Pull x86 platform driver updates from Ilpo Järvinen:
 "The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:
   - new model names and recent CPU support
   - more special button / function key handling
   - battery and hardware monitoring quirks

  Tool updates to intel-speed-select

  WMI now supports non-x86 architectures

  Miscellaneous cleanups / refactoring / improvements"

* tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)
  platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes
  platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming
  platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD
  platform/x86: asus-armoury: add power limits quirk for GU605CM
  platform/x86: asus-armoury: add power limits quirk for G533QS
  platform/x86: asus-armoury: add power limits quirk for GA402NV
  platform/x86: asus-armoury: add power limits quirk for FA608UP
  platform/x86: asus-armoury: add power limits quirk for FA608UH
  platform/x86: asus-armoury: add power limits quirk for FA608PM
  platform/x86: asus-armoury: add power limits quirk for G713QR
  platform/x86: ibm_rtl: Fix potential OOB read at signature search
  platform/x86: acer-wmi: Add support for Acer Nitro AN16-41
  platform/x86: acer-wmi: Cycle platform profile on mode key 0x4
  platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable
  platform/x86: gpd pocket fan: Cancel work before releasing GPIOs
  platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables
  platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd
  platform/x86: msi-wmi: Sort scancodes numerically
  platform: arm64: Add a driver for the EC found on ASUS Glymur machines
  MAINTAINERS: Add myself as a LENOVO drivers co-maintainer
  ...

Pull liveupdate updates from Mike Rapoport:

 - Several small fixes to KHO and LiveUpdate selftest

 - A series that renames "KHO scratch" to "KHO bootmem" because this
   memory is way more important in kexec'ed kernels rather than in the
   original cold boot kernel and the new name reflects it

* tag 'liveupdate-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  kho: do not reserve empty per-node bootmem areas
  selftests/liveupdate: Prefer KVM and HVF over TCG in vmtest.sh
  kho: rename kho_scratch= commandline parameter to kho_bootmem=
  kho: rename KHO scratch to KHO bootmem
  memblock: rename KHO_SCRATCH to KHO_NOPRSRV
  memblock: get rid of CONFIG_MEMBLOCK_KHO_SCRATCH
  kho: docs: fix scratch_phys debugfs cross-reference
  kho: do not reserve scratch memory in the kdump kernel

Pull KVM updates from Paolo Bonzini:
 "ARM:

   - pKVM state isolation: years after pKVM started being enabled
     upstream, we finally get the basics in the form of state isolation.
     The vcpu state is now off-limit for the host for protected VMs

   - pKVM also grows a hypervisor-private memory allocator, allowing it
     to deal with sub-page allocation, much like everywhere else

   - pKVM also lands a trace_printk() equivalent, which hopefully will
     make debugging a bit easier

   - First shot at annotating portions of the KVM/arm64 code to be
     extracted and built on s390. The real fun is yet to come

   - Allow pre-faulting of stage-2 canonical mappings from userspace,
     joining x86 and s390 in implementing this feature

   - Add a reverse mapping infrastructure for shadow stage-2,
     significantly improving performance when MMU notifiers kick in, and
     avoiding full unmap of all shadow tables for this VM

   - Next step of GICv5 enablement, adding support for the IRS block,
     and providing both SPI and LPI support. This is the first point
     where KVM/arm64 can support an SMP GICv5 guest

   - As a preliminary to eventually enabling CCA, add a bunch of
     infrastructure to KVM/arm64, splitting some of the basic operations
     into individual backends (normal VM, normal pKVM VM, protected pKVM
     VM). This allows CCA to later slot in without polluting the rest of
     KVM with its firmware-driven nonsense

   - Make ID registers immutable from the point where a vcpu is able to
     run, even if it fails to run. This prevents KVM from sampling
     untrusted values

   - Restore some type checking to the EL2 object. KVM/arm64 originally
     had some strong type checking between the kernel and the EL2
     object, but lost it along the way when the private hypercall
     interface was (somewhat pointlessly) converted to SMCCC. Type
     checking is back, syscall style, and with added sparse goodies

   - Expand the FFA support to FFA_NOTIFICATION_*, and add some
     sanitisation of the protocol that pKVM relays to the "trusted"
     runtime

   - Make GICv3 RD assignment more robust to userspace nonsense

   - Convert the remaining MMU fault handler backends to
     kvm_s2_fault_vma_info and co., fixing a number of bugs in the
     process

