, change the error assignment to
-EIO as well to avoid confusion.

Fixes: df9d7a22dd21 ("arm64: mte: Add Memory Tagging Extension documentation")
Fixes: 18ddbaa02b7a ("arm64: mte: ptrace: Add PTRACE_{PEEK,POKE}MTETAGS support")
Reported-by: Yury Khrustalev <yury.khrustalev@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>

The assembly for __percpu_##name##_case_##sz() and
__percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro
argument to form the LSE instruction. Without 'sfx', a W register
argument will imply a 32-bit memory location, and consequently
{8,16}-bit ops will erroneously read and write 32 bits of memory when
the LSE instruction is used.

Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not
necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is
a register-register operation which does not access memory (and does not
take a size suffix).

Fixes: 959bf2fd03b5 ("arm64: percpu: Rewrite per-cpu ops to allow use of LSE atomics")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Cc: Ada Couprie Diaz <ada.coupriediaz@arm.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vladimir Murzin <vladimir.murzin@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <yang@os.amperecomputing.com>
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>

The arm64 implementation of this_cpu_and(pcp, val) is built in terms of
ANDNOT operations, which requires the 'val' argument to be bitwise
negated. The bitwise negation is not implemented correctly, with two
bugs described below.

(1) The bitwise negation is performed as '~val' rather than '~(val)'.
    This won't always generate the expected value when 'val' is an
    expression.

    For example, for this_cpu_and(pcp, 1 - 1):

    * 'val'    is  '1 - 1'   ===> (int) 0x00000000
    * '~val'   is '~1 - 1'   ===> (int) 0xfffffffd
    * '~(val)' is '~(1 - 1)' ===> (int) 0xffffffff

    ... and thus bit[1] of 'pcp' would be preserved unexpectedly by the
    ANDNOT operation.

(2) The bitwise negation is performed on 'val' before it has been cast
    to (at least) the width of 'pcp'. This won't always generate the
    expected value for the upper bits.

    For example, for this_cpu_and(pcp, zero), where 'pcp' is a u64 and
    'zero' is a u32:

    * 'zero'           ===> (u32) 0x00000000
    * '~(zero)'        ===> (u32) 0xffffffff
    * '(u64)~(zero)'   ===> (u64) 0x00000000ffffffff
    * '~((u64)(zero))' ===> (u64) 0xffffffffffffffff

    ... and thus bits[63:32] of 'pcp' would be preserved unexpectedly by
    the ANDNOT operation.

Fix these issues by adding brackets around 'val', and by casting 'val'
to an appropriately-sized type before bitwise negation.

Fixes: 959bf2fd03b5 ("arm64: percpu: Rewrite per-cpu ops to allow use of LSE atomics")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Tested-by: Muhammad Usama Anjum <usama.anjum@arm.com>
Acked-by: Christopher Lameter (Ampere) <cl@gentwo.org>
Cc: Ada Couprie Diaz <ada.coupriediaz@arm.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Vladimir Murzin <vladimir.murzin@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yang Shi <yang@os.amperecomputing.com>
Cc: stable@vger.kernel.org
Signed-off-by: Will Deacon <will@kernel.org>