--- /dev/null
+From 5f55affde77dfe701e3a9648a3aab6a4c5ba0e6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 13:02:39 +0200
+Subject: ASoC: codecs: tas2780: Fix log of failed reset via I2C.
+
+From: Roy Chateau <roy.chateau@mep-info.com>
+
+[ Upstream commit 4e9a429ae80657bdc502d3f5078e2073656ec5fd ]
+
+Correctly log failures of reset via I2C.
+
+Signed-off-by: Roy Chateau <roy.chateau@mep-info.com>
+Link: https://lore.kernel.org/r/20231013110239.473123-1-roy.chateau@mep-info.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c
+index afdf0c863aa10..a2d27410bbefa 100644
+--- a/sound/soc/codecs/tas2780.c
++++ b/sound/soc/codecs/tas2780.c
+@@ -39,7 +39,7 @@ static void tas2780_reset(struct tas2780_priv *tas2780)
+ usleep_range(2000, 2050);
+ }
+
+- snd_soc_component_write(tas2780->component, TAS2780_SW_RST,
++ ret = snd_soc_component_write(tas2780->component, TAS2780_SW_RST,
+ TAS2780_RST);
+ if (ret)
+ dev_err(tas2780->dev, "%s:errCode:0x%x Reset error!\n",
+--
+2.42.0
+
--- /dev/null
+From 2cc16c97685e6055236622b236bf1cd51f8cef7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 17:45:25 +0800
+Subject: ASoC: rt5650: fix the wrong result of key button
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ]
+
+The RT5650 should enable a power setting for button detection to avoid the wrong result.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 620ecbfa4a7a8..f86fc7cd104d4 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3251,6 +3251,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component,
+ RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ);
+ regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1,
+ RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL);
++ regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1,
++ RT5645_HP_CB_MASK, RT5645_HP_CB_PU);
+ }
+ rt5645_irq(0, rt5645);
+
+--
+2.42.0
+
--- /dev/null
+From 62d3a4e113dae91d2fdfda8b33cbe7703dc86423 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 05:34:18 +0000
+Subject: ASoC: simple-card: fixup asoc_simple_probe() error handling
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 41bae58df411f9accf01ea660730649b2fab1dab ]
+
+asoc_simple_probe() is used for both "DT probe" (A) and "platform probe"
+(B). It uses "goto err" when error case, but it is not needed for
+"platform probe" case (B). Thus it is using "return" directly there.
+
+ static int asoc_simple_probe(...)
+ {
+ ^ if (...) {
+ | ...
+(A) if (ret < 0)
+ | goto err;
+ v } else {
+ ^ ...
+ | if (ret < 0)
+(B) return -Exxx;
+ v }
+
+ ...
+ ^ if (ret < 0)
+(C) goto err;
+ v ...
+
+ err:
+(D) simple_util_clean_reference(card);
+
+ return ret;
+ }
+
+Both case are using (C) part, and it calls (D) when err case.
+But (D) will do nothing for (B) case.
+Because of these behavior, current code itself is not wrong,
+but is confusable, and more, static analyzing tool will warning on
+(B) part (should use goto err).
+
+To avoid static analyzing tool warning, this patch uses "goto err"
+on (B) part.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index fbb682747f598..a8bc4e45816df 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -678,10 +678,12 @@ static int asoc_simple_probe(struct platform_device *pdev)
+ struct snd_soc_dai_link *dai_link = priv->dai_link;
+ struct simple_dai_props *dai_props = priv->dai_props;
+
++ ret = -EINVAL;
++
+ cinfo = dev->platform_data;
+ if (!cinfo) {
+ dev_err(dev, "no info for asoc-simple-card\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ if (!cinfo->name ||
+@@ -690,7 +692,7 @@ static int asoc_simple_probe(struct platform_device *pdev)
+ !cinfo->platform ||
+ !cinfo->cpu_dai.name) {
+ dev_err(dev, "insufficient asoc_simple_card_info settings\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ cpus = dai_link->cpus;
+--
+2.42.0
+
--- /dev/null
+From 9f5c263b2ead90e60140f1011e7302b691cc4eee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 15:01:17 +0200
+Subject: ASoC: tlv320adc3xxx: BUG: Correct micbias setting
+
+From: Antoine Gennart <gennartan@disroot.org>
+
+[ Upstream commit e930bea4124b8a4a47ba4092d99da30099b9242d ]
+
+The micbias setting for tlv320adc can also have the value '3' which
+means that the micbias ouput pin is connected to the input pin AVDD.
+
+Signed-off-by: Antoine Gennart <gennartan@disroot.org>
+Link: https://lore.kernel.org/r/20230929130117.77661-1-gennartan@disroot.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320adc3xxx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c
+index 52bb557247244..6bd6da01aafac 100644
+--- a/sound/soc/codecs/tlv320adc3xxx.c
++++ b/sound/soc/codecs/tlv320adc3xxx.c
+@@ -293,7 +293,7 @@
+ #define ADC3XXX_BYPASS_RPGA 0x80
+
+ /* MICBIAS control bits */
+-#define ADC3XXX_MICBIAS_MASK 0x2
++#define ADC3XXX_MICBIAS_MASK 0x3
+ #define ADC3XXX_MICBIAS1_SHIFT 5
+ #define ADC3XXX_MICBIAS2_SHIFT 3
+
+@@ -1099,7 +1099,7 @@ static int adc3xxx_parse_dt_micbias(struct adc3xxx *adc3xxx,
+ unsigned int val;
+
+ if (!of_property_read_u32(np, propname, &val)) {
+- if (val >= ADC3XXX_MICBIAS_AVDD) {
++ if (val > ADC3XXX_MICBIAS_AVDD) {
+ dev_err(dev, "Invalid property value for '%s'\n", propname);
+ return -EINVAL;
+ }
+--
+2.42.0
+
--- /dev/null
+From bc27300161bb5295ddd43e48ce3d23bb4d620337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 21:55:29 -0400
+Subject: ceph_wait_on_conflict_unlink(): grab reference before dropping
+ ->d_lock
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit dc32464a5fe4946fe1a4d8f8e29961dc411933c5 ]
+
+Use of dget() after we'd dropped ->d_lock is too late - dentry might
+be gone by that point.
+
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index f6a7fd47efd7a..82874be945248 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -709,8 +709,8 @@ int ceph_wait_on_conflict_unlink(struct dentry *dentry)
+ if (!d_same_name(udentry, pdentry, &dname))
+ goto next;
+
++ found = dget_dlock(udentry);
+ spin_unlock(&udentry->d_lock);
+- found = dget(udentry);
+ break;
+ next:
+ spin_unlock(&udentry->d_lock);
+--
+2.42.0
+
--- /dev/null
+From 472d405e4b67f40c1a9a5fbc3e26a37395994787 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 17:19:51 +0100
+Subject: coresight: tmc-etr: Disable warnings for allocation failures
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit e5028011885a85032aa3c1b7e3e493bcdacb4a0a ]
+
+Running the following command on Juno triggers the warning:
+
+ $ perf record -e cs_etm// -m ,128M ...
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 412 at mm/page_alloc.c:4453 __alloc_pages+0x334/0x1420
+ CPU: 1 PID: 412 Comm: perf Not tainted 6.5.0-rc3+ #181
+ Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019
+ pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : __alloc_pages+0x334/0x1420
+ lr : dma_common_alloc_pages+0x108/0x138
+ sp : ffffffc087fb7440
+ x29: ffffffc087fb7440 x28: 0000000000000000 x27: ffffffc07e48fba0
+ x26: 0000000000000001 x25: 000000000000000f x24: ffffffc081f24880
+ x23: 0000000000000cc0 x22: ffffff88012b6f08 x21: 0000000008000000
+ x20: ffffff8801433000 x19: 0000000000000000 x18: 0000000000000000
+ x17: ffffffc080316e5c x16: ffffffc07e46406c x15: ffffffc0803af580
+ x14: ffffffc08036b460 x13: ffffffc080025cbc x12: ffffffb8108c3fc4
+ x11: 1ffffff8108c3fc3 x10: 1ffffff810ff6eac x9 : 00000000f204f204
+ x8 : 000000000000f204 x7 : 00000000f2f2f2f2 x6 : 00000000f3f3f3f3
+ x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000cc0 x1 : 0000000000000000 x0 : ffffffc085333000
+ Call trace:
+ __alloc_pages+0x334/0x1420
+ dma_common_alloc_pages+0x108/0x138
+ __dma_alloc_pages+0xf4/0x108
+ dma_alloc_pages+0x18/0x30
+ tmc_etr_alloc_flat_buf+0xa0/0x190 [coresight_tmc]
+ tmc_alloc_etr_buf.constprop.0+0x124/0x298 [coresight_tmc]
+ alloc_etr_buf.constprop.0.isra.0+0x88/0xc8 [coresight_tmc]
+ tmc_alloc_etr_buffer+0x164/0x2f0 [coresight_tmc]
+ etm_setup_aux+0x32c/0x520 [coresight]
+ rb_alloc_aux+0x29c/0x3f8
+ perf_mmap+0x59c/0xce0
+ mmap_region+0x340/0x10e0
+ do_mmap+0x48c/0x580
+ vm_mmap_pgoff+0x160/0x248
+ ksys_mmap_pgoff+0x1e8/0x278
+ __arm64_sys_mmap+0x8c/0xb8
+
+With the flat mode, we only attempt to allocate large memory if there is an IOMMU
+connected to the ETR. If the allocation fails, we always have a fallback path
+and return an error if nothing else worked. So, suppress the warning for flat
+mode allocations.
