--- /dev/null
+From b3434461d66a43b4d4dc013c8e45b7979ead2565 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 19:24:57 +0800
+Subject: arm64: dts: imx93: add the Flex-CAN stop mode by GPR
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 23ed2be5404da7cee6a519fa69bf22d0f69da4e4 ]
+
+imx93 A0 chip use the internal q-channel handshake signal in LPCG
+and CCM to automatically handle the Flex-CAN stop mode. But this
+method meet issue when do the system PM stress test. IC can't fix
+it easily. So in the new imx93 A1 chip, IC drop this method, and
+involve back the old way，use the GPR method to trigger the Flex-CAN
+stop mode signal. Now NXP claim to drop imx93 A0, and only support
+imx93 A1. So here add the stop mode through GPR.
+
+This patch also fix a typo for aonmix_ns_gpr.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Link: https://lore.kernel.org/all/20230726112458.3524165-1-haibo.chen@nxp.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx93.dtsi | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx93.dtsi b/arch/arm64/boot/dts/freescale/imx93.dtsi
+index 1d8dd14b65cfa..2a9b89bf52698 100644
+--- a/arch/arm64/boot/dts/freescale/imx93.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx93.dtsi
+@@ -146,7 +146,7 @@
+ #size-cells = <1>;
+ ranges;
+
+- anomix_ns_gpr: syscon@44210000 {
++ aonmix_ns_gpr: syscon@44210000 {
+ compatible = "fsl,imx93-aonmix-ns-syscfg", "syscon";
+ reg = <0x44210000 0x1000>;
+ };
+@@ -280,6 +280,7 @@
+ assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>;
+ assigned-clock-rates = <40000000>;
+ fsl,clk-source = /bits/ 8 <0>;
++ fsl,stop-mode = <&aonmix_ns_gpr 0x14 0>;
+ status = "disabled";
+ };
+
+@@ -532,6 +533,7 @@
+ assigned-clock-parents = <&clk IMX93_CLK_SYS_PLL_PFD1_DIV2>;
+ assigned-clock-rates = <40000000>;
+ fsl,clk-source = /bits/ 8 <0>;
++ fsl,stop-mode = <&wakeupmix_gpr 0x0c 2>;
+ status = "disabled";
+ };
+
+--
+2.42.0
+
--- /dev/null
+From 8103ec3ba5fd4a871d48a95c02604824177de302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 13:02:39 +0200
+Subject: ASoC: codecs: tas2780: Fix log of failed reset via I2C.
+
+From: Roy Chateau <roy.chateau@mep-info.com>
+
+[ Upstream commit 4e9a429ae80657bdc502d3f5078e2073656ec5fd ]
+
+Correctly log failures of reset via I2C.
+
+Signed-off-by: Roy Chateau <roy.chateau@mep-info.com>
+Link: https://lore.kernel.org/r/20231013110239.473123-1-roy.chateau@mep-info.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2780.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/tas2780.c b/sound/soc/codecs/tas2780.c
+index 86bd6c18a9440..41076be238542 100644
+--- a/sound/soc/codecs/tas2780.c
++++ b/sound/soc/codecs/tas2780.c
+@@ -39,7 +39,7 @@ static void tas2780_reset(struct tas2780_priv *tas2780)
+ usleep_range(2000, 2050);
+ }
+
+- snd_soc_component_write(tas2780->component, TAS2780_SW_RST,
++ ret = snd_soc_component_write(tas2780->component, TAS2780_SW_RST,
+ TAS2780_RST);
+ if (ret)
+ dev_err(tas2780->dev, "%s:errCode:0x%x Reset error!\n",
+--
+2.42.0
+
--- /dev/null
+From 39dce1f36fb7f7192d7ed17350e41e740a42ed39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 12:32:43 +0200
+Subject: ASoC: core: Do not call link_exit() on uninitialized rtd objects
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit dd9f9cc1e6b9391140afa5cf27bb47c9e2a08d02 ]
+
+On init we have sequence:
+
+ for_each_card_prelinks(card, i, dai_link) {
+ ret = snd_soc_add_pcm_runtime(card, dai_link);
+
+ ret = init_some_other_things(...);
+ if (ret)
+ goto probe_end:
+
+ for_each_card_rtds(card, rtd) {
+ ret = soc_init_pcm_runtime(card, rtd);
+
+probe_end:
+
+while on exit:
+ for_each_card_rtds(card, rtd)
+ snd_soc_link_exit(rtd);
+
+If init_some_other_things() step fails due to error we end up with
+not fully setup rtds and try to call snd_soc_link_exit on them, which
+depending on contents on .link_exit handler, can end up dereferencing
+NULL pointer.
+
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Link: https://lore.kernel.org/r/20230929103243.705433-2-amadeuszx.slawinski@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc.h | 2 ++
+ sound/soc/soc-core.c | 20 +++++++++++++++-----
+ 2 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/soc.h b/include/sound/soc.h
+index b27f84580c5b0..cf34810882347 100644
+--- a/include/sound/soc.h
++++ b/include/sound/soc.h
+@@ -1125,6 +1125,8 @@ struct snd_soc_pcm_runtime {
+ unsigned int pop_wait:1;
+ unsigned int fe_compr:1; /* for Dynamic PCM */
+
++ bool initialized;
++
+ int num_components;
+ struct snd_soc_component *components[]; /* CPU/Codec/Platform */
+ };
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 1a0bde23f5e6f..2d85164457f73 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1259,7 +1259,7 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
+ snd_soc_runtime_get_dai_fmt(rtd);
+ ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
+ if (ret)
+- return ret;
++ goto err;
+
+ /* add DPCM sysfs entries */
+ soc_dpcm_debugfs_add(rtd);
+@@ -1284,17 +1284,26 @@ static int soc_init_pcm_runtime(struct snd_soc_card *card,
+ /* create compress_device if possible */
+ ret = snd_soc_dai_compress_new(cpu_dai, rtd, num);
+ if (ret != -ENOTSUPP)
+- return ret;
++ goto err;
+
+ /* create the pcm */
+ ret = soc_new_pcm(rtd, num);
+ if (ret < 0) {
+ dev_err(card->dev, "ASoC: can't create pcm %s :%d\n",
+ dai_link->stream_name, ret);
+- return ret;
++ goto err;
+ }
+
+- return snd_soc_pcm_dai_new(rtd);
++ ret = snd_soc_pcm_dai_new(rtd);
++ if (ret < 0)
++ goto err;
++
++ rtd->initialized = true;
++
++ return 0;
++err:
++ snd_soc_link_exit(rtd);
++ return ret;
+ }
+
+ static void soc_set_name_prefix(struct snd_soc_card *card,
+@@ -1892,7 +1901,8 @@ static void soc_cleanup_card_resources(struct snd_soc_card *card)
+
+ /* release machine specific resources */
+ for_each_card_rtds(card, rtd)
+- snd_soc_link_exit(rtd);
++ if (rtd->initialized)
++ snd_soc_link_exit(rtd);
+ /* remove and free each DAI */
+ soc_remove_link_dais(card);
+ soc_remove_link_components(card);
+--
+2.42.0
+
--- /dev/null
+From 68c5025828ef8487924e379abe0e702ce0ddf54c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Oct 2023 10:12:58 +0800
+Subject: ASoC: da7219: Correct the process of setting up Gnd switch in AAD
+
+From: David Rau <David.Rau.opensource@dm.renesas.com>
+
+[ Upstream commit e8ecffd9962fe051d53a0761921b26d653b3df6b ]
+
+Enable Gnd switch to improve stability when Jack insert event
+occurs, and then disable Gnd switch after Jack type detection
+is finished.
+
+Signed-off-by: David Rau <David.Rau.opensource@dm.renesas.com>
+Link: https://lore.kernel.org/r/20231017021258.5929-1-David.Rau.opensource@dm.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/da7219-aad.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
+index 581b334a6631d..3bbe850916493 100644
+--- a/sound/soc/codecs/da7219-aad.c
++++ b/sound/soc/codecs/da7219-aad.c
+@@ -59,9 +59,6 @@ static void da7219_aad_btn_det_work(struct work_struct *work)
+ bool micbias_up = false;
+ int retries = 0;
+
+- /* Disable ground switch */
+- snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00);
+-
+ /* Drive headphones/lineout */
+ snd_soc_component_update_bits(component, DA7219_HP_L_CTRL,
+ DA7219_HP_L_AMP_OE_MASK,
+@@ -155,9 +152,6 @@ static void da7219_aad_hptest_work(struct work_struct *work)
+ tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ_INT_OSC);
+ }
+
+- /* Disable ground switch */
+- snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00);
+-
+ /* Ensure gain ramping at fastest rate */
+ gain_ramp_ctrl = snd_soc_component_read(component, DA7219_GAIN_RAMP_CTRL);
+ snd_soc_component_write(component, DA7219_GAIN_RAMP_CTRL, DA7219_GAIN_RAMP_RATE_X8);
+@@ -421,6 +415,11 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data)
+ * handle a removal, and we can check at the end of
+ * hptest if we have a valid result or not.
+ */
++
++ cancel_delayed_work_sync(&da7219_aad->jack_det_work);
++ /* Disable ground switch */
++ snd_soc_component_update_bits(component, 0xFB, 0x01, 0x00);
++
+ if (statusa & DA7219_JACK_TYPE_STS_MASK) {
+ report |= SND_JACK_HEADSET;
+ mask |= SND_JACK_HEADSET | SND_JACK_LINEOUT;
+--
+2.42.0
+
--- /dev/null
+From 3061dd5006a1f535cd75db15947628e9b592cd42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 17:43:12 +0800
+Subject: ASoC: fsl-asoc-card: use integer type for fll_id and pll_id
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 2b21207afd06714986a3d22442ed4860ba4f9ced ]
+
+As the pll_id and pll_id can be zero (WM8960_SYSCLK_AUTO)
+with the commit 2bbc2df46e67 ("ASoC: wm8960: Make automatic the
+default clocking mode")
+
+Then the machine driver will skip to call set_sysclk() and set_pll()
+for codec, when the sysclk rate is different with what wm8960 read
+at probe, the output sound frequency is wrong.
