Pull IOMMU updates from Joerg Roedel:
 "Core:
   - Detect scatterlist length overflows and finalize deferred domain
     attachments before mapping MSI pages
   - Consolidate x86 MSI reserved-region handling and clean up internal
     DMA and SVA helpers

  AMD IOMMU:
   - Add IOMMU PerfOpt support, enabled by amdgpu for supported
     integrated GPUs in identity domains
   - Restrict forced identity mapping to GPUs that require it
   - Fix kdump device-table allocation and reuse, ATS configuration
     error handling, and an interrupt-remapping allocation leak
   - Clean up device probing and initialization
   - Add Vasant Hegde as an AMD IOMMU maintainer

  ARM SMMUv2:
   - Device-tree binding updates for Qualcomm Maili and Nord SoCs

  ARM SMMUv3:
   - Work around hardware integration issue on Google Tensor G5 SoCs
     where all DMA transactions appear as instruction fetches
   - Allow command queue size to be configured on the kernel
     command-line
   - Reduce queue sizes when running as a kdump kernel
   - Fix some pre-existing issues in the driver and kunit tests reported
     by Sashiko
   - Fix handling of Arm hardware errata relating to the contiguous hint
     when using SVA
   - Rework the TLB invalidation logic in preparation for enabling
     iommu-pt in future
   - Minor cleanups in preparation for improving support for kdump

  Apple DART:
   - Support device-tree DMA aperture specifications

  Broadcom:
   - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia
     devices, including the generic page-table format and shared TLB
     cache management

  Hyper-V:
   - Add a para-virtualized guest IOMMU driver with guest-managed
     stage-1 page tables and page-selective IOTLB invalidation

  Intel VT-d:
   - Enhanced IQE fault handling for batched multiple descriptors,
   - Optimization of page-table level calculation in
     compute_vasz_lg2_ss(),
   - Fixes for several pre-existing issues reported by Sashiko,
   - General cleanup and refinement

  RISC-V:
   - Report cache-coherency capability for coherent devices, enabling
     VFIO/iommufd use

  Samsung Exynos:
   - Support SysMMUs without BLOCK mode, fixing their enable sequence
     and TLB invalidation
   - Improve v7 fault diagnostics with transaction information"

* tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits)
  MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer
  iommu/hyperv: Make hv_iommu_device static
  iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver
  iommu/amd: Don't allocate kdump device table from DMA32
  iommu/amd: Program device table when kdump reuse fails
  iommu/dma: Clean up redundant MSI cookie check
  iommu/dma: Catch scatterlist length overflows
  iommu/hyperv: Add page-selective IOTLB flush support
  iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest
  iommu/x86: Add architectural MSI reserved region helper
  Drivers: hv: Add logical device ID registry for vPCI devices
  hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU
  iommu: Make iommu-dma helpers private
  iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node
  iommu/arm-smmu-v3: Add Q_POS() macro
  iommu/arm-smmu-v3: Add arm_smmu_attach_release()
  iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown
  iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain
  iommu/arm-smmu-v3: Precompute the invalidation commands
  iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used
  ...

Pull dma-mapping updates from Marek Szyprowski:

 - several SWIOTLB initialization cleanups (Aneesh Kumar K.V, Francesco
   Valla)

 - exact page allocation for DMA pages (Qingfang Deng)

 - tools/dma build fixes (Sasha Levin)

 - minor fixes for various corner cases (Marek Szyprowski, Leon
   Romanovsky) and code cleanup (John Garry)

* tag 'dma-mapping-7.4-2026-10-21' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma-debug: Skip cacheline tracking for MMIO mappings
  tools/dma: fix building from the top level with O=
  tools/dma: fix building with O=
  dma: swiotlb: Track whether the pool size was explicitly set
  dma: swiotlb: Consolidate slab rounding
  dma: swiotlb: Rename swiotlb_size_or_default()
  dma: swiotlb: use KiB in restricted pool allocation log
  dma-direct: Restore arch_dma_alloc() for the DMA_ATTR_NO_KERNEL_MAPPING case
  MAINTAINERS: Add files to the DMA MAPPING HELPERS entry
  dma-mapping: use exact allocation for DMA pages
  dma-mapping: rename dma_opt_mapping_size()

Pull iommufd updates from Jason Gunthorpe:
 "Several bug fixes, probably found by AI based on the emails:

   - Several edge cases in the self test

   - Reject malformed invalidation commands in case the VMM let them
     through

   - Rework how the invalidation interface works to the drivers to be
     more robust and fix several Sashiko issues