+
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Anshuman Khandual <anshuman.khandual@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: James Clark <james.clark@arm.com>
+Link: https://lore.kernel.org/r/20230817161951.658534-1-suzuki.poulose@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 1be0e5e0e80b2..c88a6afb29512 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -610,7 +610,8 @@ static int tmc_etr_alloc_flat_buf(struct tmc_drvdata *drvdata,
+
+ flat_buf->vaddr = dma_alloc_noncoherent(real_dev, etr_buf->size,
+ &flat_buf->daddr,
+- DMA_FROM_DEVICE, GFP_KERNEL);
++ DMA_FROM_DEVICE,
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!flat_buf->vaddr) {
+ kfree(flat_buf);
+ return -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From 11f815c8a4bf5a8b0a9e3b817503c9637e3ad235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 22:28:35 +0800
+Subject: dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+We fix it by calling pm_runtime_disable when error returns.
+
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ste_dma40.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index 3b09fdc507e04..594b016e76efc 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -3697,6 +3697,7 @@ static int __init d40_probe(struct platform_device *pdev)
+ regulator_disable(base->lcpa_regulator);
+ regulator_put(base->lcpa_regulator);
+ }
++ pm_runtime_disable(base->dev);
+
+ kfree(base->lcla_pool.alloc_map);
+ kfree(base->lookup_log_chans);
+--
+2.42.0
+
--- /dev/null
+From b12c1dc583df742183c645e062fb5aeb52b46dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:28:52 -0400
+Subject: drm/amdgpu: Reserve fences for VM update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ]
+
+In amdgpu_dma_buf_move_notify reserve fences for the page table updates
+in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON
+in dma_resv_add_fence when using SDMA for page table updates.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+index 7bd8e33b14be5..e8b3e9520cf6e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+@@ -400,7 +400,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach)
+ continue;
+ }
+
+- r = amdgpu_vm_clear_freed(adev, vm, NULL);
++ /* Reserve fences for two SDMA page table updates */
++ r = dma_resv_reserve_fences(resv, 2);
++ if (!r)
++ r = amdgpu_vm_clear_freed(adev, vm, NULL);
+ if (!r)
+ r = amdgpu_vm_handle_moved(adev, vm);
+
+--
+2.42.0
+
--- /dev/null
+From ec4507ea16de29009b303d39f6808f90f428f1f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 22:24:39 -0400
+Subject: drm/amdgpu: Unset context priority is now invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ]
+
+A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of
+carrying it around and passing it to the Direct Rendering Manager--and it
+becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context
+creation.
+
+Cc: Alex Deucher <Alexander.Deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alex Deucher <Alexander.Deucher@amd.com>
+Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tuikov@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index d2139ac121595..fdbeafda4e80a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] = {
+ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
+ {
+ switch (ctx_prio) {
+- case AMDGPU_CTX_PRIORITY_UNSET:
+ case AMDGPU_CTX_PRIORITY_VERY_LOW:
+ case AMDGPU_CTX_PRIORITY_LOW:
+ case AMDGPU_CTX_PRIORITY_NORMAL:
+@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
+ case AMDGPU_CTX_PRIORITY_VERY_HIGH:
+ return true;
+ default:
++ case AMDGPU_CTX_PRIORITY_UNSET:
+ return false;
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From 38e9863d6a269212b72a14c87c3597f7436676bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 14:15:25 +0200
+Subject: drm/ttm: Reorder sys manager cleanup step
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Karolina Stolarek <karolina.stolarek@intel.com>
+
+[ Upstream commit 3b401e30c249849d803de6c332dad2a595a58658 ]
+
+With the current cleanup flow, we could trigger a NULL pointer
+dereference if there is a delayed destruction of a BO with a
+system resource that gets executed on drain_workqueue() call,
+as we attempt to free a resource using an already released
+resource manager.
+
+Remove the device from the device list and drain its workqueue
+before releasing the system domain manager in ttm_device_fini().
+
+Signed-off-by: Karolina Stolarek <karolina.stolarek@intel.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_device.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
+index b84f74807ca13..ec9ddaad56a05 100644
+--- a/drivers/gpu/drm/ttm/ttm_device.c
++++ b/drivers/gpu/drm/ttm/ttm_device.c
+@@ -239,10 +239,6 @@ void ttm_device_fini(struct ttm_device *bdev)
+ struct ttm_resource_manager *man;
+ unsigned i;
+
+- man = ttm_manager_type(bdev, TTM_PL_SYSTEM);
+- ttm_resource_manager_set_used(man, false);
+- ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL);
+-
+ mutex_lock(&ttm_global_mutex);
+ list_del(&bdev->device_list);
+ mutex_unlock(&ttm_global_mutex);
+@@ -252,6 +248,10 @@ void ttm_device_fini(struct ttm_device *bdev)
+ if (ttm_bo_delayed_delete(bdev, true))
+ pr_debug("Delayed destroy list was clean\n");
+
++ man = ttm_manager_type(bdev, TTM_PL_SYSTEM);
++ ttm_resource_manager_set_used(man, false);
++ ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL);
++
+ spin_lock(&bdev->lru_lock);
+ for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i)
+ if (list_empty(&man->lru[0]))
+--
+2.42.0
+
--- /dev/null
+From 10251b36ada9bab401bead67e0cd1b72403fa327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 22:26:33 +0800
+Subject: efi: fix memory leak in krealloc failure handling
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 0d3ad1917996839a5042d18f04e41915cfa1b74a ]
+
+In the previous code, there was a memory leak issue where the
+previously allocated memory was not freed upon a failed krealloc
+operation. This patch addresses the problem by releasing the old memory
+before setting the pointer to NULL in case of a krealloc failure. This
+ensures that memory is properly managed and avoids potential memory
+leaks.
+
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/efi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index b43e5e6ddaf6e..b7c0e8cc0764f 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -245,9 +245,13 @@ static __init int efivar_ssdt_load(void)
+ if (status == EFI_NOT_FOUND) {
+ break;
+ } else if (status == EFI_BUFFER_TOO_SMALL) {
+- name = krealloc(name, name_size, GFP_KERNEL);
+- if (!name)
++ efi_char16_t *name_tmp =
++ krealloc(name, name_size, GFP_KERNEL);
++ if (!name_tmp) {
++ kfree(name);
+ return -ENOMEM;
++ }
++ name = name_tmp;
+ continue;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From c2a51dff1aa734c413248b7329df885defd7f406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 19:04:21 +0800
+Subject: fbdev: atyfb: only use ioremap_uc() on i386 and ia64
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ]
+
+ioremap_uc() is only meaningful on old x86-32 systems with the PAT
+extension, and on ia64 with its slightly unconventional ioremap()
+behavior, everywhere else this is the same as ioremap() anyway.
+
+Change the only driver that still references ioremap_uc() to only do so
+on x86-32/ia64 in order to allow removing that interface at some
+point in the future for the other architectures.
+
+On some architectures, ioremap_uc() just returns NULL, changing
+the driver to call ioremap() means that they now have a chance
+of working correctly.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Baoquan He <bhe@redhat.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
+index b3463d1371520..faaa64fa5dfe9 100644
+--- a/drivers/video/fbdev/aty/atyfb_base.c
++++ b/drivers/video/fbdev/aty/atyfb_base.c
+@@ -3447,11 +3447,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info,
+ }
+
+ info->fix.mmio_start = raddr;
++#if defined(__i386__) || defined(__ia64__)
+ /*
+ * By using strong UC we force the MTRR to never have an
+ * effect on the MMIO region on both non-PAT and PAT systems.