+
+So change the fll_id and pll_id initial value, still keep machine
+driver's behavior same as before.
+
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Link: https://lore.kernel.org/r/1695202992-24864-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/fsl-asoc-card.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
+index 76b5bfc288fde..bab7d34cf585b 100644
+--- a/sound/soc/fsl/fsl-asoc-card.c
++++ b/sound/soc/fsl/fsl-asoc-card.c
+@@ -52,8 +52,8 @@ struct codec_priv {
+ unsigned long mclk_freq;
+ unsigned long free_freq;
+ u32 mclk_id;
+- u32 fll_id;
+- u32 pll_id;
++ int fll_id;
++ int pll_id;
+ };
+
+ /**
+@@ -206,7 +206,7 @@ static int fsl_asoc_card_hw_params(struct snd_pcm_substream *substream,
+ }
+
+ /* Specific configuration for PLL */
+- if (codec_priv->pll_id && codec_priv->fll_id) {
++ if (codec_priv->pll_id >= 0 && codec_priv->fll_id >= 0) {
+ if (priv->sample_format == SNDRV_PCM_FORMAT_S24_LE)
+ pll_out = priv->sample_rate * 384;
+ else
+@@ -248,7 +248,7 @@ static int fsl_asoc_card_hw_free(struct snd_pcm_substream *substream)
+
+ priv->streams &= ~BIT(substream->stream);
+
+- if (!priv->streams && codec_priv->pll_id && codec_priv->fll_id) {
++ if (!priv->streams && codec_priv->pll_id >= 0 && codec_priv->fll_id >= 0) {
+ /* Force freq to be free_freq to avoid error message in codec */
+ ret = snd_soc_dai_set_sysclk(asoc_rtd_to_codec(rtd, 0),
+ codec_priv->mclk_id,
+@@ -621,6 +621,10 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
+ priv->card.dapm_routes = audio_map;
+ priv->card.num_dapm_routes = ARRAY_SIZE(audio_map);
+ priv->card.driver_name = DRIVER_NAME;
++
++ priv->codec_priv.fll_id = -1;
++ priv->codec_priv.pll_id = -1;
++
+ /* Diversify the card configurations */
+ if (of_device_is_compatible(np, "fsl,imx-audio-cs42888")) {
+ codec_dai_name = "cs42888";
+--
+2.42.0
+
--- /dev/null
+From 23682fd35ee3d94ed6163c37c5144f2fa2d110cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 17:21:25 +0800
+Subject: ASoC: Intel: sof_sdw: add support for SKU 0B14
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit fb0b8d299781be8d46b3612aa96cef28da0d93f4 ]
+
+One more missing SKU in the list.
+
+Closes: https://github.com/thesofproject/linux/issues/4543
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Chao Song <chao.song@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20230919092125.1922468-1-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index 93544eac23ad8..a23a7a1a35815 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -366,6 +366,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ /* No Jack */
+ .driver_data = (void *)SOF_SDW_TGL_HDMI,
+ },
++ {
++ .callback = sof_sdw_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0B14"),
++ },
++ /* No Jack */
++ .driver_data = (void *)SOF_SDW_TGL_HDMI,
++ },
++
+ {
+ .callback = sof_sdw_quirk_cb,
+ .matches = {
+--
+2.42.0
+
--- /dev/null
+From 6624ea7402de0174e8061821fde0cf024c4a9041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 17:45:25 +0800
+Subject: ASoC: rt5650: fix the wrong result of key button
+
+From: Shuming Fan <shumingf@realtek.com>
+
+[ Upstream commit f88dfbf333b3661faff996bb03af2024d907b76a ]
+
+The RT5650 should enable a power setting for button detection to avoid the wrong result.
+
+Signed-off-by: Shuming Fan <shumingf@realtek.com>
+Link: https://lore.kernel.org/r/20231013094525.715518-1-shumingf@realtek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index a506d940a2ead..fae04e9fae4e7 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3251,6 +3251,8 @@ int rt5645_set_jack_detect(struct snd_soc_component *component,
+ RT5645_GP1_PIN_IRQ, RT5645_GP1_PIN_IRQ);
+ regmap_update_bits(rt5645->regmap, RT5645_GEN_CTRL1,
+ RT5645_DIG_GATE_CTRL, RT5645_DIG_GATE_CTRL);
++ regmap_update_bits(rt5645->regmap, RT5645_DEPOP_M1,
++ RT5645_HP_CB_MASK, RT5645_HP_CB_PU);
+ }
+ rt5645_irq(0, rt5645);
+
+--
+2.42.0
+
--- /dev/null
+From ea21fe04c6aa1d561440eaf93fa2ea7bb46fb52c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 05:34:18 +0000
+Subject: ASoC: simple-card: fixup asoc_simple_probe() error handling
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 41bae58df411f9accf01ea660730649b2fab1dab ]
+
+asoc_simple_probe() is used for both "DT probe" (A) and "platform probe"
+(B). It uses "goto err" when error case, but it is not needed for
+"platform probe" case (B). Thus it is using "return" directly there.
+
+ static int asoc_simple_probe(...)
+ {
+ ^ if (...) {
+ | ...
+(A) if (ret < 0)
+ | goto err;
+ v } else {
+ ^ ...
+ | if (ret < 0)
+(B) return -Exxx;
+ v }
+
+ ...
+ ^ if (ret < 0)
+(C) goto err;
+ v ...
+
+ err:
+(D) simple_util_clean_reference(card);
+
+ return ret;
+ }
+
+Both case are using (C) part, and it calls (D) when err case.
+But (D) will do nothing for (B) case.
+Because of these behavior, current code itself is not wrong,
+but is confusable, and more, static analyzing tool will warning on
+(B) part (should use goto err).
+
+To avoid static analyzing tool warning, this patch uses "goto err"
+on (B) part.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87o7hy7mlh.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 0745bf6a09aa0..5005d3c9c659a 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -701,10 +701,12 @@ static int asoc_simple_probe(struct platform_device *pdev)
+ struct snd_soc_dai_link *dai_link = priv->dai_link;
+ struct simple_dai_props *dai_props = priv->dai_props;
+
++ ret = -EINVAL;
++
+ cinfo = dev->platform_data;
+ if (!cinfo) {
+ dev_err(dev, "no info for asoc-simple-card\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ if (!cinfo->name ||
+@@ -713,7 +715,7 @@ static int asoc_simple_probe(struct platform_device *pdev)
+ !cinfo->platform ||
+ !cinfo->cpu_dai.name) {
+ dev_err(dev, "insufficient asoc_simple_card_info settings\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ cpus = dai_link->cpus;
+--
+2.42.0
+
--- /dev/null
+From a301b1d65da72d622a01add8b7faea81d6e7d75a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 17:57:09 +0200
+Subject: ASoC: soc-dapm: Add helper for comparing widget name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 76aca10ccb7c23a7b7a0d56e0bfde2c8cdddfe24 ]
+
+Some drivers use one event callback for multiple widgets but still need
+to perform a bit different actions based on actual widget. This is done
+by comparing widget name, however drivers tend to miss possible name
+prefix. Add a helper to solve common mistakes.
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20231003155710.821315-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/soc-dapm.h | 1 +
+ sound/soc/soc-component.c | 1 +
+ sound/soc/soc-dapm.c | 12 ++++++++++++
+ 3 files changed, 14 insertions(+)
+
+diff --git a/include/sound/soc-dapm.h b/include/sound/soc-dapm.h
+index 87f8e1793af15..295d63437e4d8 100644
+--- a/include/sound/soc-dapm.h
++++ b/include/sound/soc-dapm.h
+@@ -423,6 +423,7 @@ void snd_soc_dapm_connect_dai_link_widgets(struct snd_soc_card *card);
+
+ int snd_soc_dapm_update_dai(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params, struct snd_soc_dai *dai);
++int snd_soc_dapm_widget_name_cmp(struct snd_soc_dapm_widget *widget, const char *s);
+
+ /* dapm path setup */
+ int snd_soc_dapm_new_widgets(struct snd_soc_card *card);
+diff --git a/sound/soc/soc-component.c b/sound/soc/soc-component.c
+index 4356cc320fea0..10b5fe5a3af85 100644
+--- a/sound/soc/soc-component.c
++++ b/sound/soc/soc-component.c
+@@ -242,6 +242,7 @@ int snd_soc_component_notify_control(struct snd_soc_component *component,
+ char name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN];
+ struct snd_kcontrol *kctl;
+
++ /* When updating, change also snd_soc_dapm_widget_name_cmp() */
+ if (component->name_prefix)
+ snprintf(name, ARRAY_SIZE(name), "%s %s", component->name_prefix, ctl);
+ else
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 3091e8160bad7..5fd32185fe63d 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2726,6 +2726,18 @@ int snd_soc_dapm_update_dai(struct snd_pcm_substream *substream,
+ }
+ EXPORT_SYMBOL_GPL(snd_soc_dapm_update_dai);
+
++int snd_soc_dapm_widget_name_cmp(struct snd_soc_dapm_widget *widget, const char *s)
++{
++ struct snd_soc_component *component = snd_soc_dapm_to_component(widget->dapm);
++ const char *wname = widget->name;
++
++ if (component->name_prefix)
++ wname += strlen(component->name_prefix) + 1; /* plus space */
++
++ return strcmp(wname, s);
++}
++EXPORT_SYMBOL_GPL(snd_soc_dapm_widget_name_cmp);
++
+ /*
+ * dapm_update_widget_flags() - Re-compute widget sink and source flags
+ * @w: The widget for which to update the flags
+--
+2.42.0
+
--- /dev/null
+From 26328dbc0b85a128a5ed9a2764ffab4a59e03a65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 15:01:17 +0200
+Subject: ASoC: tlv320adc3xxx: BUG: Correct micbias setting
+
+From: Antoine Gennart <gennartan@disroot.org>
+
+[ Upstream commit e930bea4124b8a4a47ba4092d99da30099b9242d ]
+
+The micbias setting for tlv320adc can also have the value '3' which
+means that the micbias ouput pin is connected to the input pin AVDD.