   - Fix the SError/SEA selftests to be both more robust and less
     braindead

   - Fix a smattering of documentation bugs, some of them as a result of
     our AI friends spitting out credible assertions based on
     non-existing symbols

   - The usual collection of low impact bug fixes (SMCCC, timers, PMU)

  Loongarch:

   - Add separate vmid support

   - Simplify MSI interrupt injection

   - Add crash hypercall support

   - Allow to set pv_feature until vCPU run

   - Enable HW page table walk automatically in selftests

  s390:

   - rework page allocation for secure guest variable storage

   - Selftests and documentation improvements

   - Replace get_zeroed_page with kzalloc

   - Fix corner cases of floating interrupt injection

   - Initial arm64 on s390 support

  x86:

   - Clean up the handling of vcpu->arch.xen.long_mode to be consistent
     and correctly handle 32-bit/64-bit alignment, and various other bug
     fixes have accumulated over the months since v1

   - Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring
     bug where callers fail to do so

   - Fix a variety of issues in the pre-fault code that are mostly
     benign in the current code base, but will show up in big ways
     if/when the pre-faulting logic is used to implementing
     prefetch-on-fault for the TDP MMU

   - For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock
     and just walk the rmaps' with mmu_lock taken. On the write side
     (which always uses mmu_lock), the bit-spinlock was assuming that
     preemption was disabled, but that is *not* true when rwlocks become
     sleepable

   - Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an
     error PFN, e.g. so that userspace can resolve transient issues
     instead of killing the guest. Convert a variety of WARN()+EFAULT
     paths into KVM_BUG_ON()+EIO so that KVM can hard commit to filling
     memory_fault on -EFAULTs that occur in the page fault path

   - Fix a NX hugepage un-accounting bug where KVM would always uncharge
     the shadow MMU, even when handling TDP MMU pages

   - Mask off the address space ID when checking for illegal usage of
     kvm_set_internal_memslot() to prevent false negatives on the sanity
     check

   - Explicitly zero reserved flags when delivering a SynIC message to
     avoid leaking a byte of stack information to the guest

   - Rework TDX's handling of the canonical MMU root level to not rely
     on userspace to fill CPUID correctly, as doing so lets userspace
     trivially trigger a KVM_BUG_ON()

   - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with
     EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to
     configure an 64-bit MMU without PAE

   - Ignore EFER.LMA (clear it from KVM's cached save state) if
     EFER.LME=0 when preparing L2 state, to fix another way to confuse
     KVM's MMU (and because real hardware also ignores EFER.LMA)

   - Improve KVM's sanity checks for a misconfigured MMU to (hopefully)
     detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE

   - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the
     param is only used to avoid what effectively amounts to a single
     memory write

   - Fix a mostly-benign bug where KVM can write through a guest's
     read-only mapping due to not checking the error code when
     expediting emulated MMIO page faults

   - Honor the guest's view of the "EFER.LMSLE must be zero" defeature
     so that userspace can provide migration compatibility between Rome
     and Milan+

   - Pend a KVM_REQ_EVENT request when an exception is morphed into a
     nested VM-Exit, otherwise KVM can fail to actually deliver the
     nested VM-Exit, e.g. when injecting a page fault

   - Add support for PML on SVM

   - Add support for virtualizing Bus Lock Detect on SVM, and fix a
     number of DR6 bugs and warts along the way

   - Fix a variety of warts in KVM's handling of guest TSC, kvmclock,
     and timekeeping in general, as a (big) first step towards
     addressing several longstanding problems with the kvmclock
     implementation. Most notably, fix a precision issue where
     get_kvmclock_ns() computed the clock from the *host* TSC without
     applying guest TSC scaling, causing systemic drift from the values
     the guest computes from its own TSC

   - Rip out KVM's shadow timekeeping structures, now that ktime
     snapshots are powerful enough to replace it

   - Misc fixes and cleanups

  x86 (AMD):

   - Fix a benign-in-practice bug where KVM unintentionally sets a
     non-zero error code when delivering exceptions to SEV-ES+ guests

   - Force a new ASID in both VMCBs on pCPU migration to fix a bug where
     KVM can run a VMCB with a stale ASID due to the tracking being
     per-CPU, not per-VMCB

   - Return INVALID_INPUT to the guest instead of exiting to userspace
     with -EIO if KVM can't access "guest request" buffer, i.e. try to
     keep the guest alive if the guest or userspace goofs

  x86 (Intel):