+ */
+ par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000);
++#else
++ par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000);
++#endif
+ if (par->ati_regbase == NULL)
+ return -ENOMEM;
+
+--
+2.42.0
+
--- /dev/null
+From 55322384849ac2baeb973715eeb0d7af07e7937d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 14:19:52 +0300
+Subject: fbdev: omapfb: fix some error codes
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit dc608db793731426938baa2f0e75a4a3cce5f5cf ]
+
+Return negative -ENXIO instead of positive ENXIO.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap/omapfb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
+index 17cda57656838..5ea7c52baa5a8 100644
+--- a/drivers/video/fbdev/omap/omapfb_main.c
++++ b/drivers/video/fbdev/omap/omapfb_main.c
+@@ -1643,13 +1643,13 @@ static int omapfb_do_probe(struct platform_device *pdev,
+ }
+ fbdev->int_irq = platform_get_irq(pdev, 0);
+ if (fbdev->int_irq < 0) {
+- r = ENXIO;
++ r = -ENXIO;
+ goto cleanup;
+ }
+
+ fbdev->ext_irq = platform_get_irq(pdev, 1);
+ if (fbdev->ext_irq < 0) {
+- r = ENXIO;
++ r = -ENXIO;
+ goto cleanup;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From 7f6f5d5c3f1c5994b1a27e6ed3845fe7a70c0c5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 17:43:47 -0300
+Subject: fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
+
+From: Jorge Maidana <jorgem.linux@gmail.com>
+
+[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ]
+
+Delete the v86d netlink only after all the VBE tasks have been
+completed.
+
+Fixes initial state restore on module unload:
+uvesafb: VBE state restore call failed (eax=0x4f04, err=-19)
+
+Signed-off-by: Jorge Maidana <jorgem.linux@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/uvesafb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
+index 0e3cabbec4b40..a85463db9f986 100644
+--- a/drivers/video/fbdev/uvesafb.c
++++ b/drivers/video/fbdev/uvesafb.c
+@@ -1935,10 +1935,10 @@ static void uvesafb_exit(void)
+ }
+ }
+
+- cn_del_callback(&uvesafb_cn_id);
+ driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d);
+ platform_device_unregister(uvesafb_device);
+ platform_driver_unregister(&uvesafb_driver);
++ cn_del_callback(&uvesafb_cn_id);
+ }
+
+ module_exit(uvesafb_exit);
+--
+2.42.0
+
--- /dev/null
+From 359abc1880f6adda2019462c80a2c49d78c84f45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 15:52:19 +0400
+Subject: fs/ntfs3: Add ckeck in ni_update_parent()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 87d1888aa40f25773fa0b948bcb2545f97e2cb15 ]
+
+Check simple case when parent inode equals current inode.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index dda13e1f1b330..166c3c49530ec 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -3198,6 +3198,12 @@ static bool ni_update_parent(struct ntfs_inode *ni, struct NTFS_DUP_INFO *dup,
+ if (!fname || !memcmp(&fname->dup, dup, sizeof(fname->dup)))
+ continue;
+
++ /* Check simple case when parent inode equals current inode. */
++ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) {
++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
++ continue;
++ }
++
+ /* ntfs_iget5 may sleep. */
+ dir = ntfs_iget5(sb, &fname->home, NULL);
+ if (IS_ERR(dir)) {
+--
+2.42.0
+
--- /dev/null
+From e99ce7e376e848f31053e3419cd88f90b40ef502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 12:48:07 +0800
+Subject: fs/ntfs3: Avoid possible memory leak
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit e4494770a5cad3c9d1d2a65ed15d07656c0d9b82 ]
+
+smatch warn:
+fs/ntfs3/fslog.c:2172 last_log_lsn() warn: possible memory leak of 'page_bufs'
+Jump to label 'out' to free 'page_bufs' and is more consistent with
+other code.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index 00faf41d8f97d..710cb5aa5a65b 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -2169,8 +2169,10 @@ static int last_log_lsn(struct ntfs_log *log)
+
+ if (!page) {
+ page = kmalloc(log->page_size, GFP_NOFS);
+- if (!page)
+- return -ENOMEM;
++ if (!page) {
++ err = -ENOMEM;
++ goto out;
++ }
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From 718d4a2a5a87a7d68ed0d4c1c8f1c50b4f0848be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 21:50:32 -0700
+Subject: fs/ntfs3: Fix directory element type detection
+
+From: Gabriel Marcano <gabemarcano@yahoo.com>
+
+[ Upstream commit 85a4780dc96ed9dd643bbadf236552b3320fae26 ]
+
+Calling stat() from userspace correctly identified junctions in an NTFS
+partition as symlinks, but using readdir() and iterating through the
+directory containing the same junction did not identify the junction
+as a symlink.
+
+When emitting directory contents, check FILE_ATTRIBUTE_REPARSE_POINT
+attribute to detect junctions and report them as links.
+
+Signed-off-by: Gabriel Marcano <gabemarcano@yahoo.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/dir.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
+index fb438d6040409..d4d9f4ffb6d9a 100644
+--- a/fs/ntfs3/dir.c
++++ b/fs/ntfs3/dir.c
+@@ -309,7 +309,11 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
+ return 0;
+ }
+
+- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
++ /* NTFS: symlinks are "dir + reparse" or "file + reparse" */
++ if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT)
++ dt_type = DT_LNK;
++ else
++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
+
+ return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
+ }
+--
+2.42.0
+
--- /dev/null
+From a1a19da1f0c9a64854616aee5678e109e7bde15c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 11:28:11 +0300
+Subject: fs/ntfs3: Fix NULL pointer dereference on error in
+ attr_allocate_frame()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 9c689c8dc86f8ca99bf91c05f24c8bab38fe7d5f ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index 63169529b52c4..2215179c925b3 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1658,10 +1658,8 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
+ le_b = NULL;
+ attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL,
+ 0, NULL, &mi_b);
+- if (!attr_b) {
+- err = -ENOENT;
+- goto out;
+- }
++ if (!attr_b)
++ return -ENOENT;
+
+ attr = attr_b;
+ le = le_b;
+--
+2.42.0
+
--- /dev/null
+From 0fd10ddae05594b565fd05c60f8d112d42ce6ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 11:19:08 +0300
+Subject: fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 32e9212256b88f35466642f9c939bb40cfb2c2de ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index 166c3c49530ec..bb7e33c240737 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -2149,7 +2149,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page)
+
+ for (i = 0; i < pages_per_frame; i++) {
+ pg = pages[i];
+- if (i == idx)
++ if (i == idx || !pg)
+ continue;
+ unlock_page(pg);
+ put_page(pg);
+--
+2.42.0
+
--- /dev/null
+From e707ee9da0f79c05aa0b925ce0b5216f4d78f252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 16:12:58 +0400
+Subject: fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit fc471e39e38fea6677017cbdd6d928088a59fc67 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 15 +++++++++++++--
+ fs/ntfs3/bitmap.c | 3 ++-
+ fs/ntfs3/super.c | 2 +-
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index 81c22df27c725..0c6a68e71e7d4 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,7 +52,8 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
+- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN);
++ /* attr is resident: lsize < record_size (1K or 4K) */
++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+ err = -ENOMEM;
+ goto out;
+@@ -80,7 +81,17 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ if (err < 0)
+ goto out;
+
+- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN);
++ /* attr is nonresident.
++ * The worst case:
++ * 1T (2^40) extremely fragmented file.
++ * cluster = 4K (2^12) => 2^28 fragments
++ * 2^9 fragments per one record => 2^19 records
++ * 2^5 bytes of ATTR_LIST_ENTRY per one record => 2^24 bytes.
++ *
++ * the result is 16M bytes per attribute list.
++ * Use kvmalloc to allocate in range [several Kbytes - dozen Mbytes]
++ */
++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+ err = -ENOMEM;
+ goto out;
+diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c
+index e0cdc91d88a85..c055bbdfe0f7c 100644
+--- a/fs/ntfs3/bitmap.c
++++ b/fs/ntfs3/bitmap.c
+@@ -662,7 +662,8 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits)
+ wnd->bits_last = wbits;
+
+ wnd->free_bits =
+- kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN);
++ kvmalloc_array(wnd->nwnd, sizeof(u16), GFP_KERNEL | __GFP_ZERO);
++
+ if (!wnd->free_bits)
+ return -ENOMEM;
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index 8e2fe0f69203b..6066eea3f61cb 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -1141,7 +1141,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+ goto put_inode_out;
+ }
+ bytes = inode->i_size;
+- sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN);
++ sbi->def_table = t = kvmalloc(bytes, GFP_KERNEL);
+ if (!t) {
+ err = -ENOMEM;
+ goto put_inode_out;
+--
+2.42.0
+
--- /dev/null
+From 5ad679dc956a2de9def84859ed2c6e0508d115b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 15:57:19 +0400
+Subject: fs/ntfs3: Write immediately updated ntfs state
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 06ccfb00645990a9fcc14249e6d1c25921ecb836 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 9c0fc3a29d0c9..873b1434a9989 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -953,18 +953,11 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty)
+ if (err)
+ return err;
+
+- mark_inode_dirty(&ni->vfs_inode);
++ mark_inode_dirty_sync(&ni->vfs_inode);
+ /* verify(!ntfs_update_mftmirr()); */
+
+- /*
+- * If we used wait=1, sync_inode_metadata waits for the io for the
+- * inode to finish. It hangs when media is removed.