+
+Signed-off-by: Antoine Gennart <gennartan@disroot.org>
+Link: https://lore.kernel.org/r/20230929130117.77661-1-gennartan@disroot.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tlv320adc3xxx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/tlv320adc3xxx.c b/sound/soc/codecs/tlv320adc3xxx.c
+index b976c1946286a..420bbf588efea 100644
+--- a/sound/soc/codecs/tlv320adc3xxx.c
++++ b/sound/soc/codecs/tlv320adc3xxx.c
+@@ -293,7 +293,7 @@
+ #define ADC3XXX_BYPASS_RPGA 0x80
+
+ /* MICBIAS control bits */
+-#define ADC3XXX_MICBIAS_MASK 0x2
++#define ADC3XXX_MICBIAS_MASK 0x3
+ #define ADC3XXX_MICBIAS1_SHIFT 5
+ #define ADC3XXX_MICBIAS2_SHIFT 3
+
+@@ -1099,7 +1099,7 @@ static int adc3xxx_parse_dt_micbias(struct adc3xxx *adc3xxx,
+ unsigned int val;
+
+ if (!of_property_read_u32(np, propname, &val)) {
+- if (val >= ADC3XXX_MICBIAS_AVDD) {
++ if (val > ADC3XXX_MICBIAS_AVDD) {
+ dev_err(dev, "Invalid property value for '%s'\n", propname);
+ return -EINVAL;
+ }
+--
+2.42.0
+
--- /dev/null
+From c80c03f958f4425cb838f330ecf7daf6f4e67fc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 22:55:58 +0200
+Subject: ata: pata_parport: add custom version of wait_after_reset
+
+From: Ondrej Zary <linux@zary.sk>
+
+[ Upstream commit f343e578fef99a69b3322aca38b94a6d8ded2ce7 ]
+
+Some parallel adapters (e.g. EXP Computer MC-1285B EPP Cable) return
+bogus values when there's no master device present. This can cause
+reset to fail, preventing the lone slave device (such as EXP Computer
+CD-865) from working.
+
+Add custom version of wait_after_reset that ignores master failure when
+a slave device is present. The custom version is also needed because
+the generic ata_sff_wait_after_reset uses direct port I/O for slave
+device detection.
+
+Signed-off-by: Ondrej Zary <linux@zary.sk>
+Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_parport/pata_parport.c | 68 ++++++++++++++++++++++++-
+ 1 file changed, 67 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/pata_parport/pata_parport.c b/drivers/ata/pata_parport/pata_parport.c
+index cf87bbb52f1ff..a7adfdcb5e27c 100644
+--- a/drivers/ata/pata_parport/pata_parport.c
++++ b/drivers/ata/pata_parport/pata_parport.c
+@@ -80,6 +80,72 @@ static bool pata_parport_devchk(struct ata_port *ap, unsigned int device)
+ return (nsect == 0x55) && (lbal == 0xaa);
+ }
+
++static int pata_parport_wait_after_reset(struct ata_link *link,
++ unsigned int devmask,
++ unsigned long deadline)
++{
++ struct ata_port *ap = link->ap;
++ struct pi_adapter *pi = ap->host->private_data;
++ unsigned int dev0 = devmask & (1 << 0);
++ unsigned int dev1 = devmask & (1 << 1);
++ int rc, ret = 0;
++
++ ata_msleep(ap, ATA_WAIT_AFTER_RESET);
++
++ /* always check readiness of the master device */
++ rc = ata_sff_wait_ready(link, deadline);
++ if (rc) {
++ /*
++ * some adapters return bogus values if master device is not
++ * present, so don't abort now if a slave device is present
++ */
++ if (!dev1)
++ return rc;
++ ret = -ENODEV;
++ }
++
++ /*
++ * if device 1 was found in ata_devchk, wait for register
++ * access briefly, then wait for BSY to clear.
++ */
++ if (dev1) {
++ int i;
++
++ pata_parport_dev_select(ap, 1);
++
++ /*
++ * Wait for register access. Some ATAPI devices fail
++ * to set nsect/lbal after reset, so don't waste too
++ * much time on it. We're gonna wait for !BSY anyway.
++ */
++ for (i = 0; i < 2; i++) {
++ u8 nsect, lbal;
++
++ nsect = pi->proto->read_regr(pi, 0, ATA_REG_NSECT);
++ lbal = pi->proto->read_regr(pi, 0, ATA_REG_LBAL);
++ if (nsect == 1 && lbal == 1)
++ break;
++ /* give drive a breather */
++ ata_msleep(ap, 50);
++ }
++
++ rc = ata_sff_wait_ready(link, deadline);
++ if (rc) {
++ if (rc != -ENODEV)
++ return rc;
++ ret = rc;
++ }
++ }
++
++ pata_parport_dev_select(ap, 0);
++ if (dev1)
++ pata_parport_dev_select(ap, 1);
++ if (dev0)
++ pata_parport_dev_select(ap, 0);
++
++ return ret;
++}
++
+ static int pata_parport_bus_softreset(struct ata_port *ap, unsigned int devmask,
+ unsigned long deadline)
+ {
+@@ -94,7 +160,7 @@ static int pata_parport_bus_softreset(struct ata_port *ap, unsigned int devmask,
+ ap->last_ctl = ap->ctl;
+
+ /* wait the port to become ready */
+- return ata_sff_wait_after_reset(&ap->link, devmask, deadline);
++ return pata_parport_wait_after_reset(&ap->link, devmask, deadline);
+ }
+
+ static int pata_parport_softreset(struct ata_link *link, unsigned int *classes,
+--
+2.42.0
+
--- /dev/null
+From d64cb4e7b6d5a15a48a2737d1427736de467c4aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 22:55:59 +0200
+Subject: ata: pata_parport: fit3: implement IDE command set registers
+
+From: Ondrej Zary <linux@zary.sk>
+
+[ Upstream commit 0c1e81d0b5ebd5813536dd5fcf5966ad043f37dc ]
+
+fit3 protocol driver does not support accessing IDE control registers
+(device control/altstatus). The DOS driver does not use these registers
+either (as observed from DOSEMU trace). But the HW seems to be capable
+of accessing these registers - I simply tried bit 3 and it works!
+
+The control register is required to properly reset ATAPI devices or
+they will be detected only once (after a power cycle).
+
+Tested with EXP Computer CD-865 with MC-1285B EPP cable and
+TransDisk 3000.
+
+Signed-off-by: Ondrej Zary <linux@zary.sk>
+Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_parport/fit3.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/ata/pata_parport/fit3.c b/drivers/ata/pata_parport/fit3.c
+index bad7aa920cdca..d2b81cf2e16d2 100644
+--- a/drivers/ata/pata_parport/fit3.c
++++ b/drivers/ata/pata_parport/fit3.c
+@@ -9,11 +9,6 @@
+ *
+ * The TD-2000 and certain older devices use a different protocol.
+ * Try the fit2 protocol module with them.
+- *
+- * NB: The FIT adapters do not appear to support the control
+- * registers. So, we map ALT_STATUS to STATUS and NO-OP writes
+- * to the device control register - this means that IDE reset
+- * will not work on these devices.
+ */
+
+ #include <linux/module.h>
+@@ -37,8 +32,7 @@
+
+ static void fit3_write_regr(struct pi_adapter *pi, int cont, int regr, int val)
+ {
+- if (cont == 1)
+- return;
++ regr += cont << 3;
+
+ switch (pi->mode) {
+ case 0:
+@@ -59,11 +53,7 @@ static int fit3_read_regr(struct pi_adapter *pi, int cont, int regr)
+ {
+ int a, b;
+
+- if (cont) {
+- if (regr != 6)
+- return 0xff;
+- regr = 7;
+- }
++ regr += cont << 3;
+
+ switch (pi->mode) {
+ case 0:
+--
+2.42.0
+
--- /dev/null
+From cb94b7a07daea7500b80262ca4798e12182ad8b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jul 2023 19:24:58 +0800
+Subject: can: flexcan: remove the auto stop mode for IMX93
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+[ Upstream commit 63ead535570f13d0e06fda3f2d020c8f5394e998 ]
+
+IMX93 A0 chip involve the internal q-channel handshake in LPCG and
+CCM to automatically handle the Flex-CAN IPG STOP signal. Only after
+FLEX-CAN enter stop mode then can support the self-wakeup feature.
+But meet issue when do the continue system PM stress test. When config
+the CAN as wakeup source, the first time after system suspend, any data
+on CAN bus can wakeup the system, this is as expect. But the second time
+when system suspend, data on CAN bus can't wakeup the system. If continue
+this test, we find in odd time system enter suspend, CAN can wakeup the
+system, but in even number system enter suspend, CAN can't wakeup the
+system. IC find a bug in the auto stop mode logic, and can't fix it easily.
+So for the new imx93 A1, IC drop the auto stop mode and involve the
+GPR to support stop mode (used before). IC define a bit in GPR which can
+trigger the IPG STOP signal to Flex-CAN, let it go into stop mode.