   - Enable Notify VM-Exits (now called Instruction Timeout in the SDM)
     and Bus Lock VM-Exits for TDX guests when they're enabled by
     userspace (KVM forgot to wire up the TDX Module knobs)

   - Move all common (between VMX and TDX) APIs/helpers to
     common.h/main.c, and change all namespace prefixes from "vmx" to
     "vt"

   - Fix a thankfully benign bug (due to other areas of KVM being
     hardened) where userspace can bypass INIT_MEM_REGION's address wrap
     check by providing a nr_pages that will overflow a u64 when
     converted to bytes, and fix an also- benign off-by-one bug in the
     check (inclusive vs. exclusive)

   - Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace
     sets KVM's mp_state to anything other than HALTED, e.g. so that a
     vCPU doesn't get stuck in HLT if userspace emulates RESET

  guest_memfd:

   - Take the invalidate lock when unbinding a dying file to fix a race
     with kvm_gmem_invalidate_end() that results in KVM leaving the MMU
     invalidation count elevated. Not taking the lock in the first place
     was pure misguided paranoid

   - When binding a memslot, purge the bindings if storing the new
     memslot fails, as Xarray's "store range" API can subtly fail
     partway through

   - Establish memslot<=>guest_memfd bindings *after* the memslot is
     ready, as the memslot becomes reachable the instant the binding is
     installed

   - Don't grab a page refcount when reloading an SNP VMSA and stop
     returning a "struct page" from guest_memfd's PFN lookup altogether,
     to ensure that KVM doesn't hold any unnecessary refcounts (the
     lifetime of the page is ensured by MMU notifiers and similar
     hooks). Preventing unnecessary refcounts greatly simplifies
     supporting in-place SHARED=>PRIVATE conversions

   - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a
     single guest_memfd instance to be used for both PRIVATE and SHARED
     variations of CoCo guests' memory (though not at the same time).
     This eliminates the need to double allocate guest memory for TDX
     and SNP, and is basically a hard requirement for pKVM, which relies
     on being able to preserve memory contents on conversions

   - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning
     -EBUSY if the filemap invalidate lock is contended. Punt on a
     proper fix for the moment, as a proper fix likely involves
     reworking truncate_error_folio()

   - Add a pile of selftests for in-place conversions

   - Misc guest_memfd cleanups

  Generic:

   - Move some configuration items to preprocessor symbols, to help with
     arm-on-s390's need to compile the same code twice with different
     values

   - Allow KVM implementations to choose alternative device names, also
     for s390's support of ARM virtualmachines

   - Switch the KVM-VFIO interface and external consumers over to
     standard file-based reference counting, eliminating all external
     KVM symbol exports

  Selftests:

   - Rework KVM selftest's handling of memory regions all so that PPC
     can force its page table allocations to be naturally aligned

   - PPC support

   - Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match
     real Hyper-V's behavior

   - Saturate L2's TSC frequency if stacking L1 and L2 scaling
     multipliers exceeds what hardware supports, as attempting to run L2
     with an illegal multiplier will either cause VM-Entry to fail (VMX)
     or trigger a #GP when writing MSR_AMD64_TSC_RATIO (SVM). The #GP is
     thankfully benign in the grand scheme as even "unsafe" WRMSRs have
     exception fixup

   - Rework KVM selftest's handling of memory regions so that PPC can
     force its page table allocations to be naturally aligned

   - Clean up selftest's VMX instruction helpers, and drop an absurd
     number of completely useless return values, e.g. functions that
     unconditionally return %true and then have every caller assert
     success

   - Add selftests support for Zhaoxin CPUs

   - Overhaul the TSC scaling test to add a regression test for the
     saturation behavior, and to increase its coverage in general

   - Fix selftests usage various NUMA syscalls to account for an
     undocumented, but known since 2007, off-by-one kernel bug. Add
     helpers to try and avoid re-introducing the same flaws in the
     future

   - Automatically run xAPIC IPI migration test (between NUMA nodes)
     when possible, as the entire point of the test is verify KVM's
     handling of page migration of the APIC backing page

