Pull hyperv updates from Wei Liu:

 - Update to documents and code comments (Michael Kelley)

 - Harden Vmbus (Kameron Carr)

 - Rework MSHV driver page deposit logic (Mukesh Rathor)

 - Vmbus kexec bug fix (Shradha Gupta)

 - Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin)

* tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  Drivers: hv: Remove leftover support for old Hyper-V versions
  mshv: Remove unused *_old memory deposit functions
  mshv: Redesign hypervisor memory deposit logic
  mshv: Rename memory deposit memory functions to _old
  mshv_vtl: reject poll files with multiple waitqueues
  mshv_vtl: detach poll waiter on POLLFREE
  mshv_vtl: initialize poll file mutex before device registration
  Documentation: hyperv: Update information on guest CPU offlining
  Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2
  Drivers: hv: Run VMBus kexec cleanup from syscore shutdown
  kexec: Add helper to report an active kexec reboot
  tools: hv: remove unused rte_smp_mb()
  Documentation: hyperv: Update documentation for sending VMBus packets
  Drivers: hv: vmbus: Check ACPI companion before use
  Documentation: hyperv: Describe validation of the ring buffer indices
  Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index
  Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot
  Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices
  Drivers: hv: vmbus: Bounds check the shared ring buffer indices

When removing support for running Linux guests on Windows Server
2008/2008R2 and Windows 7, one area was missed due to the code
comment spelling "2012" incorrectly. Remove that functionality now.

Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

Pull IOMMU updates from Joerg Roedel:
 "Core:
   - Detect scatterlist length overflows and finalize deferred domain
     attachments before mapping MSI pages
   - Consolidate x86 MSI reserved-region handling and clean up internal
     DMA and SVA helpers

  AMD IOMMU:
   - Add IOMMU PerfOpt support, enabled by amdgpu for supported
     integrated GPUs in identity domains
   - Restrict forced identity mapping to GPUs that require it
   - Fix kdump device-table allocation and reuse, ATS configuration
     error handling, and an interrupt-remapping allocation leak
   - Clean up device probing and initialization
   - Add Vasant Hegde as an AMD IOMMU maintainer

  ARM SMMUv2:
   - Device-tree binding updates for Qualcomm Maili and Nord SoCs

  ARM SMMUv3:
   - Work around hardware integration issue on Google Tensor G5 SoCs
     where all DMA transactions appear as instruction fetches
   - Allow command queue size to be configured on the kernel
     command-line
   - Reduce queue sizes when running as a kdump kernel
   - Fix some pre-existing issues in the driver and kunit tests reported
     by Sashiko
   - Fix handling of Arm hardware errata relating to the contiguous hint
     when using SVA
   - Rework the TLB invalidation logic in preparation for enabling
     iommu-pt in future
   - Minor cleanups in preparation for improving support for kdump

  Apple DART:
   - Support device-tree DMA aperture specifications

  Broadcom:
   - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia
     devices, including the generic page-table format and shared TLB
     cache management

  Hyper-V:
   - Add a para-virtualized guest IOMMU driver with guest-managed
     stage-1 page tables and page-selective IOTLB invalidation

  Intel VT-d:
   - Enhanced IQE fault handling for batched multiple descriptors,
   - Optimization of page-table level calculation in
     compute_vasz_lg2_ss(),
   - Fixes for several pre-existing issues reported by Sashiko,
   - General cleanup and refinement

  RISC-V:
   - Report cache-coherency capability for coherent devices, enabling
     VFIO/iommufd use

  Samsung Exynos:
   - Support SysMMUs without BLOCK mode, fixing their enable sequence
     and TLB invalidation
   - Improve v7 fault diagnostics with transaction information"

* tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits)
  MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer
  iommu/hyperv: Make hv_iommu_device static
  iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver
  iommu/amd: Don't allocate kdump device table from DMA32
  iommu/amd: Program device table when kdump reuse fails
  iommu/dma: Clean up redundant MSI cookie check
  iommu/dma: Catch scatterlist length overflows
  iommu/hyperv: Add page-selective IOTLB flush support
  iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest
  iommu/x86: Add architectural MSI reserved region helper
  Drivers: hv: Add logical device ID registry for vPCI devices
  hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU
  iommu: Make iommu-dma helpers private
  iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node
  iommu/arm-smmu-v3: Add Q_POS() macro
  iommu/arm-smmu-v3: Add arm_smmu_attach_release()
  iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
  iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain
  iommu/arm-smmu-v3: Precompute the invalidation commands
  iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used
  ...

Remove the renamed *_old functions, done for ease of review.

Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

The current memory deposit implementation has a few issues and bugs:
 o It is very slow: one of the main contributions to slow VM creations
   and boot is many hypercalls repeatedly coming back with insufficient
   memory. On Hyper-V, a hypercall returns with such status whenever it
   cannot complete due to lack of memory in the hypervisor and needs more.
 o Contiguous range requirement is broken, and is critical bug
 o An incorrect assumption is made that contiguous memory size would
   always be power of 2.
 o Two pages are allocated, only one is really needed. Extra alloc adds
   to the overhead.
 o For a 512 page deposit, the allocation is split into two: one for 511
   and second for 1. Thus, an order 9 allocation never happens. A
   contiguous 2M range, if possible, greatly improves performance
   in the hypervisor as it can be mapped as large page whenever possible.
   Also, removing extra allocation reduces overhead in linux.
 o Since a page is already allocated to collect the frames, there is
   not really a need to use per cpu input page, and hence avoid local
   irq disable.
 o In hv_call_deposit_pages(), in case of error, under err_free_allocations
   label, all pages are freed without checking status to see if some pages
   were deposited. This is a critical bug as it would free pages that hyp
   may be using.