+And NXP claim to drop IMX93 A0, and only support IMX93 A1. So this patch
+remove the auto stop mode, and add flag FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR
+to imx93.
+
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Link: https://lore.kernel.org/all/20230726112458.3524165-2-haibo.chen@nxp.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan/flexcan-core.c | 46 ++++++++------------------
+ drivers/net/can/flexcan/flexcan.h | 2 --
+ 2 files changed, 13 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/net/can/flexcan/flexcan-core.c b/drivers/net/can/flexcan/flexcan-core.c
+index ff0fc18baf133..d8be69f4a0c3f 100644
+--- a/drivers/net/can/flexcan/flexcan-core.c
++++ b/drivers/net/can/flexcan/flexcan-core.c
+@@ -348,7 +348,7 @@ static struct flexcan_devtype_data fsl_imx8mp_devtype_data = {
+ static struct flexcan_devtype_data fsl_imx93_devtype_data = {
+ .quirks = FLEXCAN_QUIRK_DISABLE_RXFG | FLEXCAN_QUIRK_ENABLE_EACEN_RRS |
+ FLEXCAN_QUIRK_DISABLE_MECR | FLEXCAN_QUIRK_USE_RX_MAILBOX |
+- FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_AUTO_STOP_MODE |
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE | FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR |
+ FLEXCAN_QUIRK_SUPPORT_FD | FLEXCAN_QUIRK_SUPPORT_ECC |
+ FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX |
+ FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX_RTR,
+@@ -544,11 +544,6 @@ static inline int flexcan_enter_stop_mode(struct flexcan_priv *priv)
+ } else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR) {
+ regmap_update_bits(priv->stm.gpr, priv->stm.req_gpr,
+ 1 << priv->stm.req_bit, 1 << priv->stm.req_bit);
+- } else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE) {
+- /* For the auto stop mode, software do nothing, hardware will cover
+- * all the operation automatically after system go into low power mode.
+- */
+- return 0;
+ }
+
+ return flexcan_low_power_enter_ack(priv);
+@@ -574,12 +569,6 @@ static inline int flexcan_exit_stop_mode(struct flexcan_priv *priv)
+ reg_mcr &= ~FLEXCAN_MCR_SLF_WAK;
+ priv->write(reg_mcr, ®s->mcr);
+
+- /* For the auto stop mode, hardware will exist stop mode
+- * automatically after system go out of low power mode.
+- */
+- if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)
+- return 0;
+-
+ return flexcan_low_power_exit_ack(priv);
+ }
+
+@@ -1994,13 +1983,18 @@ static int flexcan_setup_stop_mode(struct platform_device *pdev)
+ ret = flexcan_setup_stop_mode_scfw(pdev);
+ else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_SETUP_STOP_MODE_GPR)
+ ret = flexcan_setup_stop_mode_gpr(pdev);
+- else if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)
+- ret = 0;
+ else
+ /* return 0 directly if doesn't support stop mode feature */
+ return 0;
+
+- if (ret)
++ /* If ret is -EINVAL, this means SoC claim to support stop mode, but
++ * dts file lack the stop mode property definition. For this case,
++ * directly return 0, this will skip the wakeup capable setting and
++ * will not block the driver probe.
++ */
++ if (ret == -EINVAL)
++ return 0;
++ else if (ret)
+ return ret;
+
+ device_set_wakeup_capable(&pdev->dev, true);
+@@ -2320,16 +2314,8 @@ static int __maybe_unused flexcan_noirq_suspend(struct device *device)
+ if (netif_running(dev)) {
+ int err;
+
+- if (device_may_wakeup(device)) {
++ if (device_may_wakeup(device))
+ flexcan_enable_wakeup_irq(priv, true);
+- /* For auto stop mode, need to keep the clock on before
+- * system go into low power mode. After system go into
+- * low power mode, hardware will config the flexcan into
+- * stop mode, and gate off the clock automatically.
+- */
+- if (priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)
+- return 0;
+- }
+
+ err = pm_runtime_force_suspend(device);
+ if (err)
+@@ -2347,15 +2333,9 @@ static int __maybe_unused flexcan_noirq_resume(struct device *device)
+ if (netif_running(dev)) {
+ int err;
+
+- /* For the wakeup in auto stop mode, no need to gate on the
+- * clock here, hardware will do this automatically.
+- */
+- if (!(device_may_wakeup(device) &&
+- priv->devtype_data.quirks & FLEXCAN_QUIRK_AUTO_STOP_MODE)) {
+- err = pm_runtime_force_resume(device);
+- if (err)
+- return err;
+- }
++ err = pm_runtime_force_resume(device);
++ if (err)
++ return err;
+
+ if (device_may_wakeup(device))
+ flexcan_enable_wakeup_irq(priv, false);
+diff --git a/drivers/net/can/flexcan/flexcan.h b/drivers/net/can/flexcan/flexcan.h
+index 91402977780b2..025c3417031f4 100644
+--- a/drivers/net/can/flexcan/flexcan.h
++++ b/drivers/net/can/flexcan/flexcan.h
+@@ -68,8 +68,6 @@
+ #define FLEXCAN_QUIRK_SUPPORT_RX_MAILBOX_RTR BIT(15)
+ /* Device supports RX via FIFO */
+ #define FLEXCAN_QUIRK_SUPPORT_RX_FIFO BIT(16)
+-/* auto enter stop mode to support wakeup */
+-#define FLEXCAN_QUIRK_AUTO_STOP_MODE BIT(17)
+
+ struct flexcan_devtype_data {
+ u32 quirks; /* quirks needed for different IP cores */
+--
+2.42.0
+
--- /dev/null
+From fc414d2438746e88eb7b261438b008eb0b1d4547 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Sep 2023 21:55:29 -0400
+Subject: ceph_wait_on_conflict_unlink(): grab reference before dropping
+ ->d_lock
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit dc32464a5fe4946fe1a4d8f8e29961dc411933c5 ]
+
+Use of dget() after we'd dropped ->d_lock is too late - dentry might
+be gone by that point.
+
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 4b0ba067e9c93..e40aafbfa7b9f 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -709,8 +709,8 @@ int ceph_wait_on_conflict_unlink(struct dentry *dentry)
+ if (!d_same_name(udentry, pdentry, &dname))
+ goto next;
+
++ found = dget_dlock(udentry);
+ spin_unlock(&udentry->d_lock);
+- found = dget(udentry);
+ break;
+ next:
+ spin_unlock(&udentry->d_lock);
+--
+2.42.0
+
--- /dev/null
+From ed9003b5d1f85089dcfb76495c97f960f1ccf5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Aug 2023 17:19:51 +0100
+Subject: coresight: tmc-etr: Disable warnings for allocation failures
+
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+
+[ Upstream commit e5028011885a85032aa3c1b7e3e493bcdacb4a0a ]
+
+Running the following command on Juno triggers the warning:
+
+ $ perf record -e cs_etm// -m ,128M ...
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 412 at mm/page_alloc.c:4453 __alloc_pages+0x334/0x1420
+ CPU: 1 PID: 412 Comm: perf Not tainted 6.5.0-rc3+ #181
+ Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019
+ pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : __alloc_pages+0x334/0x1420
+ lr : dma_common_alloc_pages+0x108/0x138
+ sp : ffffffc087fb7440
+ x29: ffffffc087fb7440 x28: 0000000000000000 x27: ffffffc07e48fba0
+ x26: 0000000000000001 x25: 000000000000000f x24: ffffffc081f24880
+ x23: 0000000000000cc0 x22: ffffff88012b6f08 x21: 0000000008000000
+ x20: ffffff8801433000 x19: 0000000000000000 x18: 0000000000000000
+ x17: ffffffc080316e5c x16: ffffffc07e46406c x15: ffffffc0803af580
+ x14: ffffffc08036b460 x13: ffffffc080025cbc x12: ffffffb8108c3fc4
+ x11: 1ffffff8108c3fc3 x10: 1ffffff810ff6eac x9 : 00000000f204f204
+ x8 : 000000000000f204 x7 : 00000000f2f2f2f2 x6 : 00000000f3f3f3f3
+ x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000
+ x2 : 0000000000000cc0 x1 : 0000000000000000 x0 : ffffffc085333000
+ Call trace:
+ __alloc_pages+0x334/0x1420
+ dma_common_alloc_pages+0x108/0x138
+ __dma_alloc_pages+0xf4/0x108
+ dma_alloc_pages+0x18/0x30
+ tmc_etr_alloc_flat_buf+0xa0/0x190 [coresight_tmc]
+ tmc_alloc_etr_buf.constprop.0+0x124/0x298 [coresight_tmc]
+ alloc_etr_buf.constprop.0.isra.0+0x88/0xc8 [coresight_tmc]
+ tmc_alloc_etr_buffer+0x164/0x2f0 [coresight_tmc]
+ etm_setup_aux+0x32c/0x520 [coresight]
+ rb_alloc_aux+0x29c/0x3f8
+ perf_mmap+0x59c/0xce0
+ mmap_region+0x340/0x10e0
+ do_mmap+0x48c/0x580
+ vm_mmap_pgoff+0x160/0x248
+ ksys_mmap_pgoff+0x1e8/0x278
+ __arm64_sys_mmap+0x8c/0xb8
+
+With the flat mode, we only attempt to allocate large memory if there is an IOMMU
+connected to the ETR. If the allocation fails, we always have a fallback path
+and return an error if nothing else worked. So, suppress the warning for flat
+mode allocations.
