Pull Char/Misc/IIO/others driver updates from Greg KH:
 "Here is the big set of char/misc/android/iio and other small driver
  subsystem patches for 7.4-rc1. Loads of stuff in here, larger than
  normal. Highlights include:

   - removal of the C binder code, the rust version is stable and will
     be used going forward in a few billion devices. Great job by those
     developers

   - loads and loads of IIO driver updates and feature additions

   - speakup driver fixes and updates

   - mhi driver updates

   - mei driver updates

   - xillybus driver fixes

   - comedi driver fixes

   - lots of coresight driver updates

   - Interconnect driver updates

   - nvmem driver updates and fixes

   - slimbus driver updates and fixes

   - spmi driver updates and fixes

   - lots of tiny misc and char driver fixes based on people scanning
     for things

  All of these have been in linux-next for a while with no reported
  issues, other than a merge conflict with one of the rust tree files,
  which should be simple to resolve"

* tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)
  rust_binder: wake epoll on self-work queued to poll thread
  rust_binder: avoid overflow in get_node_debug_info()
  MAINTAINERS: Add Abel as SPMI co-maintainer
  spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
  iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
  iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
  misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
  phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
  power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
  nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
  spmi: Add helper to get a parent SPMI device
  spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
  spmi: Remove unneeded goto in spmi_device_add() error path
  spmi: Print error status with %pe format
  spmi: Remove redundant dev_name() print in spmi_device_add()
  spmi: Fix potential use-after-free by grabbing of_node reference
  spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
  MAINTAINERS: Add Qualcomm SPMI controller entry
  spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
  comedi: addi_apci_3xxx: fix subdevice count underallocation
  ...

Pull driver core updates from Danilo Krummrich:
 "Core:

   - Add TAINT_FORCED_BIND to taint the kernel and driver module before
     manual sysfs bind/unbind operations; make add_taint_module()
     available to driver core and update taint decoding tools and
     documentation

   - Constify device_show/store_*() attribute parameters and adapt x86
     MCE and perf users to prepare for const dev_ext_attribute instances

   - Fix UAF in NUMA access node registration failure handling by
     dropping the device reference with put_device() instead of directly
     freeing the node

  debugfs:

   - Make debugfs_create_str() read-only to eliminate double-free races
     between concurrent writers; reject writable modes; convert
     interconnect and SoundWire users to local file operations with
     mutex-protected strings

  kobject:

   - Fix out-of-bounds access in kobject_action_type() when parsing
     action strings containing embedded NUL bytes

   - Fix the kobject_set_name() reference in kset_register() kernel-doc

  Rust:

   - DMA:

      - Tie Coherent, CoherentBox and CoherentHandle to the device's
        bound lifetime to prevent retaining DMA allocations beyond
        driver unbind; propagate the lifetime through nova-core and the
        DMA sample driver

   - I/O:

      - Require explicit base types for registers and replace relative
        registers with typed subregion projections; reimplement
        register!() as a proc macro, support registers using existing
        types without inline bitfields, and convert nova-core, Tyr and
        the PCI sample; add AsRepr/AsReprMut and transmute helpers with
        deferred size checks for representation conversions

      - Wrap ResourceSize in a transparent newtype with explicit
        conversions, including checked conversion to usize

   - PCI:

      - Add typed PCIe extended capability lookup and SR-IOV accessors
        for the First VF Offset and decoded VF BAR addresses and widths,
        keeping raw SR-IOV registers private to preserve PCI core
        ownership of their state

   - scatterlist:

      - Honor the device's maximum segment size as well as the DMA
        mapping limit when constructing SG tables

      - Return u32 from SGEntry::dma_len() to match the C segment length
        type

   - misc:

      - Validate auxiliary DeviceId name length explicitly to improve
        compile-time diagnostics for oversized device ID table entries

      - Drop unnecessary 'static bounds from debugfs ScopedDir file
        creation methods to support data containing non-'static
        references, including DMA buffers