+- * So wait=0 is sent down to sync_inode_metadata
+- * and filemap_fdatawrite is used for the data blocks.
+- */
+- err = sync_inode_metadata(&ni->vfs_inode, 0);
+- if (!err)
+- err = filemap_fdatawrite(ni->vfs_inode.i_mapping);
++ /* write mft record on disk. */
++ err = _ni_write_inode(&ni->vfs_inode, 1);
+
+ return err;
+ }
+--
+2.42.0
+
--- /dev/null
+From 5dc31e59e56b903257914af0d1338b4a2ec26bb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 22:48:56 -0400
+Subject: gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ]
+
+Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was
+amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it
+calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to
+index sched->sched_rq[].
+
+Cc: Alex Deucher <Alexander.Deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alex Deucher <Alexander.Deucher@amd.com>
+Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tuikov@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++-
+ include/drm/gpu_scheduler.h | 3 +--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index fdbeafda4e80a..1ed2142a6e7bf 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio)
+ {
+ switch (ctx_prio) {
+ case AMDGPU_CTX_PRIORITY_UNSET:
+- return DRM_SCHED_PRIORITY_UNSET;
++ pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL");
++ return DRM_SCHED_PRIORITY_NORMAL;
+
+ case AMDGPU_CTX_PRIORITY_VERY_LOW:
+ return DRM_SCHED_PRIORITY_MIN;
+diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
+index 2ae4fd62e01c4..17e7e3145a058 100644
+--- a/include/drm/gpu_scheduler.h
++++ b/include/drm/gpu_scheduler.h
+@@ -55,8 +55,7 @@ enum drm_sched_priority {
+ DRM_SCHED_PRIORITY_HIGH,
+ DRM_SCHED_PRIORITY_KERNEL,
+
+- DRM_SCHED_PRIORITY_COUNT,
+- DRM_SCHED_PRIORITY_UNSET = -2
++ DRM_SCHED_PRIORITY_COUNT
+ };
+
+ /**
+--
+2.42.0
+
--- /dev/null
+From 101bff8ef24f52aebb1d31da12238ab074809078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 17:29:57 -0700
+Subject: Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ]
+
+Touch controllers need some time after receiving reset command for the
+firmware to finish re-initializing and be ready to respond to commands
+from the host. The driver already had handling for the post-reset delay
+for I2C and SPI transports, this change adds the handling to
+SMBus-connected devices.
+
+SMBus devices are peculiar because they implement legacy PS/2
+compatibility mode, so reset is actually issued by psmouse driver on the
+associated serio port, after which the control is passed to the RMI4
+driver with SMBus companion device.
+
+Note that originally the delay was added to psmouse driver in
+92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus
+mode"), but that resulted in an unwanted delay in "fast" reconnect
+handler for the serio port, so it was decided to revert the patch and
+have the delay being handled in the RMI4 driver, similar to the other
+transports.
+
+Tested-by: Jeffery Miller <jefferymiller@google.com>
+Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ drivers/input/rmi4/rmi_smbus.c | 50 ++++++++++++++++++---------------
+ 2 files changed, 29 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index d2c9f4cbd00c6..e43e93ac2798a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1753,6 +1753,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
+ psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+ !SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10);
+ const struct rmi_device_platform_data pdata = {
++ .reset_delay_ms = 30,
+ .sensor_pdata = {
+ .sensor_type = rmi_sensor_touchpad,
+ .axis_align.flip_y = true,
+diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
+index c130468541b7d..7080c2ddbaf2b 100644
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb)
+
+ static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb)
+ {
+- int retval;
++ struct i2c_client *client = rmi_smb->client;
++ int smbus_version;
++
++ /*
++ * psmouse driver resets the controller, we only need to wait
++ * to give the firmware chance to fully reinitialize.
++ */
++ if (rmi_smb->xport.pdata.reset_delay_ms)
++ msleep(rmi_smb->xport.pdata.reset_delay_ms);
+
+ /* we need to get the smbus version to activate the touchpad */
+- retval = rmi_smb_get_version(rmi_smb);
+- if (retval < 0)
+- return retval;
++ smbus_version = rmi_smb_get_version(rmi_smb);
++ if (smbus_version < 0)
++ return smbus_version;
++
++ rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
++ smbus_version);
++
++ if (smbus_version != 2 && smbus_version != 3) {
++ dev_err(&client->dev, "Unrecognized SMB version %d\n",
++ smbus_version);
++ return -ENODEV;
++ }
+
+ return 0;
+ }
+@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr)
+ rmi_smb_clear_state(rmi_smb);
+
+ /*
+- * we do not call the actual reset command, it has to be handled in
+- * PS/2 or there will be races between PS/2 and SMBus.
+- * PS/2 should ensure that a psmouse_reset is called before
+- * intializing the device and after it has been removed to be in a known
+- * state.
++ * We do not call the actual reset command, it has to be handled in
++ * PS/2 or there will be races between PS/2 and SMBus. PS/2 should
++ * ensure that a psmouse_reset is called before initializing the
++ * device and after it has been removed to be in a known state.
+ */
+ return rmi_smb_enable_smbus_mode(rmi_smb);
+ }
+@@ -273,7 +289,6 @@ static int rmi_smb_probe(struct i2c_client *client,
+ {
+ struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev);
+ struct rmi_smb_xport *rmi_smb;
+- int smbus_version;
+ int error;
+
+ if (!pdata) {
+@@ -312,18 +327,9 @@ static int rmi_smb_probe(struct i2c_client *client,
+ rmi_smb->xport.proto_name = "smb";
+ rmi_smb->xport.ops = &rmi_smb_ops;
+
+- smbus_version = rmi_smb_get_version(rmi_smb);
+- if (smbus_version < 0)
+- return smbus_version;
+-
+- rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
+- smbus_version);
+-
+- if (smbus_version != 2 && smbus_version != 3) {
+- dev_err(&client->dev, "Unrecognized SMB version %d\n",
+- smbus_version);
+- return -ENODEV;
+- }
++ error = rmi_smb_enable_smbus_mode(rmi_smb);
++ if (error)
++ return error;
+
+ i2c_set_clientdata(client, rmi_smb);
+
+--
+2.42.0
+
--- /dev/null
+From 1bc54909c18d857c48133fcef575fae9d88dc9fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 18:47:31 -0400
+Subject: io_uring: kiocb_done() should *not* trust ->ki_pos if
+ ->{read,write}_iter() failed
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 1939316bf988f3e49a07d9c4dd6f660bf4daa53d ]
+
+->ki_pos value is unreliable in such cases. For an obvious example,
+consider O_DSYNC write - we feed the data to page cache and start IO,
+then we make sure it's completed. Update of ->ki_pos is dealt with
+by the first part; failure in the second ends up with negative value
+returned _and_ ->ki_pos left advanced as if sync had been successful.
+In the same situation write(2) does not advance the file position
+at all.
+
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/rw.c b/io_uring/rw.c
+index 0218fae12eddc..0133db648d8e9 100644
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -326,7 +326,7 @@ static int kiocb_done(struct io_kiocb *req, ssize_t ret,
+ struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
+ unsigned final_ret = io_fixup_rw_res(req, ret);
+
+- if (req->flags & REQ_F_CUR_POS)
++ if (ret >= 0 && req->flags & REQ_F_CUR_POS)
+ req->file->f_pos = rw->kiocb.ki_pos;
+ if (ret >= 0 && (rw->kiocb.ki_complete == io_complete_rw)) {
+ if (!__io_complete_rw_common(req, ret)) {
+--
+2.42.0
+
--- /dev/null
+From bc4bbe9dd327cfd448c323137650c7d18199cb4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 10:13:51 +0530
+Subject: irqchip/riscv-intc: Mark all INTC nodes as initialized
+
+From: Anup Patel <apatel@ventanamicro.com>
+
+[ Upstream commit e13cd66bd821be417c498a34928652db4ac6b436 ]
+
+The RISC-V INTC local interrupts are per-HART (or per-CPU) so we
+create INTC IRQ domain only for the INTC node belonging to the boot
+HART. This means only the boot HART INTC node will be marked as
+initialized and other INTC nodes won't be marked which results
+downstream interrupt controllers (such as PLIC, IMSIC and APLIC
+direct-mode) not being probed due to missing device suppliers.
+
+To address this issue, we mark all INTC node for which we don't
+create IRQ domain as initialized.