+
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Anshuman Khandual <anshuman.khandual@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Reviewed-by: James Clark <james.clark@arm.com>
+Link: https://lore.kernel.org/r/20230817161951.658534-1-suzuki.poulose@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-tmc-etr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+index 6132c5b3db9c7..8311e1028ddb0 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
++++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
+@@ -610,7 +610,8 @@ static int tmc_etr_alloc_flat_buf(struct tmc_drvdata *drvdata,
+
+ flat_buf->vaddr = dma_alloc_noncoherent(real_dev, etr_buf->size,
+ &flat_buf->daddr,
+- DMA_FROM_DEVICE, GFP_KERNEL);
++ DMA_FROM_DEVICE,
++ GFP_KERNEL | __GFP_NOWARN);
+ if (!flat_buf->vaddr) {
+ kfree(flat_buf);
+ return -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From 56fc96a24de70a8b9547d37c37b05f5a536ecffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 22:28:35 +0800
+Subject: dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 0618c077a8c20e8c81e367988f70f7e32bb5a717 ]
+
+The pm_runtime_enable will increase power disable depth. Thus
+a pairing decrement is needed on the error handling path to
+keep it balanced according to context.
+We fix it by calling pm_runtime_disable when error returns.
+
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/tencent_DD2D371DB5925B4B602B1E1D0A5FA88F1208@qq.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ste_dma40.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index 89e82508c1339..002833fb1fa04 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -3668,6 +3668,7 @@ static int __init d40_probe(struct platform_device *pdev)
+ regulator_disable(base->lcpa_regulator);
+ regulator_put(base->lcpa_regulator);
+ }
++ pm_runtime_disable(base->dev);
+
+ report_failure:
+ d40_err(dev, "probe failed\n");
+--
+2.42.0
+
--- /dev/null
+From 161079adb724f8c0f7ed8eccc4c8cef79ada073d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jul 2023 15:28:52 -0400
+Subject: drm/amdgpu: Reserve fences for VM update
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 316baf09d355aec1179981b6dfe28eba50c5ee5b ]
+
+In amdgpu_dma_buf_move_notify reserve fences for the page table updates
+in amdgpu_vm_clear_freed and amdgpu_vm_handle_moved. This fixes a BUG_ON
+in dma_resv_add_fence when using SDMA for page table updates.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+index 12210598e5b8e..ba3a87cb88ccc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+@@ -403,7 +403,10 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach)
+ continue;
+ }
+
+- r = amdgpu_vm_clear_freed(adev, vm, NULL);
++ /* Reserve fences for two SDMA page table updates */
++ r = dma_resv_reserve_fences(resv, 2);
++ if (!r)
++ r = amdgpu_vm_clear_freed(adev, vm, NULL);
+ if (!r)
+ r = amdgpu_vm_handle_moved(adev, vm);
+
+--
+2.42.0
+
--- /dev/null
+From a19d91fcd68f2d002bd23d269aeaa48f31671133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 22:24:39 -0400
+Subject: drm/amdgpu: Unset context priority is now invalid
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit eab0261967aeab528db4d0a51806df8209aec179 ]
+
+A context priority value of AMD_CTX_PRIORITY_UNSET is now invalid--instead of
+carrying it around and passing it to the Direct Rendering Manager--and it
+becomes AMD_CTX_PRIORITY_NORMAL in amdgpu_ctx_ioctl(), the gateway to context
+creation.
+
+Cc: Alex Deucher <Alexander.Deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alex Deucher <Alexander.Deucher@amd.com>
+Link: https://lore.kernel.org/r/20231017035656.8211-1-luben.tuikov@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index 0dc9c655c4fbd..092962b93064f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -47,7 +47,6 @@ const unsigned int amdgpu_ctx_num_entities[AMDGPU_HW_IP_NUM] = {
+ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
+ {
+ switch (ctx_prio) {
+- case AMDGPU_CTX_PRIORITY_UNSET:
+ case AMDGPU_CTX_PRIORITY_VERY_LOW:
+ case AMDGPU_CTX_PRIORITY_LOW:
+ case AMDGPU_CTX_PRIORITY_NORMAL:
+@@ -55,6 +54,7 @@ bool amdgpu_ctx_priority_is_valid(int32_t ctx_prio)
+ case AMDGPU_CTX_PRIORITY_VERY_HIGH:
+ return true;
+ default:
++ case AMDGPU_CTX_PRIORITY_UNSET:
+ return false;
+ }
+ }
+--
+2.42.0
+
--- /dev/null
+From 47ce6d6686107472d6a36ab1ae35e9468a2e04f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 14:15:25 +0200
+Subject: drm/ttm: Reorder sys manager cleanup step
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Karolina Stolarek <karolina.stolarek@intel.com>
+
+[ Upstream commit 3b401e30c249849d803de6c332dad2a595a58658 ]
+
+With the current cleanup flow, we could trigger a NULL pointer
+dereference if there is a delayed destruction of a BO with a
+system resource that gets executed on drain_workqueue() call,
+as we attempt to free a resource using an already released
+resource manager.
+
+Remove the device from the device list and drain its workqueue
+before releasing the system domain manager in ttm_device_fini().
+
+Signed-off-by: Karolina Stolarek <karolina.stolarek@intel.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231016121525.2237838-1-karolina.stolarek@intel.com
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ttm/ttm_device.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
+index 7726a72befc54..d48b39132b324 100644
+--- a/drivers/gpu/drm/ttm/ttm_device.c
++++ b/drivers/gpu/drm/ttm/ttm_device.c
+@@ -232,10 +232,6 @@ void ttm_device_fini(struct ttm_device *bdev)
+ struct ttm_resource_manager *man;
+ unsigned i;
+
+- man = ttm_manager_type(bdev, TTM_PL_SYSTEM);
+- ttm_resource_manager_set_used(man, false);
+- ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL);
+-
+ mutex_lock(&ttm_global_mutex);
+ list_del(&bdev->device_list);
+ mutex_unlock(&ttm_global_mutex);
+@@ -243,6 +239,10 @@ void ttm_device_fini(struct ttm_device *bdev)
+ drain_workqueue(bdev->wq);
+ destroy_workqueue(bdev->wq);
+
++ man = ttm_manager_type(bdev, TTM_PL_SYSTEM);
++ ttm_resource_manager_set_used(man, false);
++ ttm_set_driver_manager(bdev, TTM_PL_SYSTEM, NULL);
++
+ spin_lock(&bdev->lru_lock);
+ for (i = 0; i < TTM_MAX_BO_PRIORITY; ++i)
+ if (list_empty(&man->lru[0]))
+--
+2.42.0
+
--- /dev/null
+From b03703eb68a6e37c412c75f46be7b6500b310b0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 22:26:33 +0800
+Subject: efi: fix memory leak in krealloc failure handling
+
+From: Kuan-Wei Chiu <visitorckw@gmail.com>
+
+[ Upstream commit 0d3ad1917996839a5042d18f04e41915cfa1b74a ]
+
+In the previous code, there was a memory leak issue where the
+previously allocated memory was not freed upon a failed krealloc
+operation. This patch addresses the problem by releasing the old memory
+before setting the pointer to NULL in case of a krealloc failure. This
+ensures that memory is properly managed and avoids potential memory
+leaks.
+
+Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/efi.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index 1599f11768426..9cfac61812f68 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -273,9 +273,13 @@ static __init int efivar_ssdt_load(void)
+ if (status == EFI_NOT_FOUND) {
+ break;
+ } else if (status == EFI_BUFFER_TOO_SMALL) {
+- name = krealloc(name, name_size, GFP_KERNEL);
+- if (!name)
++ efi_char16_t *name_tmp =
++ krealloc(name, name_size, GFP_KERNEL);
++ if (!name_tmp) {
++ kfree(name);
+ return -ENOMEM;
++ }
++ name = name_tmp;
+ continue;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From a9eba8873f1fb9ea9fe899002389cb3f061e8fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Sep 2023 19:04:21 +0800
+Subject: fbdev: atyfb: only use ioremap_uc() on i386 and ia64
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c1a8d1d0edb71dec15c9649cb56866c71c1ecd9e ]
+
+ioremap_uc() is only meaningful on old x86-32 systems with the PAT
+extension, and on ia64 with its slightly unconventional ioremap()
+behavior, everywhere else this is the same as ioremap() anyway.
+
+Change the only driver that still references ioremap_uc() to only do so
+on x86-32/ia64 in order to allow removing that interface at some
+point in the future for the other architectures.
+
+On some architectures, ioremap_uc() just returns NULL, changing
+the driver to call ioremap() means that they now have a chance
+of working correctly.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Baoquan He <bhe@redhat.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/aty/atyfb_base.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c
+index cba2b113b28b0..a73114c1c6918 100644
+--- a/drivers/video/fbdev/aty/atyfb_base.c
++++ b/drivers/video/fbdev/aty/atyfb_base.c
+@@ -3440,11 +3440,15 @@ static int atyfb_setup_generic(struct pci_dev *pdev, struct fb_info *info,
+ }
+
+ info->fix.mmio_start = raddr;
++#if defined(__i386__) || defined(__ia64__)
+ /*
+ * By using strong UC we force the MTRR to never have an
+ * effect on the MMIO region on both non-PAT and PAT systems.