  Misc:

   - Add Johan Hovold as driver core maintainer

   - Simplify platform_device_alloc() by returning early on allocation
     failure

   - Fix typos in driver core and kernfs comments"

* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
  rust: pci: add extended capability and SR-IOV support
  kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
  rust: io: convert ResourceSize into a transparent newtype
  rust: scatterlist: return u32 from SGEntry::dma_len()
  MAINTAINERS: add myself as driver core maintainer
  debugfs: make debugfs_create_str() read-only
  soundwire: debugfs: replace writable string helper
  interconnect: debugfs: replace writable string helper
  docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
  driver core: platform: Simplify platform_device_alloc()
  kobject: fix out-of-bounds access in kobject_action_type()
  rust: scatterlist: honor the device's maximum segment size
  driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
  module: fix up documentation for add_taint() and add_taint_module()
  module: pull out add_taint_module() to be public
  driver core: Constify the signature of device_show/store_*()
  drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  rust: auxiliary: validate DeviceId name length
  driver core: fix typos in comments
  ...

Georgi writes:

interconnect changes for 7.4

This pull request contains the following interconnect updates for
the 7.4-rc1 merge window:

- New driver for Kuno SoC
- Make important drivers default
- Add multi-port QoS programming support
- Add support for Milos OSM L3
- Misc cleanups and fixes

Signed-off-by: Georgi Djakov <djakov@kernel.org>

* tag 'icc-7.4-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (21 commits)
  interconnect: mediatek: fix Makefile typo for mt8196
  interconnect: qcom: fix endian annotations of BCM aux data
  interconnect: qcom: Skip get_bw on QoS programming providers
  interconnect: qcom: use 64-bit SMD RPM bus votes
  interconnect: qcom: msm8976: Configure auxiliary GPU QoS port
  interconnect: qcom: msm8996: Configure auxiliary Venus QoS port
  interconnect: qcom: icc-rpm: Program SMD RPM auxiliary QoS ports
  interconnect: qcom: icc-rpm: Handle icc_link_create() failures
  interconnect: qcom: implement get_bw with rpmh_read
  interconnect: exynos: Remove the PM QoS request on unbind
  interconnect: Add kernel-doc for devm_of_icc_get(), icc_enable() and icc_disable()
  interconnect: qcom: icc-rpm: Don't skip small votes
  interconnect: qcom: Move bcm_div() to common code
  interconnect: fix typo "commited" in comments
  interconnect: qcom: Constify struct qcom_icc_qosbox
  interconnect: qcom: Add Kuno interconnect provider driver
  dt-bindings: interconnect: Add Qualcomm Kuno NoC
  dt-bindings: interconnect: OSM L3: Document Milos OSM L3 compatible
  interconnect: qcom: Add missing depends to Hawi, Maili, Nord and Shikra
  interconnect: qcom: Make important drivers default
  ...

* icc-misc
  interconnect: qcom: Constify struct qcom_icc_qosbox
  interconnect: fix typo "commited" in comments
  interconnect: Add kernel-doc for devm_of_icc_get(), icc_enable() and icc_disable()
  interconnect: exynos: Remove the PM QoS request on unbind
  interconnect: qcom: implement get_bw with rpmh_read
  interconnect: qcom: Skip get_bw on QoS programming providers
  interconnect: qcom: fix endian annotations of BCM aux data
  interconnect: mediatek: fix Makefile typo for mt8196

Signed-off-by: Georgi Djakov <djakov@kernel.org>

Correct a copy-paste typo in the MediaTek interconnect Makefile that
mapped mt8196.o to CONFIG_INTERCONNECT_MTK_MT8195 instead of MT8196.