   - Misc cleanups"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (506 commits)
  KVM: always make in-place conversion a compile-time constant when possible
  KVM: x86: leave the legacy private attribute in for TDX and SEV
  KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES
  selftests: kvm: remove useless comma operator
  arm64: Use proper include variant
  MAINTAINERS: Add entry for ARM on s390 KVM
  KVM: s390: arm64: Integrate arm on s390
  KVM: s390: arm64: Implement basic page fault handler
  KVM: s390: arm64: Implement vCPU IOCTLs
  KVM: s390: arm64: Implement vm/vcpu create destroy
  KVM: s390: arm64: Implement required functions
  KVM: s390: Add basic arm64 kvm module
  s390/hwcaps: Report SAE support as hwcap
  KVM: s390: arm64: Introduce host definitions
  s390: Introduce Start Arm Execution instruction
  KVM: s390: Use arm64 code
  s390/tools: Use arm64 headers
  KVM: s390: Use dedicated function for migration mode
  s390/Kconfig: remove PCI dependency from HAS_IOMEM
  KVM: s390: Kick PV cpus at the right time for service irqs
  ...

Pull perf events updates from Ingo Molnar:

 - Support SIMD/eGPRs/SSP register sampling in perf
   (Dapeng Mi, Kan Liang)

 - Turn amd_uncore_ctx events into a flexible array (Rosen Penev)

 - Finish the work related to fixing the guest PEBS path to not
   set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
   are upstream already (Sean Christopherson)

 - Drop redundant counter slot searches in the AMD uncore
   driver (Usama Arif)

 - Don't WARN when the ext_regs_buf allocation fails (vineash)

 - Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)

* tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits)
  perf/x86: Don't WARN when the ext_regs_buf allocation fails
  perf/x86/amd/uncore: Free counter slot by index
  perf/x86/amd/uncore: Remove redundant event slot scan
  perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage
  KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs
  KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable
  perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM
  perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data
  perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask
  perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr
  perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array
  perf/x86/intel: Add sanity check for PEBS record/fragment size
  perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs
  perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability
  perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling
  perf/x86: Support SSP sampling using sample_regs_* fields
  perf/x86: Support eGPRs sampling using sample_regs_* fields
  perf: Enhance perf_reg_validate() with simd_enabled argument
  perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields
  perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
  ...

Pull x86 FPU state updates from Borislav Petkov:

 - Document and cleanup the signal frame handling with the goal to allow
   process migration between CPUs with different FPU capabilities but
   which use only a common set of FPU features, i.e., think
   checkpoint/restore (Andrei Vagin)

 - Consolidate how XSTATE features are checked by doing them once during
   boot with the intent of removing cpu_has_xfeatures(). Latter will
   happen in the next cycle (Eric Biggers)

 - Other cleanups

* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/fpu: Remove additional remnants of math emulation
  x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
  selftests/x86: Add tests for signal frame FPU portability
  x86/fpu: Pre-fault only required size of xstate buffer
  x86/fpu: Fix potential underflow in xstate_calculate_size()
  x86/fpu: Document reasoning of FX-only fallback
  x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()
  x86/fpu: Clean up and rename variables in signal frame handling
  x86/fpu: Document signal frame layout and portability
  xor: Add AVX-512 optimized xor_gen()
  xor: Remove redundant X86_FEATURE_OSXSAVE check
  lib/crc: x86: Stop using cpu_has_xfeatures()
  lib/crypto: x86: Stop using cpu_has_xfeatures()
  crypto: x86 - Stop using cpu_has_xfeatures()
  um: Check for missing AVX and AVX-512 xstate bits
  x86/fpu: Check for missing AVX and AVX-512 xstate bits

Add struct hsmp_telemetry_table_rm to the UAPI header, describing the
Ryzen Master SMC telemetry table (table version 5, as reported by
HSMP_CLIENT_GET_METRICS_TABLE_VER) returned by
HSMP_CLIENT_GET_METRICS_TABLE on the Family 1Ah client models, now
that the previous commit wires that message up to a usable DRAM
mapping.

Point amd_hsmp.rst at struct hsmp_telemetry_table_rm instead of
duplicating the layout in prose. The Public PPR for the model in use
remains the reference for units and encodings.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261012085407.1202295-5-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

Wire the client metric table and metric table DRAM address messages
into the metric table read path for the Family 1Ah client platforms,
and fetch the DRAM base for them during ACPI probe, lifting the
defensive client exclusion placed on that call several commits ago.