   - Correct several error unwind paths

   - UAF during eventq file release

   - Reject more malformed usage of the dirty tracking by the VMM"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommupt: Do not allow PTEs to be split when dirty logging
  iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA
  iommufd: Reject a zero-length dirty bitmap request
  iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned
  iommufd: Fix event queue release use-after-free
  iommufd: Keep dmabuf PFNs MMIO when filling another domain
  iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails
  iommufd: Fix iommufd_hw_capabilities reference in kernel-doc
  iommu/vt-d: Convert nested cache invalidation to the core array loop
  iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop
  iommufd/selftest: Convert cache invalidation mocks to the core array loop
  iommufd: Iterate the cache invalidation array in the core
  iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
  iommufd/selftest: Skip when the mock device is not there
  iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

Pull ACPI support updates from Rafael Wysocki:
 "The most significant change here is the rework of the core ACPI device
  enumeration code to avoid initializing ACPI power management
  prematurely for devices with unmet dependencies. This essentially is a
  problem fix, but it requires taking PCI device enumeration ordering
  into account among other things, so it is far from straightforward.
  There was an attempt to do this in the 7.3 time frame that had to be
  reverted, so this time it is done much more carefully.

  There is also an ACPI thermal control update rearranging the code to
  register thermal class cooling devices under specific parents, which
  is visible in sysfs. This helps to figure out what is represented by
  those devices much more easily, but it also allows the binding of
  cooling devices to trip points in thermal zones to be adjusted so it
  need not rely on specific cooling device data usage in thermal
  drivers.

  From the number of commits perspective, the most visible part is the
  one replacing acpi_get_first_physical_node() with
  acpi_bus_get_primary_device() everywhere and dropping the former that
  was inherently racy and generally unsafe to use. Fortunately, the
  maintainers involved responded timely and all of that could be done
  within one development cycle.

  Another quite visible part is Dave Jiang's series fixing multiple
  issues reported by Sashiko in the ACPI APEI support code with a PCI
  AER improvement on top. It took several iterations of this to make
  Sashiko happy and the code in question should be much more robust
  going forward.

  One other thing worth mentioning separately is that the ACPI bus type
  is now going to be registered as a "companion" one and it will not be
  possible to register a driver binding directly to a struct
  acpi_device. All of the existing users of those drivers in the tree
  were converted to platform drivers in the previous cycles, so this is
  just a final step in a longer journey.

  Apart from the above, there are many fixes, mostly in drivers, with a
  noticeable exception of a fix in the code binding devices to their
  ACPI companions, new IOVT IOMMU support in ACPICA, new _Ixx object
  support for suspend-to-idle on x86, multiple new quirks, mostly
  related to unused ACPI power resources and backlight handling, and
  assorted cleanups.

  Specifics:

   - Make the core ACPI device enumeration code stop attempting to
     initialize ACPI power management for devices before they are known
     to be present and functional (Rafael Wysocki)

   - Simplify and clean up the core ACPI device enumeration code on top
     of the previous adjustment and reduce debug noise coming from it
     (Rafael Wysocki)

   - Fix locking in the code binding devices to their ACPI companions,
     prevent it from replacing a valid ACPI companion pointer with NULL
     incidentally, improve its messaging (including debug noise
     reduction), and reduce its overhead by making it skip the cases in
     which no ACPI companion may exist early (Rafael Wysocki)

   - Reduce runtime memory footprint of struct acpi_device by
     rearranging fields in it (Andy Shevchenko)

   - Update the driver core to allow bus types without drivers to be
     registered as "companion bus types" without driver-related sysfs
     attributes and register the ACPI bus type as a companion one
     (Rafael Wysocki)

   - Use strscpy() instead of strcpy() in the ACPI sysfs interface
     (Ruslan Vagner)

   - Remove __meminitdata from hmat_adist_nb declaration preserving it
     even when CONFIG_MEMORY_HOTPLUG is not set to prevent notifier
     chain corruption in some cases (Alejandro Lucero)

   - Prevent a NULL pointer dereference when attempting to read the
     table length after a mapping bookkeeping failure during an initrd
     override invocation with permanent table mappings enabled (Slavin
     Liu)

   - Use for_each_populated_zone() in get_node_num() in the MRRM table
     pareser (Sang-Heon Jeon)

   - Use vsnprintf() in acpi_os_vprintf() to prevent memory corruption
     resulting from overly long diagnostic messages that may not fit
     into a static buffer used by ACPICA and may be produced by a
     malformed ACPI table (Vlatko Kosturjak)

   - Ignore leading root scope prefix in string _UID match to allow AMD
     IOMMU matching to work as expected in some cases (Mario
     Limonciello)