Assisted-by: OpenCode AI
Signed-off-by: Breno Rodrigues Alves <breno3011alves@gmail.com>
Link: https://patch.msgid.link/20260905140113.21638-1-breno3011alves@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

struct qcom_icc_bcm::aux_data keeps a copy of the struct bcm_db read
from the command db, whose unit and width fields are annotated as
__le32/__le16 to describe the little-endian on-disk format. Using
those restricted types directly in bandwidth calculations makes sparse
complain about endianness.

Keep aux_data typed as struct bcm_db, copied verbatim from the command
db buffer, and convert the fields with le32_to_cpu()/le16_to_cpu() at
the places where unit and width are used. No functional change.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202609221350.3Y8MOce9-lkp@intel.com/
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260923185059.25196-1-rosenp@gmail.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

debugfs_create_str() is being made read-only because its generic write
path is hard to make safe without adding more locking to the helper.

Convert the interconnect debugfs client src_node and dst_node entries to
local file operations before removing writable string support from
debugfs_create_str().  Protect the string replacement and path lookup with
the existing debugfs_lock.

The old code duplicated the strings under rcu_read_lock(), so it had to use
GFP_ATOMIC.  The local file operations protect src_node and dst_node with
debugfs_lock instead, so the allocation can use GFP_KERNEL.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20260807100053.1089834-2-chenyichong@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Programming the static QoS configuration in qcom_icc_rpmh_probe()
touches NoC registers directly, and nothing in that path clocks or
powers the NoC first.  It has been working only because the
interconnect core used to vote every node to INT_MAX while adding it,
and that vote stays in hardware until sync_state.

Reading the boot-time AMC votes back from RPMh removed that implicit
guarantee: a NoC whose BCMs come out of the bootloader unvoted is now
left unclocked, and the first QoS register access aborts.  On Qualcomm
Nord SoC, the MMSS NoC dies while programming qnm_camnoc_hf, taking the
board down before rootfs:

  Internal error: synchronous external abort: 0000000096001610
    regmap_mmio_read32le+0xc/0xa4
    regmap_update_bits_base+0x64/0x98
    qcom_icc_rpmh_probe+0x44c/0x540

Only install the get_bw() callback for providers that do not program
QoS, i.e. those without a regmap config.  Providers that do program
QoS keep the previous INT_MAX initial votes, so their register
accesses stay safe, and the rest keep the benefit of honouring the
boot-time votes.

Reported-by: Bartosz Golaszewski <brgl@kernel.org>
Fixes: 11a44c6087c6 ("interconnect: qcom: implement get_bw with rpmh_read")
Assisted-by: LLM
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260922020623.398913-1-shengchao.guo@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

This series brings multi-port QoS programming and squashes some
minor existing issues.

* icc-rpm
  interconnect: qcom: Move bcm_div() to common code
  interconnect: qcom: icc-rpm: Don't skip small votes
  interconnect: qcom: icc-rpm: Handle icc_link_create() failures
  interconnect: qcom: icc-rpm: Program SMD RPM auxiliary QoS ports
  interconnect: qcom: msm8996: Configure auxiliary Venus QoS port
  interconnect: qcom: msm8976: Configure auxiliary GPU QoS port
  interconnect: qcom: use 64-bit SMD RPM bus votes

Link: https://patch.msgid.link/20260909-topic-icc_rpm_smd_qol-v1-0-6dc5b5e97626@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>

SMD RPM bus bandwidth requests carry a 64-bit bandwidth value.
The interconnect proxy declared the KVP payload as u32, truncating
votes above 4 GiB/s and advertising the wrong payload size to RPM.

Use a little-endian 64-bit payload and accept a u64 value in the proxy
API. This has always been the right behavior, even on msm-3.10 and
32-bit SoCs.

Fixes: be06f8e7425d ("interconnect: qcom: Add interconnect RPM over SMD driver")
Assisted-by: LLM
Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Reviewed-by: Gopikrishna Garmidi <gopikrishna.garmidi@oss.qualcomm.com>
Link: https://patch.msgid.link/20260904-topic-icc_rpm_64b_req-v1-1-37e24f1991a3@oss.qualcomm.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>