+
+Reported-by: Dmitry Dunaev <dunaev@tecon.ru>
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru
+Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-intc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c
+index 499e5f81b3fe3..4b66850978e6e 100644
+--- a/drivers/irqchip/irq-riscv-intc.c
++++ b/drivers/irqchip/irq-riscv-intc.c
+@@ -110,8 +110,16 @@ static int __init riscv_intc_init(struct device_node *node,
+ * for each INTC DT node. We only need to do INTC initialization
+ * for the INTC DT node belonging to boot CPU (or boot HART).
+ */
+- if (riscv_hartid_to_cpuid(hartid) != smp_processor_id())
++ if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) {
++ /*
++ * The INTC nodes of each CPU are suppliers for downstream
++ * interrupt controllers (such as PLIC, IMSIC and APLIC
++ * direct-mode) so we should mark an INTC node as initialized
++ * if we are not creating IRQ domain for it.
++ */
++ fwnode_dev_initialized(of_fwnode_handle(node), true);
+ return 0;
++ }
+
+ intc_domain = irq_domain_add_linear(node, BITS_PER_LONG,
+ &riscv_intc_domain_ops, NULL);
+--
+2.42.0
+
--- /dev/null
+From 716da56b9ca0ab56a2a0ec63df16c79c501391d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 12:20:03 -0400
+Subject: irqchip/stm32-exti: add missing DT IRQ flag translation
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ]
+
+The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger
+flags specified in the device tree were being ignored. This was
+preventing the RTC alarm interrupt from working, because it must be set
+to trigger on the rising edge to function correctly.
+
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-stm32-exti.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index 8bbb2b114636c..dc6f67decb022 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -458,6 +458,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = {
+ .map = irq_map_generic_chip,
+ .alloc = stm32_exti_alloc,
+ .free = stm32_exti_free,
++ .xlate = irq_domain_xlate_twocell,
+ };
+
+ static void stm32_irq_ack(struct irq_data *d)
+--
+2.42.0
+
--- /dev/null
+From 5374cd52398c5c53ddcc1850a80b34b0b70d0a55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Export symbol invalid_pud_table for modules building
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 449c2756c2323c9e32b2a2fa9c8b59ce91b5819d ]
+
+Export symbol invalid_pud_table for modules building (such as the KVM
+module) if 4-level page tables enabled. Otherwise we get:
+
+ERROR: modpost: "invalid_pud_table" [arch/loongarch/kvm/kvm.ko] undefined!
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Tianrui Zhao <zhaotianrui@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
+index c7e9c96719fa3..c74da7770e39e 100644
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -228,6 +228,7 @@ pgd_t swapper_pg_dir[_PTRS_PER_PGD] __section(".bss..swapper_pg_dir");
+ pgd_t invalid_pg_dir[_PTRS_PER_PGD] __page_aligned_bss;
+ #ifndef __PAGETABLE_PUD_FOLDED
+ pud_t invalid_pud_table[PTRS_PER_PUD] __page_aligned_bss;
++EXPORT_SYMBOL(invalid_pud_table);
+ #endif
+ #ifndef __PAGETABLE_PMD_FOLDED
+ pmd_t invalid_pmd_table[PTRS_PER_PMD] __page_aligned_bss;
+--
+2.42.0
+
--- /dev/null
+From ab81980ade9ef98a1b0dfca0cf4a44b7e0ff891d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Replace kmap_atomic() with kmap_local_page() in
+ copy_user_highpage()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 477a0ebec101359f49d92796e3b609857d564b52 ]
+
+Replace kmap_atomic()/kunmap_atomic() calls with kmap_local_page()/
+kunmap_local() in copy_user_highpage() which can be invoked from both
+preemptible and atomic context [1].
+
+[1] https://lore.kernel.org/all/20201029222652.302358281@linutronix.de/
+
+Suggested-by: Deepak R Varma <drv@mailo.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
+index c74da7770e39e..f42a3be5f28d7 100644
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -68,11 +68,11 @@ void copy_user_highpage(struct page *to, struct page *from,
+ {
+ void *vfrom, *vto;
+
+- vto = kmap_atomic(to);
+- vfrom = kmap_atomic(from);
++ vfrom = kmap_local_page(from);
++ vto = kmap_local_page(to);
+ copy_page(vto, vfrom);
+- kunmap_atomic(vfrom);
+- kunmap_atomic(vto);
++ kunmap_local(vfrom);
++ kunmap_local(vto);
+ /* Make sure this page is cleared on other CPU's too before using it */
+ smp_wmb();
+ }
+--
+2.42.0
+
--- /dev/null
+From 2c51146e4d999c83949e75f98bd34ebe814e29f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 17:27:59 +0800
+Subject: net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ]
+
+t4_set_params_timeout() can return -EINVAL if failed, add check
+for this.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 8d719f82854a9..76de55306c4d0 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3816,6 +3816,8 @@ int t4_load_phy_fw(struct adapter *adap, int win,
+ FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD));
+ ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1,
+ ¶m, &val, 30000);
++ if (ret)
++ return ret;
+
+ /* If we have version number support, then check to see that the new
+ * firmware got loaded properly.
+--
+2.42.0
+
--- /dev/null
+From dfeffffaf453f6e39ea91abb198b44d216c5c095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 15:19:37 +0200
+Subject: net: sched: cls_u32: Fix allocation size in u32_init()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ]
+
+commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array
+with flexible-array member") incorrecly replaced an instance of
+`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results
+in a an over-allocation of 8 bytes.
+
+This change is wrong because `hlist` in `struct tc_u_common` is a
+pointer:
+
+net/sched/cls_u32.c:
+struct tc_u_common {
+ struct tc_u_hnode __rcu *hlist;
+ void *ptr;
+ int refcnt;
+ struct idr handle_idr;
+ struct hlist_node hnode;
+ long knodes;
+};
+
+So, the use of `struct_size()` makes no sense: we don't need to allocate
+any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine.
+
+So, `struct_size(tp_c, hlist->ht, 1)` translates to:
+
+sizeof(*tp_c) + sizeof(tp_c->hlist->ht) ==
+sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) ==
+ 144 + 8 == 0x98 (byes)
+ ^^^
+ |
+ unnecessary extra
+ allocation size
+
+$ pahole -C tc_u_common net/sched/cls_u32.o
+struct tc_u_common {
+ struct tc_u_hnode * hlist; /* 0 8 */
+ void * ptr; /* 8 8 */
+ int refcnt; /* 16 4 */
+
+ /* XXX 4 bytes hole, try to pack */
+
+ struct idr handle_idr; /* 24 96 */
+ /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */
+ struct hlist_node hnode; /* 120 16 */
+ /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */
+ long int knodes; /* 136 8 */
+
+ /* size: 144, cachelines: 3, members: 6 */
+ /* sum members: 140, holes: 1, sum holes: 4 */
+ /* last cacheline: 16 bytes */
+};
+
+And with `sizeof(*tp_c)`, we have:
+
+ sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes)
+
+which is the correct and original allocation size.
+
+Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with
+`sizeof(*tp_c)`, and avoid allocating 8 too many bytes.
+
+The following difference in binary output is expected and reflects the
+desired change:
+
+| net/sched/cls_u32.o
+| @@ -6148,7 +6148,7 @@
+| include/linux/slab.h:599
+| 2cf5: mov 0x0(%rip),%rdi # 2cfc <u32_init+0xfc>
+| 2cf8: R_X86_64_PC32 kmalloc_caches+0xc
+|- 2cfc: mov $0x98,%edx
+|+ 2cfc: mov $0x90,%edx
+
+Reported-by: Alejandro Colomar <alx@kernel.org>
+Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_u32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index ba93e2a6bdbb4..04448bfb4d3db 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -364,7 +364,7 @@ static int u32_init(struct tcf_proto *tp)
+ idr_init(&root_ht->handle_idr);
+
+ if (tp_c == NULL) {
+- tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL);
++ tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
+ if (tp_c == NULL) {
+ kfree(root_ht);
+ return -ENOBUFS;
+--
+2.42.0
+
--- /dev/null
+From 959cd15feba4b19c84ba60c844636a5f2b317d30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 17:06:59 +0200
+Subject: netfilter: nf_tables: audit log object reset once per table
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 1baf0152f7707c6c7e4ea815dcc1f431c0e603f9 ]
+
+When resetting multiple objects at once (via dump request), emit a log
+message per table (or filled skb) and resurrect the 'entries' parameter
+to contain the number of objects being logged for.