   - Adjust message printing macros for ACPI objects to use dev_fmt()
     for more consistency with the analogous dev_*() macros (Rafael
     Wysocki)

   - Add _Ixx GPE wake indicator support to the x86 suspend-to-idle
     handling code (Saranya Gopal)

   - Clear driver_data before free in the ACPI PCI Link driver to
     prevent a dangling pointer from being used later (Jiale Yao)

   - Accumulate the queued flag across error sections of a CPER record
     in ghes_do_proc() to prevent it from being cleared by a later
     section or entry that does not queue memory-failure work (Breno
     Leitao)

   - Map a raw PCI AER Capability image field by field to prevent
     information loss from occurring while processing it (Dave Jiang)

   - Update a stale driver source reference in the ACPI APEI EINJ driver
     documentation (Prabhakar Pujeri)

   - Reject CPER records with an out-of-range error_data_length or an
     error status block length wrapping a u32 in the EFI CPER driver
     (Dave Jiang)

   - Address multiple assorted issues in the ACPI extlog driver (Dave
     Jiang)

   - Address two issues related to CXL in the ACPI APEI GHES driver
     (Dave Jiang)

   - Read only validated fields in cper_mem_err_pack() (Dave Jiang)

   - Validate memory error section length before payload access, prevent
     writes past array bounds from occurring and sanitize software
     metadata in the ACPI APEI GHES driver (Dave Jiang)

   - Make cxl_cper_handle_prot_err() static (Dave Jiang)

   - Add IOVT IOMMU support to ACPICA (Bibo Mao)

   - Fix PCC OperationRegion command offsets in ACPICA (Sudeep Holla)

   - Fix memory leak in acpi_ds_create_field() related to the handling
     of internal_pcc_buffer allocations (Breno Leitao)

   - Fix memory leak due to leftover devm_kcalloc() argument in the ACPI
     fan driver (Rafael Wysocki)

   - Fix backlight unregistration ordering in the ACPI video bus device
     driver (Rafael Wysocki)

   - Update the thermal core to allow the registration of thermal class
     cooling devices under specific parents and convert the ACPI fan,
     ACPI processor, and ACPI video bus device drivers to do so (Rafael
     Wysocki)

   - Adjust the ACPI thermal zone driver to use thermal class cooling
     device parent information for binding cooling devices to trip
     points in thermal zones (Rafael Wysocki)

   - Use cooling device data that is a better match for a given driver
     instead of a struct acpi_device pointer that had to be used for
     this purpose previously in the ACPI fan and processor drivers
     (Rafael Wysocki)

   - Fix acpi_thermal_guess_offset() in the ACPI thermal zone driver for
     thermal zone devices with a 273.0°K offset (Hans de Goede)

   - Define a free for ACPI objects allocated by ACPICA helpers and use
     it to simplify AML error handling in the ACPI fan driver (Rafael
     Wysocki)

   - Switch over the users of acpi_get_first_physical_node(), that was
     inherently racy and therefore not really safe to use, to use its
     replacement acpi_bus_get_primary_device(), and eliminate the former
     (Rafael Wysocki)

   - Add !CONFIG_ACPI stubs for acpi_find_child_device() and
     acpi_device_uid() (Mario Limonciello and Robin Murphy)

   - Fix bogus cycle count values on systems without _BIX in the ACPI
     battery driver (Armin Wolf)

   - Fix NULL pointer dereference on allocation failure and report
     relative state of charge as CAPACITY in the ACPI SBS driver (Itay
     Shem-tov and Guangshuo Li)

   - Add lid_init_state quirk for Razer Blade Stealth 13 (Early 2020)
     RZ09-0310 to the ACPI button driver (Ian Gallagher)

   - Add new quirks to force the native backlight on Dell OptiPlex AIO
     7410 35W and Acer Nitro AN515-58 in the ACPI video bus device
     driver (Chitransh Mandhaniya and Dirga Yuza)

   - Fix the shared memory signature handling in the ACPI PCC address
     space handler, free the PCC mailbox channel on operation region
     deactivation, and avoid unnecessary repeated computations of the
     PCC operation region command timeout (Sudeep Holla)

   - Fix a log message typo in the ACPI NUMA support code (Hemanth
     Selam)

   - Zero-initialize capability query result in the ACPI Platform
     Firmware Runtime Update and Telemetry driver to avoid disclosure of
     kernel stack data to user space (Karl Mehltretter)

   - Replace the remaining built-in/module check for CONFIG_ACPI_WMI in
     a header file with IS_ENABLED() macro (Lalit Shankar Chowdhury)