+ */
+ par->ati_regbase = ioremap_uc(info->fix.mmio_start, 0x1000);
++#else
++ par->ati_regbase = ioremap(info->fix.mmio_start, 0x1000);
++#endif
+ if (par->ati_regbase == NULL)
+ return -ENOMEM;
+
+--
+2.42.0
+
--- /dev/null
+From 83b68ce4e8910173563c1dac7ecfaa7b791ebca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 14:19:52 +0300
+Subject: fbdev: omapfb: fix some error codes
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit dc608db793731426938baa2f0e75a4a3cce5f5cf ]
+
+Return negative -ENXIO instead of positive ENXIO.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap/omapfb_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c
+index ad65554b33c35..0be95b4e14fdb 100644
+--- a/drivers/video/fbdev/omap/omapfb_main.c
++++ b/drivers/video/fbdev/omap/omapfb_main.c
+@@ -1648,13 +1648,13 @@ static int omapfb_do_probe(struct platform_device *pdev,
+ }
+ fbdev->int_irq = platform_get_irq(pdev, 0);
+ if (fbdev->int_irq < 0) {
+- r = ENXIO;
++ r = -ENXIO;
+ goto cleanup;
+ }
+
+ fbdev->ext_irq = platform_get_irq(pdev, 1);
+ if (fbdev->ext_irq < 0) {
+- r = ENXIO;
++ r = -ENXIO;
+ goto cleanup;
+ }
+
+--
+2.42.0
+
--- /dev/null
+From f9beb6a7a9e9c794e15554fd8633fca3b0d31951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 17:43:47 -0300
+Subject: fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
+
+From: Jorge Maidana <jorgem.linux@gmail.com>
+
+[ Upstream commit 1022e7e2f40574c74ed32c3811b03d26b0b81daf ]
+
+Delete the v86d netlink only after all the VBE tasks have been
+completed.
+
+Fixes initial state restore on module unload:
+uvesafb: VBE state restore call failed (eax=0x4f04, err=-19)
+
+Signed-off-by: Jorge Maidana <jorgem.linux@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/uvesafb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c
+index 78d85dae8ec80..c4559768f00f6 100644
+--- a/drivers/video/fbdev/uvesafb.c
++++ b/drivers/video/fbdev/uvesafb.c
+@@ -1931,10 +1931,10 @@ static void uvesafb_exit(void)
+ }
+ }
+
+- cn_del_callback(&uvesafb_cn_id);
+ driver_remove_file(&uvesafb_driver.driver, &driver_attr_v86d);
+ platform_device_unregister(uvesafb_device);
+ platform_driver_unregister(&uvesafb_driver);
++ cn_del_callback(&uvesafb_cn_id);
+ }
+
+ module_exit(uvesafb_exit);
+--
+2.42.0
+
--- /dev/null
+From 6035640d6bdf6e8f5914961b0ca102f30d4ede2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 15:52:19 +0400
+Subject: fs/ntfs3: Add ckeck in ni_update_parent()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 87d1888aa40f25773fa0b948bcb2545f97e2cb15 ]
+
+Check simple case when parent inode equals current inode.
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index 16bd9faa2d28b..8f34d6472ddbd 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -3208,6 +3208,12 @@ static bool ni_update_parent(struct ntfs_inode *ni, struct NTFS_DUP_INFO *dup,
+ if (!fname || !memcmp(&fname->dup, dup, sizeof(fname->dup)))
+ continue;
+
++ /* Check simple case when parent inode equals current inode. */
++ if (ino_get(&fname->home) == ni->vfs_inode.i_ino) {
++ ntfs_set_state(sbi, NTFS_DIRTY_ERROR);
++ continue;
++ }
++
+ /* ntfs_iget5 may sleep. */
+ dir = ntfs_iget5(sb, &fname->home, NULL);
+ if (IS_ERR(dir)) {
+--
+2.42.0
+
--- /dev/null
+From 6a08e600137d172981a5b7f22eef96e3bf4defb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 16:17:02 +0400
+Subject: fs/ntfs3: Add more attributes checks in mi_enum_attr()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 013ff63b649475f0ee134e2c8d0c8e65284ede50 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/record.c | 68 ++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 52 insertions(+), 16 deletions(-)
+
+diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c
+index c12ebffc94da4..02cc91ed88357 100644
+--- a/fs/ntfs3/record.c
++++ b/fs/ntfs3/record.c
+@@ -193,8 +193,9 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+ {
+ const struct MFT_REC *rec = mi->mrec;
+ u32 used = le32_to_cpu(rec->used);
+- u32 t32, off, asize;
++ u32 t32, off, asize, prev_type;
+ u16 t16;
++ u64 data_size, alloc_size, tot_size;
+
+ if (!attr) {
+ u32 total = le32_to_cpu(rec->total);
+@@ -213,6 +214,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+ if (!is_rec_inuse(rec))
+ return NULL;
+
++ prev_type = 0;
+ attr = Add2Ptr(rec, off);
+ } else {
+ /* Check if input attr inside record. */
+@@ -226,11 +228,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+ return NULL;
+ }
+
+- if (off + asize < off) {
+- /* Overflow check. */
++ /* Overflow check. */
++ if (off + asize < off)
+ return NULL;
+- }
+
++ prev_type = le32_to_cpu(attr->type);
+ attr = Add2Ptr(attr, asize);
+ off += asize;
+ }
+@@ -250,7 +252,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+
+ /* 0x100 is last known attribute for now. */
+ t32 = le32_to_cpu(attr->type);
+- if ((t32 & 0xf) || (t32 > 0x100))
++ if (!t32 || (t32 & 0xf) || (t32 > 0x100))
++ return NULL;
++
++ /* attributes in record must be ordered by type */
++ if (t32 < prev_type)
+ return NULL;
+
+ /* Check overflow and boundary. */
+@@ -259,16 +265,15 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+
+ /* Check size of attribute. */
+ if (!attr->non_res) {
++ /* Check resident fields. */
+ if (asize < SIZEOF_RESIDENT)
+ return NULL;
+
+ t16 = le16_to_cpu(attr->res.data_off);
+-
+ if (t16 > asize)
+ return NULL;
+
+- t32 = le32_to_cpu(attr->res.data_size);
+- if (t16 + t32 > asize)
++ if (t16 + le32_to_cpu(attr->res.data_size) > asize)
+ return NULL;
+
+ t32 = sizeof(short) * attr->name_len;
+@@ -278,21 +283,52 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr)
+ return attr;
+ }
+
+- /* Check some nonresident fields. */
+- if (attr->name_len &&
+- le16_to_cpu(attr->name_off) + sizeof(short) * attr->name_len >
+- le16_to_cpu(attr->nres.run_off)) {
++ /* Check nonresident fields. */
++ if (attr->non_res != 1)
++ return NULL;
++
++ t16 = le16_to_cpu(attr->nres.run_off);
++ if (t16 > asize)
++ return NULL;
++
++ t32 = sizeof(short) * attr->name_len;
++ if (t32 && le16_to_cpu(attr->name_off) + t32 > t16)
++ return NULL;
++
++ /* Check start/end vcn. */
++ if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1)
++ return NULL;
++
++ data_size = le64_to_cpu(attr->nres.data_size);
++ if (le64_to_cpu(attr->nres.valid_size) > data_size)
+ return NULL;
+- }
+
+- if (attr->nres.svcn || !is_attr_ext(attr)) {
++ alloc_size = le64_to_cpu(attr->nres.alloc_size);
++ if (data_size > alloc_size)
++ return NULL;
++
++ t32 = mi->sbi->cluster_mask;
++ if (alloc_size & t32)
++ return NULL;
++
++ if (!attr->nres.svcn && is_attr_ext(attr)) {
++ /* First segment of sparse/compressed attribute */
++ if (asize + 8 < SIZEOF_NONRESIDENT_EX)
++ return NULL;
++
++ tot_size = le64_to_cpu(attr->nres.total_size);
++ if (tot_size & t32)
++ return NULL;
++
++ if (tot_size > alloc_size)
++ return NULL;
++ } else {
+ if (asize + 8 < SIZEOF_NONRESIDENT)
+ return NULL;
+
+ if (attr->nres.c_unit)
+ return NULL;
+- } else if (asize + 8 < SIZEOF_NONRESIDENT_EX)
+- return NULL;
++ }
+
+ return attr;
+ }
+--
+2.42.0
+
--- /dev/null
+From ded7ca210b52a536338a974f843504a2bfb109ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 10:54:07 +0300
+Subject: fs/ntfs3: Add more info into /proc/fs/ntfs3/<dev>/volinfo
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit d27e202b9ac416e52093edf8789614d93dbd6231 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/super.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index 9124d74ea676b..d699819c70a14 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -453,15 +453,23 @@ static struct proc_dir_entry *proc_info_root;
+ * ntfs3.1
+ * cluster size
+ * number of clusters
++ * total number of mft records
++ * number of used mft records ~= number of files + folders
++ * real state of ntfs "dirty"/"clean"
++ * current state of ntfs "dirty"/"clean"
+ */
+ static int ntfs3_volinfo(struct seq_file *m, void *o)
+ {
+ struct super_block *sb = m->private;
+ struct ntfs_sb_info *sbi = sb->s_fs_info;
+
+- seq_printf(m, "ntfs%d.%d\n%u\n%zu\n", sbi->volume.major_ver,
+- sbi->volume.minor_ver, sbi->cluster_size,
+- sbi->used.bitmap.nbits);
++ seq_printf(m, "ntfs%d.%d\n%u\n%zu\n\%zu\n%zu\n%s\n%s\n",
++ sbi->volume.major_ver, sbi->volume.minor_ver,
++ sbi->cluster_size, sbi->used.bitmap.nbits,
++ sbi->mft.bitmap.nbits,
++ sbi->mft.bitmap.nbits - wnd_zeroes(&sbi->mft.bitmap),
++ sbi->volume.real_dirty ? "dirty" : "clean",
++ (sbi->volume.flags & VOLUME_FLAG_DIRTY) ? "dirty" : "clean");
+
+ return 0;
+ }
+--
+2.42.0
+
--- /dev/null
+From a182ef4f1b9d3c41917dc7ea5488a83f1e70812e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 12:48:07 +0800
+Subject: fs/ntfs3: Avoid possible memory leak
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit e4494770a5cad3c9d1d2a65ed15d07656c0d9b82 ]
+
+smatch warn:
+fs/ntfs3/fslog.c:2172 last_log_lsn() warn: possible memory leak of 'page_bufs'
+Jump to label 'out' to free 'page_bufs' and is more consistent with
+other code.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fslog.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c
+index 12f28cdf5c838..98ccb66508583 100644
+--- a/fs/ntfs3/fslog.c
++++ b/fs/ntfs3/fslog.c
+@@ -2168,8 +2168,10 @@ static int last_log_lsn(struct ntfs_log *log)