+
+To test the skb exhaustion path, perform some bulk counter and quota
+adds in the kselftest.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 50 +++++++++++--------
+ .../testing/selftests/netfilter/nft_audit.sh | 46 +++++++++++++++++
+ 2 files changed, 74 insertions(+), 22 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 5e3dbe2652dbd..5c783199b4999 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7324,6 +7324,16 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
+ return -1;
+ }
+
++static void audit_log_obj_reset(const struct nft_table *table,
++ unsigned int base_seq, unsigned int nentries)
++{
++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq);
++
++ audit_log_nfcfg(buf, table->family, nentries,
++ AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC);
++ kfree(buf);
++}
++
+ struct nft_obj_filter {
+ char *table;
+ u32 type;
+@@ -7338,8 +7348,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
+ struct nftables_pernet *nft_net;
++ unsigned int entries = 0;
+ struct nft_object *obj;
+ bool reset = false;
++ int rc = 0;
+
+ if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
+ reset = true;
+@@ -7352,6 +7364,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
++ entries = 0;
+ list_for_each_entry_rcu(obj, &table->objects, list) {
+ if (!nft_is_active(net, obj))
+ goto cont;
+@@ -7367,34 +7380,27 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ filter->type != NFT_OBJECT_UNSPEC &&
+ obj->ops->type->type != filter->type)
+ goto cont;
+- if (reset) {
+- char *buf = kasprintf(GFP_ATOMIC,
+- "%s:%u",
+- table->name,
+- nft_net->base_seq);
+-
+- audit_log_nfcfg(buf,
+- family,
+- obj->handle,
+- AUDIT_NFT_OP_OBJ_RESET,
+- GFP_ATOMIC);
+- kfree(buf);
+- }
+
+- if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq,
+- NFT_MSG_NEWOBJ,
+- NLM_F_MULTI | NLM_F_APPEND,
+- table->family, table,
+- obj, reset) < 0)
+- goto done;
++ rc = nf_tables_fill_obj_info(skb, net,
++ NETLINK_CB(cb->skb).portid,
++ cb->nlh->nlmsg_seq,
++ NFT_MSG_NEWOBJ,
++ NLM_F_MULTI | NLM_F_APPEND,
++ table->family, table,
++ obj, reset);
++ if (rc < 0)
++ break;
+
++ entries++;
+ nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+ cont:
+ idx++;
+ }
++ if (reset && entries)
++ audit_log_obj_reset(table, nft_net->base_seq, entries);
++ if (rc < 0)
++ break;
+ }
+-done:
+ rcu_read_unlock();
+
+ cb->args[0] = idx;
+@@ -7499,7 +7505,7 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
+
+ audit_log_nfcfg(buf,
+ family,
+- obj->handle,
++ 1,
+ AUDIT_NFT_OP_OBJ_RESET,
+ GFP_ATOMIC);
+ kfree(buf);
+diff --git a/tools/testing/selftests/netfilter/nft_audit.sh b/tools/testing/selftests/netfilter/nft_audit.sh
+index 5267c88496d51..99ed5bd6e8402 100755
+--- a/tools/testing/selftests/netfilter/nft_audit.sh
++++ b/tools/testing/selftests/netfilter/nft_audit.sh
+@@ -99,6 +99,12 @@ do_test 'nft add counter t1 c1' \
+ do_test 'nft add counter t2 c1; add counter t2 c2' \
+ 'table=t2 family=2 entries=2 op=nft_register_obj'
+
++for ((i = 3; i <= 500; i++)); do
++ echo "add counter t2 c$i"
++done >$rulefile
++do_test "nft -f $rulefile" \
++'table=t2 family=2 entries=498 op=nft_register_obj'
++
+ # adding/updating quotas
+
+ do_test 'nft add quota t1 q1 { 10 bytes }' \
+@@ -107,6 +113,12 @@ do_test 'nft add quota t1 q1 { 10 bytes }' \
+ do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \
+ 'table=t2 family=2 entries=2 op=nft_register_obj'
+
++for ((i = 3; i <= 500; i++)); do
++ echo "add quota t2 q$i { 10 bytes }"
++done >$rulefile
++do_test "nft -f $rulefile" \
++'table=t2 family=2 entries=498 op=nft_register_obj'
++
+ # changing the quota value triggers obj update path
+ do_test 'nft add quota t1 q1 { 20 bytes }' \
+ 'table=t1 family=2 entries=1 op=nft_register_obj'
+@@ -156,6 +168,40 @@ done
+ do_test 'nft reset set t1 s' \
+ 'table=t1 family=2 entries=3 op=nft_reset_setelem'
+
++# resetting counters
++
++do_test 'nft reset counter t1 c1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset counters t1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset counters t2' \
++'table=t2 family=2 entries=342 op=nft_reset_obj
++table=t2 family=2 entries=158 op=nft_reset_obj'
++
++do_test 'nft reset counters' \
++'table=t1 family=2 entries=1 op=nft_reset_obj
++table=t2 family=2 entries=341 op=nft_reset_obj
++table=t2 family=2 entries=159 op=nft_reset_obj'
++
++# resetting quotas
++
++do_test 'nft reset quota t1 q1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset quotas t1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset quotas t2' \
++'table=t2 family=2 entries=315 op=nft_reset_obj
++table=t2 family=2 entries=185 op=nft_reset_obj'
++
++do_test 'nft reset quotas' \
++'table=t1 family=2 entries=1 op=nft_reset_obj
++table=t2 family=2 entries=314 op=nft_reset_obj
++table=t2 family=2 entries=186 op=nft_reset_obj'
++
+ # deleting rules
+
+ readarray -t handles < <(nft -a list chain t1 c1 | \
+--
+2.42.0
+
--- /dev/null
+From 274d2575e65df71fe4cd9bb1134f5f9556b7644e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 10:53:08 +0200
+Subject: netfilter: nfnetlink_log: silence bogus compiler warning
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ]
+
+net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized
+
+The warning is bogus, the variable is only used if ct is non-NULL and
+always initialised in that case. Init to 0 too to silence this.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nfnetlink_log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index d97eb280cb2e8..c5ff699e30469 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -690,8 +690,8 @@ nfulnl_log_packet(struct net *net,
+ unsigned int plen = 0;
+ struct nfnl_log_net *log = nfnl_log_pernet(net);
+ const struct nfnl_ct_hook *nfnl_ct = NULL;
++ enum ip_conntrack_info ctinfo = 0;
+ struct nf_conn *ct = NULL;
+- enum ip_conntrack_info ctinfo;
+
+ if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
+ li = li_user;
+--
+2.42.0
+
--- /dev/null
+From 936aed5b56b2125c1e8f9f57b5e94c5c0d05d507 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 19:02:35 -0400
+Subject: platform/mellanox: mlxbf-tmfifo: Fix a warning message
+
+From: Liming Sun <limings@nvidia.com>
+
+[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ]
+
+This commit fixes the smatch static checker warning in function
+mlxbf_tmfifo_rxtx_word() which complains data not initialized at
+line 634 when IS_VRING_DROP() is TRUE.
+
+Signed-off-by: Liming Sun <limings@nvidia.com>
+Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
+index a04ff89a7ec44..9925a6d94affc 100644
+--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
+@@ -588,24 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring,
+
+ if (vring->cur_len + sizeof(u64) <= len) {
+ /* The whole word. */
+- if (!IS_VRING_DROP(vring)) {
+- if (is_rx)
++ if (is_rx) {
++ if (!IS_VRING_DROP(vring))
+ memcpy(addr + vring->cur_len, &data,
+ sizeof(u64));
+- else
+- memcpy(&data, addr + vring->cur_len,
+- sizeof(u64));
++ } else {
++ memcpy(&data, addr + vring->cur_len,
++ sizeof(u64));
+ }
+ vring->cur_len += sizeof(u64);
+ } else {
+ /* Leftover bytes. */
+- if (!IS_VRING_DROP(vring)) {
+- if (is_rx)
++ if (is_rx) {
++ if (!IS_VRING_DROP(vring))
+ memcpy(addr + vring->cur_len, &data,
+ len - vring->cur_len);
+- else
+- memcpy(&data, addr + vring->cur_len,
+- len - vring->cur_len);
++ } else {
++ data = 0;
++ memcpy(&data, addr + vring->cur_len,
++ len - vring->cur_len);
+ }
+ vring->cur_len = len;
+ }
+--
+2.42.0
+
--- /dev/null
+From fd9b35864a74fb6db1aba117f76e13d6f42284a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 17:55:51 +0200
+Subject: powerpc/85xx: Fix math emulation exception
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 8e8a12ecbc86700b5e1a3596ce2b3c43dafad336 ]
+
+Booting mpc85xx_defconfig kernel on QEMU leads to:
+
+Bad trap at PC: fe9bab0, SR: 2d000, vector=800
+awk[82]: unhandled trap (5) at 0 nip fe9bab0 lr fe9e01c code 5 in libc-2.27.so[fe5a000+17a000]
+awk[82]: code: 3aa00000 3a800010 4bffe03c 9421fff0 7ca62b78 38a00000 93c10008 83c10008
+awk[82]: code: 38210010 4bffdec8 9421ffc0 7c0802a6 <fc00048e> d8010008 4815190d 93810030
+Trace/breakpoint trap
+WARNING: no useful console
+
+This is because allthough CONFIG_MATH_EMULATION is selected,
+Exception 800 calls unknown_exception().