   - Retry probing battery docks after hotplug in the ACPI docking
     station driver to avoid missing ACPI add notifications (Vibhor
     Goel)

   - Detach device after resource transition failure in
     pnp_device_probe() to avoid blocking later manual PNP configuration
     attempts (Myeonghun Pak)"

* tag 'acpi-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (90 commits)
  ACPI: PM: Add Acer Aspire A515-53G to dmi_leave_unused_power_resources_on[]
  ACPI: video: force native backlight on Dell OptiPlex AIO 7410 35W
  ACPI: PM: sleep: Drop unused sleep_no_lps0 define
  ACPI: PM: Add unused power resource quirk for Casper Excalibur G900
  ACPI: dock: Retry probing battery docks after hotplug
  ACPI: PCI: pci_link: clear driver_data before free
  ACPI: APEI: accumulate the queued flag across error sections
  ACPICA: actbl2.h: Add bit constants of the Flags field in the IOVT IOMMU structure
  ACPI: bus: Drop acpi_get_first_physical_node()
  efi/dev-path-parser: Switch to use acpi_bus_get_primary_device()
  ALSA: hda: tas2781: Switch to use acpi_bus_get_primary_device()
  ALSA: hda: cs35l41: Switch to use acpi_bus_get_primary_device()
  iommu/arm-smmu-v3: Switch to use acpi_bus_get_primary_device()
  PCI/AER: Map a raw AER Capability image field by field
  ACPI: NUMA: fix typo in log message
  ACPI: Add stub for acpi_find_child_device()
  driver core/ACPI: Introduce companion_bus_register()
  ACPI: PCC: Cache OpRegion command timeout
  ACPI: PCC: Free channel on OpRegion deactivation
  ACPI: PCC: Preserve shared memory signature in OpRegion handler
  ...

Pull s390 updates from Heiko Carstens:

 - Add support for sclp-vt220 terminal resize events e.g. for QEMU

 - Warn if kernel command line contains non-printable EBCDIC characters

 - Improve show_code() disassembly output by using reliable markers for
   the instruction address and faulting instruction

 - Rework exception handling to require only a single exception table
   entry per faulting instruction: convert all inline assemblies from
   EX_TABLE to the new EX_TABLE_INSN macros. The previous exception
   handling was error prone since it usually required two EX_TABLE
   entries: one pointing at the instruction, and one pointing behind it

 - Disallow kprobes on instructions with exception table entries to
   avoid exception handlers decoding a breakpoint instead of the
   original instruction

 - Preemptible percpu ops changes:

    - Simplify percpu_entry() and percpu_exit() by encoding the percpu
      base, offset, and pointer registers into the lowcore marker,
      allowing percpu_exit() to update the percpu pointer on CPU
      migration without comparing the interrupted instruction

    - Convert this_cpu_cmpxchg(), this_cpu_xchg(), and
      this_cpu_cmpxchg128() to preemptible percpu ops; provide
      this_cpu_try_cmpxchg()

 - Emulate virtual timer in appldata via delayed work and remove the
   s390 specific vtimer infrastructure

 - Add lock contention tracepoints to rwlock slowpath

 - Fix incorrect return address in signal frame setup

 - Fix cpum_cf CPU hotplug handling

 - Convert various __get_free_pages() / get_zeroed_page() users to
   kmalloc() / kzalloc()

 - PCI:

    - Improve RPCIT instruction tracing

    - Fix double-free, use-after-free, and resource leaks in zPCI MSI
      and IRQ setup / cleanup paths

 - Crypto and zcrypt:

    - Improve reply message and length verification checks for CCA,
      EP11, and ICA messages to prevent out-of-bounds reads

    - Add missing array_index_nospec() for domain index uses in zcrypt
      to prevent speculative execution bypass

    - Fix out-of-bounds read in cca_query_crypto_facility()

 - Various other small fixes and improvements

* tag 's390-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (102 commits)
  s390/signal: Cleanup coding style
  s390/signal: Fix incorrect return address in signal frame
  s390/probes: Fix wrong mnemonic comment for clgib
  s390/probes: Add missing fixup for bctgr and bic
  s390/probes: Fix wrong opcode for cgrb fixup
  s390: Select ARCH_MEMORY_ORDER_TSO
  s390/mm: Cleanup pXXp_flush_lazy() routines
  s390/pci: Add function handle to RPCIT insn trace
  s390/pci: Use 32-bit fh outside of inline asm
  s390/pci: Adjust alignment in insn trace
  s390/sclp: Remove redundant memset after memblock_alloc_low()
  s390/entry: Save lowcore on invalid kernel stack
  s390/entry: Last breaking event vs invalid kernel stack
  s390/percpu: ImplemenHeiko Carstenst this_cpu_try_cmpxchg()
  s390/percpu: Drop unused output register from arch_this_cpu_to_op()
  s390/percpu: Drop unused output register from arch_this_cpu_add()
  s390/percpu: Use asm_inline for arch_this_cpu_add()
  s390/extable: Remove EX_TABLE macros and fallback extable search
  s390/bpf: Simplify exception table entry handling
  s390/sclp: Convert inline assembly to EX_TABLE_INSN
  ...