+
+ if (!page) {
+ page = kmalloc(log->page_size, GFP_NOFS);
+- if (!page)
+- return -ENOMEM;
++ if (!page) {
++ err = -ENOMEM;
++ goto out;
++ }
+ }
+
+ /*
+--
+2.42.0
+
--- /dev/null
+From 1fa262012ef0df005e1082fbd81e7104432ed736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 10:56:15 +0300
+Subject: fs/ntfs3: Do not allow to change label if volume is read-only
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit e52dce610a2d53bf2b5e94a8843c71cb73a91ea5 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/super.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index d699819c70a14..32c5de5699929 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -498,7 +498,12 @@ static ssize_t ntfs3_label_write(struct file *file, const char __user *buffer,
+ struct super_block *sb = pde_data(file_inode(file));
+ struct ntfs_sb_info *sbi = sb->s_fs_info;
+ ssize_t ret = count;
+- u8 *label = kmalloc(count, GFP_NOFS);
++ u8 *label;
++
++ if (sb_rdonly(sb))
++ return -EROFS;
++
++ label = kmalloc(count, GFP_NOFS);
+
+ if (!label)
+ return -ENOMEM;
+--
+2.42.0
+
--- /dev/null
+From a8afe472f0ef5529982eed5769902cad08830409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 13:12:11 +0300
+Subject: fs/ntfs3: Fix alternative boot searching
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit dcc852e509a4cba0ac6ac734077cef260e4e0fe6 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/super.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index bcb17a1723465..9124d74ea676b 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -838,7 +838,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ struct ntfs_sb_info *sbi = sb->s_fs_info;
+ int err;
+ u32 mb, gb, boot_sector_size, sct_per_clst, record_size;
+- u64 sectors, clusters, mlcn, mlcn2;
++ u64 sectors, clusters, mlcn, mlcn2, dev_size0;
+ struct NTFS_BOOT *boot;
+ struct buffer_head *bh;
+ struct MFT_REC *rec;
+@@ -847,6 +847,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ u32 boot_off = 0;
+ const char *hint = "Primary boot";
+
++ /* Save original dev_size. Used with alternative boot. */
++ dev_size0 = dev_size;
++
+ sbi->volume.blocks = dev_size >> PAGE_SHIFT;
+
+ bh = ntfs_bread(sb, 0);
+@@ -1084,9 +1087,9 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+ }
+
+ out:
+- if (err == -EINVAL && !bh->b_blocknr && dev_size > PAGE_SHIFT) {
++ if (err == -EINVAL && !bh->b_blocknr && dev_size0 > PAGE_SHIFT) {
+ u32 block_size = min_t(u32, sector_size, PAGE_SIZE);
+- u64 lbo = dev_size - sizeof(*boot);
++ u64 lbo = dev_size0 - sizeof(*boot);
+
+ /*
+ * Try alternative boot (last sector)
+@@ -1100,6 +1103,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,
+
+ boot_off = lbo & (block_size - 1);
+ hint = "Alternative boot";
++ dev_size = dev_size0; /* restore original size. */
+ goto check_boot;
+ }
+ brelse(bh);
+--
+2.42.0
+
--- /dev/null
+From cef686905c1307b6d0193ba2bc11d251e82032eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 21:50:32 -0700
+Subject: fs/ntfs3: Fix directory element type detection
+
+From: Gabriel Marcano <gabemarcano@yahoo.com>
+
+[ Upstream commit 85a4780dc96ed9dd643bbadf236552b3320fae26 ]
+
+Calling stat() from userspace correctly identified junctions in an NTFS
+partition as symlinks, but using readdir() and iterating through the
+directory containing the same junction did not identify the junction
+as a symlink.
+
+When emitting directory contents, check FILE_ATTRIBUTE_REPARSE_POINT
+attribute to detect junctions and report them as links.
+
+Signed-off-by: Gabriel Marcano <gabemarcano@yahoo.com>
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/dir.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
+index 063a6654199bc..ec0566b322d5d 100644
+--- a/fs/ntfs3/dir.c
++++ b/fs/ntfs3/dir.c
+@@ -309,7 +309,11 @@ static inline int ntfs_filldir(struct ntfs_sb_info *sbi, struct ntfs_inode *ni,
+ return 0;
+ }
+
+- dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
++ /* NTFS: symlinks are "dir + reparse" or "file + reparse" */
++ if (fname->dup.fa & FILE_ATTRIBUTE_REPARSE_POINT)
++ dt_type = DT_LNK;
++ else
++ dt_type = (fname->dup.fa & FILE_ATTRIBUTE_DIRECTORY) ? DT_DIR : DT_REG;
+
+ return !dir_emit(ctx, (s8 *)name, name_len, ino, dt_type);
+ }
+--
+2.42.0
+
--- /dev/null
+From 754890c5d464d686722c051cbbd70c849a93b425 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 11:28:11 +0300
+Subject: fs/ntfs3: Fix NULL pointer dereference on error in
+ attr_allocate_frame()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 9c689c8dc86f8ca99bf91c05f24c8bab38fe7d5f ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrib.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c
+index a9d82bbb4729e..0b52bc9681085 100644
+--- a/fs/ntfs3/attrib.c
++++ b/fs/ntfs3/attrib.c
+@@ -1736,10 +1736,8 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size,
+ le_b = NULL;
+ attr_b = ni_find_attr(ni, NULL, &le_b, ATTR_DATA, NULL,
+ 0, NULL, &mi_b);
+- if (!attr_b) {
+- err = -ENOENT;
+- goto out;
+- }
++ if (!attr_b)
++ return -ENOENT;
+
+ attr = attr_b;
+ le = le_b;
+--
+2.42.0
+
--- /dev/null
+From 252fc9734eb77947243a701d441831f3522df159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Sep 2023 11:19:08 +0300
+Subject: fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 32e9212256b88f35466642f9c939bb40cfb2c2de ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/frecord.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c
+index 8f34d6472ddbd..05fb3dbe39076 100644
+--- a/fs/ntfs3/frecord.c
++++ b/fs/ntfs3/frecord.c
+@@ -2148,7 +2148,7 @@ int ni_readpage_cmpr(struct ntfs_inode *ni, struct page *page)
+
+ for (i = 0; i < pages_per_frame; i++) {
+ pg = pages[i];
+- if (i == idx)
++ if (i == idx || !pg)
+ continue;
+ unlock_page(pg);
+ put_page(pg);
+--
+2.42.0
+
--- /dev/null
+From 313e441f5949eecea6f9e69a4b2c6845ccaaee38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 16:12:58 +0400
+Subject: fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit fc471e39e38fea6677017cbdd6d928088a59fc67 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/attrlist.c | 15 +++++++++++++--
+ fs/ntfs3/bitmap.c | 3 ++-
+ fs/ntfs3/super.c | 2 +-
+ 3 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ntfs3/attrlist.c b/fs/ntfs3/attrlist.c
+index 42631b31adf17..7c01735d1219d 100644
+--- a/fs/ntfs3/attrlist.c
++++ b/fs/ntfs3/attrlist.c
+@@ -52,7 +52,8 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+
+ if (!attr->non_res) {
+ lsize = le32_to_cpu(attr->res.data_size);
+- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN);
++ /* attr is resident: lsize < record_size (1K or 4K) */
++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+ err = -ENOMEM;
+ goto out;
+@@ -80,7 +81,17 @@ int ntfs_load_attr_list(struct ntfs_inode *ni, struct ATTRIB *attr)
+ if (err < 0)
+ goto out;
+
+- le = kmalloc(al_aligned(lsize), GFP_NOFS | __GFP_NOWARN);
++ /* attr is nonresident.
++ * The worst case:
++ * 1T (2^40) extremely fragmented file.
++ * cluster = 4K (2^12) => 2^28 fragments
++ * 2^9 fragments per one record => 2^19 records
++ * 2^5 bytes of ATTR_LIST_ENTRY per one record => 2^24 bytes.
++ *
++ * the result is 16M bytes per attribute list.
++ * Use kvmalloc to allocate in range [several Kbytes - dozen Mbytes]
++ */
++ le = kvmalloc(al_aligned(lsize), GFP_KERNEL);
+ if (!le) {
+ err = -ENOMEM;
+ goto out;
+diff --git a/fs/ntfs3/bitmap.c b/fs/ntfs3/bitmap.c
+index 107e808e06eae..d66055e30aff9 100644
+--- a/fs/ntfs3/bitmap.c
++++ b/fs/ntfs3/bitmap.c
+@@ -659,7 +659,8 @@ int wnd_init(struct wnd_bitmap *wnd, struct super_block *sb, size_t nbits)
+ wnd->bits_last = wbits;
+
+ wnd->free_bits =
+- kcalloc(wnd->nwnd, sizeof(u16), GFP_NOFS | __GFP_NOWARN);
++ kvmalloc_array(wnd->nwnd, sizeof(u16), GFP_KERNEL | __GFP_ZERO);
++
+ if (!wnd->free_bits)
+ return -ENOMEM;
+
+diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
+index d6b5170253a69..bcb17a1723465 100644
+--- a/fs/ntfs3/super.c
++++ b/fs/ntfs3/super.c
+@@ -1388,7 +1388,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)
+ }
+
+ bytes = inode->i_size;
+- sbi->def_table = t = kmalloc(bytes, GFP_NOFS | __GFP_NOWARN);
++ sbi->def_table = t = kvmalloc(bytes, GFP_KERNEL);
+ if (!t) {
+ err = -ENOMEM;
+ goto put_inode_out;
+--
+2.42.0
+
--- /dev/null
+From 68176d4f8b6c21174e0cab5f3c7e3c707a4dbb4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 15:57:19 +0400
+Subject: fs/ntfs3: Write immediately updated ntfs state
+
+From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+
+[ Upstream commit 06ccfb00645990a9fcc14249e6d1c25921ecb836 ]
+
+Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ntfs3/fsntfs.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ntfs3/fsntfs.c b/fs/ntfs3/fsntfs.c
+index 9ddb2ab23b954..fbfe21dbb4259 100644
+--- a/fs/ntfs3/fsntfs.c
++++ b/fs/ntfs3/fsntfs.c
+@@ -983,18 +983,11 @@ int ntfs_set_state(struct ntfs_sb_info *sbi, enum NTFS_DIRTY_FLAGS dirty)
+ if (err)
+ return err;
+
+- mark_inode_dirty(&ni->vfs_inode);
++ mark_inode_dirty_sync(&ni->vfs_inode);
+ /* verify(!ntfs_update_mftmirr()); */
+
+- /*
+- * If we used wait=1, sync_inode_metadata waits for the io for the
+- * inode to finish. It hangs when media is removed.