+
+Call emulation_assist_interrupt() instead.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/066caa6d9480365da9b8ed83692d7101e10ac5f8.1695657339.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_85xx.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_85xx.S b/arch/powerpc/kernel/head_85xx.S
+index 52c0ab416326a..0e16aea7853b8 100644
+--- a/arch/powerpc/kernel/head_85xx.S
++++ b/arch/powerpc/kernel/head_85xx.S
+@@ -394,7 +394,7 @@ interrupt_base:
+ #ifdef CONFIG_PPC_FPU
+ FP_UNAVAILABLE_EXCEPTION
+ #else
+- EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, unknown_exception)
++ EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, emulation_assist_interrupt)
+ #endif
+
+ /* System Call Interrupt */
+--
+2.42.0
+
--- /dev/null
+From 520ff3054abed7ee5bdb55fd76513e664e4de348 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 22:25:00 +1100
+Subject: powerpc/mm: Fix boot crash with FLATMEM
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ]
+
+Erhard reported that his G5 was crashing with v6.6-rc kernels:
+
+ mpic: Setting up HT PICs workarounds for U3/U4
+ BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe
+ Faulting instruction address: 0xc00000000005dc40
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper/0 Tainted: G T 6.6.0-rc3-PMacGS #1
+ Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac
+ NIP: c00000000005dc40 LR: c000000000066660 CTR: c000000000007730
+ REGS: c0000000022bf510 TRAP: 0380 Tainted: G T (6.6.0-rc3-PMacGS)
+ MSR: 9000000000001032 <SF,HV,ME,IR,DR,RI> CR: 44004242 XER: 00000000
+ IRQMASK: 3
+ GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac
+ GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300
+ GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000
+ GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8
+ GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000
+ GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c
+ GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000
+ GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac
+ NIP hash_page_do_lazy_icache+0x50/0x100
+ LR __hash_page_4K+0x420/0x590
+ Call Trace:
+ hash_page_mm+0x364/0x6f0
+ do_hash_fault+0x114/0x2b0
+ data_access_common_virt+0x198/0x1f0
+ --- interrupt: 300 at mpic_init+0x4bc/0x10c4
+ NIP: c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000
+ REGS: c0000000022bf9f0 TRAP: 0300 Tainted: G T (6.6.0-rc3-PMacGS)
+ MSR: 9000000000001032 <SF,HV,ME,IR,DR,RI> CR: 24004248 XER: 00000000
+ DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1
+ ...
+ NIP mpic_init+0x4bc/0x10c4
+ LR mpic_init+0x464/0x10c4
+ --- interrupt: 300
+ pmac_setup_one_mpic+0x258/0x2dc
+ pmac_pic_init+0x28c/0x3d8
+ init_IRQ+0x90/0x140
+ start_kernel+0x57c/0x78c
+ start_here_common+0x1c/0x20
+
+A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc:
+implement the new page table range API").
+
+Analysis of the oops pointed to a struct page with a corrupted
+compound_head being loaded via page_folio() -> _compound_head() in
+hash_page_do_lazy_icache().
+
+The access by the mpic code is to an MMIO address, so the expectation
+is that the struct page for that address would be initialised by
+init_unavailable_range(), as pointed out by Aneesh.
+
+Instrumentation showed that was not the case, which eventually lead to
+the realisation that pfn_valid() was returning false for that address,
+causing the struct page to not be initialised.
+
+Because the system is using FLATMEM, the version of pfn_valid() in
+memory_model.h is used:
+
+static inline int pfn_valid(unsigned long pfn)
+{
+ ...
+ return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr;
+}
+
+Which relies on max_mapnr being initialised. Early in boot max_mapnr is
+zero meaning no PFNs are valid.
+
+max_mapnr is initialised in mem_init() called via:
+
+ start_kernel()
+ mm_core_init() # init/main.c:928
+ mem_init()
+
+But that is too late for the usage in init_unavailable_range() called via:
+
+ start_kernel()
+ setup_arch() # init/main.c:893
+ paging_init()
+ free_area_init()
+ init_unavailable_range()
+
+Although max_mapnr is currently set in mem_init(), the value is actually
+already available much earlier, as soon as mem_topology_setup() has
+completed, which is also before paging_init() is called. So move the
+initialisation there, which causes paging_init() to correctly initialise
+the struct page and fixes the bug.
+
+This bug seems to have been lurking for years, but went unnoticed
+because the pre-folio code was inspecting the uninitialised page->flags
+but not dereferencing it.
+
+Thanks to Erhard and Aneesh for help debugging.
+
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/setup-common.c | 2 ++
+ arch/powerpc/mm/mem.c | 1 -
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index efb301a4987ca..59b4ac57bfaf7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -946,6 +946,8 @@ void __init setup_arch(char **cmdline_p)
+
+ /* Parse memory topology */
+ mem_topology_setup();
++ /* Set max_mapnr before paging_init() */
++ set_max_mapnr(max_pfn);
+
+ /*
+ * Release secondary cpus out of their spinloops at 0x60 now that
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 84d171953ba44..c7599b1737099 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -288,7 +288,6 @@ void __init mem_init(void)
+ #endif
+
+ high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
+- set_max_mapnr(max_pfn);
+
+ kasan_late_init();
+
+--
+2.42.0
+
--- /dev/null
+From 645fdf73995d0ff271e847cd8c0d717185fab89b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:57 -0700
+Subject: r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit bc65cc42af737a5a35f83842408ef2c6c79ba025 ]
+
+If the adapter is unplugged while we're looping in r8153b_ups_en() /
+r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500
+loops). Add code similar to what's done in other places in the driver
+to check for unplug and bail.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 3cdb7ff25a3bc..345e341d22338 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3655,6 +3655,8 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
+@@ -3695,6 +3697,8 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
+--
+2.42.0
+
--- /dev/null
+From ba7306a665524d99254804ab05ae8591ceae4a95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:56 -0700
+Subject: r8152: Check for unplug in rtl_phy_patch_request()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit dc90ba37a8c37042407fa6970b9830890cfe6047 ]
+
+If the adapter is unplugged while we're looping in
+rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms *
+5000 loops). Add code similar to what's done in other places in the
+driver to check for unplug and bail.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index c34974f7dfd26..3cdb7ff25a3bc 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4058,6 +4058,9 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)
+ for (i = 0; wait && i < 5000; i++) {
+ u32 ocp_data;
+
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ break;
++
+ usleep_range(1000, 2000);
+ ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT);
+ if ((ocp_data & PATCH_READY) ^ check)
+--
+2.42.0
+
--- /dev/null
+From affd72461635cea5a2c3bbfb9ed2e0a14766a4b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:58 -0700
+Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ]
+
+Whenever the RTL8152_UNPLUG is set that just tells the driver that all
+accesses will fail and we should just immediately bail. A future patch
+will use this same concept at a time when the driver hasn't actually
+been unplugged but is about to be reset. Rename the flag in
+preparation for the future patch.