Merge changes related to ACPI support in device drivers for 7.4:

 - Switch over the users of acpi_get_first_physical_node(), that
   was inherently racy and therefore not really safe to use, to use
   its replacement acpi_bus_get_primary_device(), and eliminate the
   former (Rafael Wysocki)

 - Add !CONFIG_ACPI stubs for acpi_find_child_device() and
   acpi_device_uid() (Mario Limonciello and Robin Murphy)

* acpi-driver:
  ACPI: bus: Drop acpi_get_first_physical_node()
  efi/dev-path-parser: Switch to use acpi_bus_get_primary_device()
  ALSA: hda: tas2781: Switch to use acpi_bus_get_primary_device()
  ALSA: hda: cs35l41: Switch to use acpi_bus_get_primary_device()
  iommu/arm-smmu-v3: Switch to use acpi_bus_get_primary_device()
  ACPI: Add stub for acpi_find_child_device()
  ACPI: bus: Provide !ACPI stub for acpi_device_uid()
  ALSA: hda: aw88399: Switch to use acpi_bus_get_primary_device()
  ASoC: loongson: Switch to use acpi_bus_get_primary_device()
  ASoC: intel: boards: Switch to use acpi_bus_get_primary_device()
  ASoC: amd: acp3x-es83xx: Switch to use acpi_bus_get_primary_device()
  ASoC: amd: acp-es8336: Switch to use acpi_bus_get_primary_device()
  thunderbolt: Switch to use acpi_bus_get_primary_device()
  platform/x86: apple-gmux: Switch to use acpi_bus_get_primary_device()
  platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device()
  platform/x86: serdev_helpers: Switch to use acpi_bus_get_primary_device()
  platform/x86: yogabook: Switch to use acpi_bus_get_primary_device()
  ACPI: amba: Switch to use acpi_bus_get_primary_device()
  ACPI: bus: Use acpi/acpi_bus.h without CONFIG_ACPI

If a single PTE cannot be stored in the current bitmap that should be a
failure and reported back to userspace. Allowing a PTE to be split creates
a possibility that dirty memory will be reported as clean.

The gather must also cover the entire PTE that is being cleaned, not just
the part that fits within the bitmap.

Fix both issues by computing the full IOVA range of every PTE and using
that to update the bitmap and the gather. The bitmap code now rejects
ranges that don't fit in it, and the gather always combined ranges.

The selftest quietly relied on a bug where the CONT was split, that is why
the half page size for the mock domain saw alternating dirties. Increase
the dirty test page size to PAGE_SIZE so it still works as intended.

Cc: stable@vger.kernel.org
Fixes: 4a00f9434891 ("iommupt: Add read_and_clear_dirty op")
Reported-by: Samarth Narang <samarth.colleges@gmail.com>
Closes: https://lore.kernel.org/all/20261013165814.309255
Link: https://patch.msgid.link/r/0-v1-5bb926ff73ec+576-iommufd_dirty_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Generally userspace is going to step the dirty bitmap through the IOVA
space. However if the bitmap ends in the middle of a large PTE this is
problematic. The first step will clear the dirty bit and report dirty to
the end of its bitmap while the second step will see the clear'd dirty and
report clean for the start of the bitmap. If it happens this ends up
losing dirties.

Further this function is missing bounds checking so if this does happen
ther is a good chance it will write memory beyond what the userspace was
expecting.

Return an error code if this illegal condition happens.

Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Link: https://patch.msgid.link/20260925161142.189813-2-parri.andrea@gmail.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

Make hv_iommu_device static to give it internal linkage. This
pointer is only used within hv-iommu-guest.c, but previously
has external linkage without a prior declaration. This causes
sparse to warn that the symbol was not declared.

Fixes: 2690d4156b51 ("iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610092126.TuSXnTYR-lkp@intel.com/
Signed-off-by: Yu Zhang <zhangyu1@linux.microsoft.com>
Reviewed-by: Jacob Pan <jacob.pan@linux.microsoft.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>