All of above is addressed by:
 o Allocate 2M by default, this is the recommendation from the hypervisor
   team, and greatly improves performance. Depositing one or few pages
   at a time results in lot of insufficient memory returns from hypercalls.
 o Always start with a full 2M range allocation, thus getting contiguous if
   available. In cases where possible, the deposits are much faster.
 o Allocate only one page in the deposit function and collect 511 pfns
   there. Just use a local variable for last pfn.
 o Use the page as input to hypercall. Since this page is locally allocated,
   irq disable can be avoided helping speed up the deposit.
 o Fix the physical contiguous memory enforcement..
 o Lastly, remove pre-deposits hv_call_create_vp() and
   hv_call_initialize_partition() as they were removed internally while
   ago, most likely because they didn't help much.

Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Reviewed-by: Souradeep Chakrabarti <schakrabarti@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

Rename hv_call_deposit_pages() and hv_deposit_memory_node() to _old
to make reviewing the new functions much easier.

Signed-off-by: Mukesh R <mrathor@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

MSHV_SET_POLL_FILE invokes a file descriptor poll callback with a poll
table backed by a single embedded wait entry. A poll callback may,
however, register the table with more than one waitqueue. pipe_poll()
does this naturally for an O_RDWR FIFO.

The second registration currently warns but then inserts the same list
node into another list. The new insertion overwrites the entry links while
the first waitqueue still points at it, corrupting the first waitqueue and
causing an invalid callback traversal when that queue wakes.

Reject a second distinct waitqueue, remove the first registration through
the common removal helper, and return -EINVAL from the ioctl. Repeated
registration of the same waitqueue is treated as a no-op. A rejected
replacement leaves the CPU slot unregistered, consistent with the existing
remove-before-register ordering. Single-waitqueue users such as the OpenHCL
io_uring poll file keep their existing behavior.

An LLM assisted the source audit, fix development, and validation of this
issue.

Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

MSHV_SET_POLL_FILE keeps a poll wait entry after the ioctl returns. A
file reference does not always pin the registered waitqueue:
signalfd_poll() uses current->sighand->signalfd_wqh, whose lifetime is
tied to the task.

signalfd_cleanup() sends POLLFREE before the sighand is freed. The MSHV
callback currently leaves its entry linked, so __wake_up_pollfree()
warns and a later replacement calls remove_wait_queue() through a stale
wqh pointer. A source-equivalent KASAN run reproduced:

  BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave
  _raw_spin_lock_irqsave
  remove_wait_queue
  harness_ioctl [mshv_pollfree_harness]

The object belonged to sighand_cache and had been released through
slab_free_after_rcu_debug() after __cleanup_sighand().

On POLLFREE, unlink the entry under the provider waitqueue lock. Preserve
the existing CPU cancellation before publishing a NULL wqh, since a NULL
load lets a racing replacement reuse the persistent poll state. Use a
matching acquire load under RCU when removing a normal registration.

The callback takes no mutex and does not sleep, so the existing
mutex-to-waitqueue-lock order is unchanged.

An LLM assisted the source audit, fix development, and validation of this
issue.

Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

mshv_vtl_init() registers /dev/mshv before initializing the poll file
mutex. A concurrent MSHV_SET_POLL_FILE ioctl can therefore attempt to lock
an uninitialized mutex while module initialization is still in progress.

Initialize the file-scope mutex statically so it is ready before the misc
device becomes visible.

Fixes: 7bfe3b8ea6e3 ("Drivers: hv: Introduce mshv_vtl driver")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>

ARM64 Hyper-V guests do not run the VMBus kexec cleanup before
secondary CPUs are stopped. Consequently, the old VMBus connection
and SynIC state remain active when the kexec kernel starts.

Run the VMBus kexec handler from the existing VMBus syscore shutdown
callback. syscore_shutdown() runs after device shutdown and before
machine shutdown, while all CPUs needed by the SynIC CPU hotplug
teardown are still available. Guard the callback with
kexec_is_in_progress() so normal restart, halt, and poweroff paths are
unchanged.

Use the same path on x86 and remove the architecture-specific handler
pointer and the weak setup/remove interfaces. VMBus teardown now
precedes hv_stimer_global_cleanup() on x86.

The new x86 ordering relies on commit be0cfab740e5 ("clocksource:
hyper-v: Remove support for stimer interrupts in message mode"), which
removed the synthetic timer's dependency on VMBus message delivery.
Older kernels that retain message-mode stimer interrupts must preserve
the existing x86 ordering and therefore require an ARM64-specific
backport.

Document the VMBus cleanup path and its position in shutdown ordering.

Fixes: 9bbb888824e3 ("arm64: hyperv: Initialize hypervisor on boot")
Link: https://lore.kernel.org/all/20260814093133.3191250-1-shradhagupta@linux.microsoft.com/
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Suggested-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Shradha Gupta <shradhagupta@linux.microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Reviewed-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Wei Liu <wei.liu@kernel.org>