+
+This is a no-op change and just a search and replace.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 96 ++++++++++++++++++++---------------------
+ 1 file changed, 48 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 345e341d22338..76792269222ea 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -763,7 +763,7 @@ enum rtl_register_content {
+
+ /* rtl8152 flags */
+ enum rtl8152_flags {
+- RTL8152_UNPLUG = 0,
++ RTL8152_INACCESSIBLE = 0,
+ RTL8152_SET_RX_MODE,
+ WORK_ENABLE,
+ RTL8152_LINK_CHG,
+@@ -1244,7 +1244,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
+ static void rtl_set_unplug(struct r8152 *tp)
+ {
+ if (tp->udev->state == USB_STATE_NOTATTACHED) {
+- set_bit(RTL8152_UNPLUG, &tp->flags);
++ set_bit(RTL8152_INACCESSIBLE, &tp->flags);
+ smp_mb__after_atomic();
+ }
+ }
+@@ -1255,7 +1255,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
+ u16 limit = 64;
+ int ret = 0;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ /* both size and indix must be 4 bytes align */
+@@ -1299,7 +1299,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen,
+ u16 byteen_start, byteen_end, byen;
+ u16 limit = 512;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ /* both size and indix must be 4 bytes align */
+@@ -1529,7 +1529,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg)
+ struct r8152 *tp = netdev_priv(netdev);
+ int ret;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ if (phy_id != R8152_PHY_ID)
+@@ -1545,7 +1545,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val)
+ {
+ struct r8152 *tp = netdev_priv(netdev);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (phy_id != R8152_PHY_ID)
+@@ -1750,7 +1750,7 @@ static void read_bulk_callback(struct urb *urb)
+ if (!tp)
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+@@ -1842,7 +1842,7 @@ static void write_bulk_callback(struct urb *urb)
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!skb_queue_empty(&tp->tx_queue))
+@@ -1863,7 +1863,7 @@ static void intr_callback(struct urb *urb)
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ switch (status) {
+@@ -2607,7 +2607,7 @@ static void bottom_half(struct tasklet_struct *t)
+ {
+ struct r8152 *tp = from_tasklet(tp, t, tx_tl);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+@@ -2650,7 +2650,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags)
+ int ret;
+
+ /* The rx would be stopped, so skip submitting */
+- if (test_bit(RTL8152_UNPLUG, &tp->flags) ||
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) ||
+ !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev))
+ return 0;
+
+@@ -3050,7 +3050,7 @@ static int rtl_enable(struct r8152 *tp)
+
+ static int rtl8152_enable(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -3137,7 +3137,7 @@ static int rtl8153_enable(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -3169,7 +3169,7 @@ static void rtl_disable(struct r8152 *tp)
+ u32 ocp_data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -3623,7 +3623,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired)
+ }
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -3655,7 +3655,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+@@ -3697,7 +3697,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+@@ -4062,8 +4062,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)
+ for (i = 0; wait && i < 5000; i++) {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
+- break;
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
++ return -ENODEV;
+
+ usleep_range(1000, 2000);
+ ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT);
+@@ -6026,7 +6026,7 @@ static int rtl8156_enable(struct r8152 *tp)
+ u32 ocp_data;
+ u16 speed;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ r8156_fc_parameter(tp);
+@@ -6084,7 +6084,7 @@ static int rtl8156b_enable(struct r8152 *tp)
+ u32 ocp_data;
+ u16 speed;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -6270,7 +6270,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex,
+
+ static void rtl8152_up(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8152_aldps_en(tp, false);
+@@ -6280,7 +6280,7 @@ static void rtl8152_up(struct r8152 *tp)
+
+ static void rtl8152_down(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6295,7 +6295,7 @@ static void rtl8153_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_u1u2en(tp, false);
+@@ -6335,7 +6335,7 @@ static void rtl8153_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6356,7 +6356,7 @@ static void rtl8153b_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6380,7 +6380,7 @@ static void rtl8153b_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6417,7 +6417,7 @@ static void rtl8153c_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6498,7 +6498,7 @@ static void rtl8156_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6571,7 +6571,7 @@ static void rtl8156_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6709,7 +6709,7 @@ static void rtl_work_func_t(struct work_struct *work)
+ /* If the device is unplugged or !netif_running(), the workqueue
+ * doesn't need to wake the device, and could return directly.
+ */
+- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev))
+ return;
+
+ if (usb_autopm_get_interface(tp->intf) < 0)
+@@ -6748,7 +6748,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work)
+ {
+ struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (usb_autopm_get_interface(tp->intf) < 0)
+@@ -6875,7 +6875,7 @@ static int rtl8152_close(struct net_device *netdev)
+ netif_stop_queue(netdev);
+
+ res = usb_autopm_get_interface(tp->intf);
+- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ rtl_stop_rx(tp);
+ } else {
+@@ -6908,7 +6908,7 @@ static void r8152b_init(struct r8152 *tp)
+ u32 ocp_data;
+ u16 data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ data = r8152_mdio_read(tp, MII_BMCR);
+@@ -6952,7 +6952,7 @@ static void r8153_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_u1u2en(tp, false);
+@@ -6963,7 +6963,7 @@ static void r8153_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -7092,7 +7092,7 @@ static void r8153b_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -7103,7 +7103,7 @@ static void r8153b_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -7174,7 +7174,7 @@ static void r8153c_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -7194,7 +7194,7 @@ static void r8153c_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -8023,7 +8023,7 @@ static void r8156_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP);
+@@ -8044,7 +8044,7 @@ static void r8156_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -8119,7 +8119,7 @@ static void r8156b_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP);
+@@ -8153,7 +8153,7 @@ static void r8156b_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -9219,7 +9219,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+ struct mii_ioctl_data *data = if_mii(rq);
+ int res;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ res = usb_autopm_get_interface(tp->intf);
+@@ -9321,7 +9321,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {
+
+ static void rtl8152_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (tp->version != RTL_VER_01)
+@@ -9330,7 +9330,7 @@ static void rtl8152_unload(struct r8152 *tp)
+
+ static void rtl8153_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_power_cut_en(tp, false);
+@@ -9338,7 +9338,7 @@ static void rtl8153_unload(struct r8152 *tp)
+
+ static void rtl8153b_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_power_cut_en(tp, false);
+--
+2.42.0
+
--- /dev/null
+From 245b2baaa37f99b797d9b45729f317204e53a285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Oct 2023 13:45:29 +0200
+Subject: scsi: mpt3sas: Fix in error path
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ]
+
+The driver should be deregistered as misc driver after PCI registration
+failure.
+
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 8e24ebcebfe52..2ea3bdc638177 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -12914,8 +12914,10 @@ _mpt3sas_init(void)
+ mpt3sas_ctl_init(hbas_to_enumerate);
+
+ error = pci_register_driver(&mpt3sas_driver);
+- if (error)
++ if (error) {
++ mpt3sas_ctl_exit(hbas_to_enumerate);
+ scsih_exit();
++ }
+
+ return error;
+ }
+--
+2.42.0
+
--- /dev/null
+asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch
+coresight-tmc-etr-disable-warnings-for-allocation-fa.patch
+asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch
+net-sched-cls_u32-fix-allocation-size-in-u32_init.patch
+irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch
+irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch
+dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch
+powerpc-85xx-fix-math-emulation-exception.patch
+input-synaptics-rmi4-handle-reset-delay-when-using-s.patch
+fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch
+fs-ntfs3-add-ckeck-in-ni_update_parent.patch
+fs-ntfs3-write-immediately-updated-ntfs-state.patch
+fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch
+fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch
+fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch
+fs-ntfs3-fix-directory-element-type-detection.patch
+fs-ntfs3-avoid-possible-memory-leak.patch
+spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch
+netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch
+efi-fix-memory-leak-in-krealloc-failure-handling.patch
+asoc-rt5650-fix-the-wrong-result-of-key-button.patch
+asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch
+drm-ttm-reorder-sys-manager-cleanup-step.patch
+fbdev-omapfb-fix-some-error-codes.patch
+fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch
+scsi-mpt3sas-fix-in-error-path.patch
+drm-amdgpu-unset-context-priority-is-now-invalid.patch
+gpu-drm-eliminate-drm_sched_priority_unset.patch
+loongarch-export-symbol-invalid_pud_table-for-module.patch
+loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch
+netfilter-nf_tables-audit-log-object-reset-once-per-.patch
+platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch
+drm-amdgpu-reserve-fences-for-vm-update.patch
+net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch
+r8152-check-for-unplug-in-rtl_phy_patch_request.patch
+r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch
+r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch
+powerpc-mm-fix-boot-crash-with-flatmem.patch
+io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch
+ceph_wait_on_conflict_unlink-grab-reference-before-d.patch
--- /dev/null
+From 7d7e62d4b5c64696088deb511be027794ea39537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 11:28:12 -0700
+Subject: spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
+
+From: William A. Kennington III <william@wkennington.com>
+
+[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ]
+
+We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when
+dummy.nbytes is 0. Since we have no dummy bytes, we don't need to
+configure the dummy byte bits per clock register value anyway.
+
+Signed-off-by: "William A. Kennington III" <william@wkennington.com>
+Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-npcm-fiu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
+index 49f6424e35af0..0624f52880705 100644
+--- a/drivers/spi/spi-npcm-fiu.c
++++ b/drivers/spi/spi-npcm-fiu.c
+@@ -353,8 +353,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
+ uma_cfg |= ilog2(op->cmd.buswidth);
+ uma_cfg |= ilog2(op->addr.buswidth)
+ << NPCM_FIU_UMA_CFG_ADBPCK_SHIFT;
+- uma_cfg |= ilog2(op->dummy.buswidth)
+- << NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
++ if (op->dummy.nbytes)
++ uma_cfg |= ilog2(op->dummy.buswidth)
++ << NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
+ uma_cfg |= ilog2(op->data.buswidth)
+ << NPCM_FIU_UMA_CFG_RDBPCK_SHIFT;
+ uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT;
+--
+2.42.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