Add metric_tbl_msg and metric_dram_msg to struct hsmp_plat_desc, and
have hsmp_metric_tbl_read_locked() and hsmp_get_tbl_dram_base() take
the message ID from there instead of a shared constant, since the
client set numbers these messages differently from the server set
(05h/06h vs 24h/25h). Have hsmp_get_tbl_dram_base() take response_sz
from hsmp_msg_response_sz() too, since the client set has no
descriptor table to take it from directly.

Add enum ryzen_master_proto_versions, and replace the single
!is_client_platform() exclusion guarding the hsmp_get_tbl_dram_base()
call in init_acpi() with a RYZEN_MASTER_PROTO_VER1 clause for client
platforms alongside the existing HSMP_PROTO_VER6 clause for server.
proto_ver holds the Ryzen Master interface version on client
platforms, a separate numbering space from enum hsmp_proto_versions;
gating the two platforms on their own version enum avoids relying on
numeric coincidence between the two, and lets a client interface
version bump be reasoned about independently of the server protocol
version.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261012085407.1202295-4-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

Add HSMP client support for the Family 1Ah client platforms, Models
80h-8Fh and E0h-E3h, recognized by the previous commit via
is_client_platform(). These parts speak the Ryzen Master SMC (RMSMC)
message set instead of the server HSMP messages, and probe via ACPI
_CRS/_DSD like a server socket.

Add the client message set to the UAPI header. Introduce struct
hsmp_plat_desc to select the test message and protocol-version
message at runtime, based on is_client_platform() rather than a
fixed set of family/model ranges.

The client set has no per-message descriptor table. validate_message()
and hsmp_ioctl_msg() therefore skip msg_id range validation and the
/dev/hsmp GET/SET fd-mode gate for client messages, leaving msg_id
validity to firmware's response status; validate_message() still
bounds client num_args and response_sz to HSMP_CLIENT_MAX_MSG_LEN.
Server platforms keep every check, and get_msg_desc() now also
enforces a lower msg_id bound there. get_msg_desc() sanitizes msg_id
with array_index_nospec() against its own num_msgs bound before
indexing the descriptor table, rather than depending on a caller-side
clamp. Add hsmp_msg_response_sz(), returning the descriptor table
entry on server and the client protocol max otherwise, used by
hsmp_cache_proto_ver() since firmware returns only args[0] for
client. validate_message() and hsmp_ioctl_msg() distinguish the two
sets via the already-resolved hsmp_plat_desc/hsmp_msg_desc pointers,
not a second is_client_platform() call.

The /dev/hsmp 0600 restriction and every sysfs/hwmon attribute hidden
on client platforms stay from the previous commit: hsmp_ioctl_msg()
still has no GET/SET gate for client messages, so an unprivileged
opener could otherwise issue destructive SET messages, and the
hidden attributes still resolve against unrelated client commands.
Lifting either restriction is deferred to the commits that make the
corresponding client functionality safe to expose.

Document the client models in amd_hsmp.rst.

Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20261012085407.1202295-3-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

KVM x86 misc changes for 7.4

 - Mask off the address space ID when checking for illegal usage of
   kvm_set_internal_memslot() to prevent false negatives on the sanity check.

 - Explicitly zero reserved flags when delivering a SynIC message to avoid
   leaking a byte of stack information to the guest.

 - Rework TDX's handling of the canonical MMU root level to not rely on
   userspace to fill CPUID correctly, as doing so lets userspace trivially
   trigger a KVM_BUG_ON().

 - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 &&
   EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU
   without PAE.

 - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when
   preparing L2 state, to fix another way to confuse KVM's MMU (and because
   real hardware also ignores EFER.LMA).

 - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect
   all of the ways KVM can botch EFER.LMA vs. CR4.PAE.

 - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param
   is only used to avoid what effectively amounts to a single memory write.

 - Fix a mostly-benign bug where KVM can write through a guest's read-only
   mapping due to not checking the error code when expediting emulated MMIO
   page faults.

 - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that
   userspace can provide migration compatibility between Rome and Milan+.

 - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested
   VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit,
   e.g. when injecting a page fault.

 - Add support for PML on SVM.

 - Add support for virtualizing Bus Lock Detect on SVM, and fix a number of
   DR6 bugs and warts along the way.

 - Misc fixes and cleanups.

LoongArch KVM changes for v7.4

1. Add separate vmid support.
2. Simplify MSI interrupt injection.
3. Add crash hypercall support.
4. Allow to set pv_feature until vCPU run.
5. Enable HW page table walk automatically in selftests.