+- * So wait=0 is sent down to sync_inode_metadata
+- * and filemap_fdatawrite is used for the data blocks.
+- */
+- err = sync_inode_metadata(&ni->vfs_inode, 0);
+- if (!err)
+- err = filemap_fdatawrite(ni->vfs_inode.i_mapping);
++ /* write mft record on disk. */
++ err = _ni_write_inode(&ni->vfs_inode, 1);
+
+ return err;
+ }
+--
+2.42.0
+
--- /dev/null
+From d9bcf22d72c63cd767cd6013a55225b58f971546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 22:48:56 -0400
+Subject: gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luben Tuikov <luben.tuikov@amd.com>
+
+[ Upstream commit fa8391ad68c16716e2c06ada397e99ceed2fb647 ]
+
+Eliminate DRM_SCHED_PRIORITY_UNSET, value of -2, whose only user was
+amdgpu. Furthermore, eliminate an index bug, in that when amdgpu boots, it
+calls drm_sched_entity_init() with DRM_SCHED_PRIORITY_UNSET, which uses it to
+index sched->sched_rq[].
+
+Cc: Alex Deucher <Alexander.Deucher@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
+Acked-by: Alex Deucher <Alexander.Deucher@amd.com>
+Link: https://lore.kernel.org/r/20231017035656.8211-2-luben.tuikov@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 ++-
+ include/drm/gpu_scheduler.h | 3 +--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index 092962b93064f..aac52d9754e6d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -64,7 +64,8 @@ amdgpu_ctx_to_drm_sched_prio(int32_t ctx_prio)
+ {
+ switch (ctx_prio) {
+ case AMDGPU_CTX_PRIORITY_UNSET:
+- return DRM_SCHED_PRIORITY_UNSET;
++ pr_warn_once("AMD-->DRM context priority value UNSET-->NORMAL");
++ return DRM_SCHED_PRIORITY_NORMAL;
+
+ case AMDGPU_CTX_PRIORITY_VERY_LOW:
+ return DRM_SCHED_PRIORITY_MIN;
+diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
+index f9544d9b670d3..ac65f0626cfc9 100644
+--- a/include/drm/gpu_scheduler.h
++++ b/include/drm/gpu_scheduler.h
+@@ -68,8 +68,7 @@ enum drm_sched_priority {
+ DRM_SCHED_PRIORITY_HIGH,
+ DRM_SCHED_PRIORITY_KERNEL,
+
+- DRM_SCHED_PRIORITY_COUNT,
+- DRM_SCHED_PRIORITY_UNSET = -2
++ DRM_SCHED_PRIORITY_COUNT
+ };
+
+ /* Used to chose between FIFO and RR jobs scheduling */
+--
+2.42.0
+
--- /dev/null
+From ec817059f9ec49000f74b8fd217120ca8b86757f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 17:29:57 -0700
+Subject: Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 5030b2fe6aab37fe42d14f31842ea38be7c55c57 ]
+
+Touch controllers need some time after receiving reset command for the
+firmware to finish re-initializing and be ready to respond to commands
+from the host. The driver already had handling for the post-reset delay
+for I2C and SPI transports, this change adds the handling to
+SMBus-connected devices.
+
+SMBus devices are peculiar because they implement legacy PS/2
+compatibility mode, so reset is actually issued by psmouse driver on the
+associated serio port, after which the control is passed to the RMI4
+driver with SMBus companion device.
+
+Note that originally the delay was added to psmouse driver in
+92e24e0e57f7 ("Input: psmouse - add delay when deactivating for SMBus
+mode"), but that resulted in an unwanted delay in "fast" reconnect
+handler for the serio port, so it was decided to revert the patch and
+have the delay being handled in the RMI4 driver, similar to the other
+transports.
+
+Tested-by: Jeffery Miller <jefferymiller@google.com>
+Link: https://lore.kernel.org/r/ZR1yUFJ8a9Zt606N@penguin
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ drivers/input/rmi4/rmi_smbus.c | 50 ++++++++++++++++++---------------
+ 2 files changed, 29 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index cefc74b3b34b1..22d16d80efb93 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1753,6 +1753,7 @@ static int synaptics_create_intertouch(struct psmouse *psmouse,
+ psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids) &&
+ !SYN_CAP_EXT_BUTTONS_STICK(info->ext_cap_10);
+ const struct rmi_device_platform_data pdata = {
++ .reset_delay_ms = 30,
+ .sensor_pdata = {
+ .sensor_type = rmi_sensor_touchpad,
+ .axis_align.flip_y = true,
+diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
+index 7059a2762aebc..b0b099b5528a8 100644
+--- a/drivers/input/rmi4/rmi_smbus.c
++++ b/drivers/input/rmi4/rmi_smbus.c
+@@ -235,12 +235,29 @@ static void rmi_smb_clear_state(struct rmi_smb_xport *rmi_smb)
+
+ static int rmi_smb_enable_smbus_mode(struct rmi_smb_xport *rmi_smb)
+ {
+- int retval;
++ struct i2c_client *client = rmi_smb->client;
++ int smbus_version;
++
++ /*
++ * psmouse driver resets the controller, we only need to wait
++ * to give the firmware chance to fully reinitialize.
++ */
++ if (rmi_smb->xport.pdata.reset_delay_ms)
++ msleep(rmi_smb->xport.pdata.reset_delay_ms);
+
+ /* we need to get the smbus version to activate the touchpad */
+- retval = rmi_smb_get_version(rmi_smb);
+- if (retval < 0)
+- return retval;
++ smbus_version = rmi_smb_get_version(rmi_smb);
++ if (smbus_version < 0)
++ return smbus_version;
++
++ rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
++ smbus_version);
++
++ if (smbus_version != 2 && smbus_version != 3) {
++ dev_err(&client->dev, "Unrecognized SMB version %d\n",
++ smbus_version);
++ return -ENODEV;
++ }
+
+ return 0;
+ }
+@@ -253,11 +270,10 @@ static int rmi_smb_reset(struct rmi_transport_dev *xport, u16 reset_addr)
+ rmi_smb_clear_state(rmi_smb);
+
+ /*
+- * we do not call the actual reset command, it has to be handled in
+- * PS/2 or there will be races between PS/2 and SMBus.
+- * PS/2 should ensure that a psmouse_reset is called before
+- * intializing the device and after it has been removed to be in a known
+- * state.
++ * We do not call the actual reset command, it has to be handled in
++ * PS/2 or there will be races between PS/2 and SMBus. PS/2 should
++ * ensure that a psmouse_reset is called before initializing the
++ * device and after it has been removed to be in a known state.
+ */
+ return rmi_smb_enable_smbus_mode(rmi_smb);
+ }
+@@ -272,7 +288,6 @@ static int rmi_smb_probe(struct i2c_client *client)
+ {
+ struct rmi_device_platform_data *pdata = dev_get_platdata(&client->dev);
+ struct rmi_smb_xport *rmi_smb;
+- int smbus_version;
+ int error;
+
+ if (!pdata) {
+@@ -311,18 +326,9 @@ static int rmi_smb_probe(struct i2c_client *client)
+ rmi_smb->xport.proto_name = "smb";
+ rmi_smb->xport.ops = &rmi_smb_ops;
+
+- smbus_version = rmi_smb_get_version(rmi_smb);
+- if (smbus_version < 0)
+- return smbus_version;
+-
+- rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
+- smbus_version);
+-
+- if (smbus_version != 2 && smbus_version != 3) {
+- dev_err(&client->dev, "Unrecognized SMB version %d\n",
+- smbus_version);
+- return -ENODEV;
+- }
++ error = rmi_smb_enable_smbus_mode(rmi_smb);
++ if (error)
++ return error;
+
+ i2c_set_clientdata(client, rmi_smb);
+
+--
+2.42.0
+
--- /dev/null
+From 3deefa3702639c3bd717ca56fc79b93391e1ca77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Aug 2023 18:47:31 -0400
+Subject: io_uring: kiocb_done() should *not* trust ->ki_pos if
+ ->{read,write}_iter() failed
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 1939316bf988f3e49a07d9c4dd6f660bf4daa53d ]
+
+->ki_pos value is unreliable in such cases. For an obvious example,
+consider O_DSYNC write - we feed the data to page cache and start IO,
+then we make sure it's completed. Update of ->ki_pos is dealt with
+by the first part; failure in the second ends up with negative value
+returned _and_ ->ki_pos left advanced as if sync had been successful.
+In the same situation write(2) does not advance the file position
+at all.
+
+Reviewed-by: Christian Brauner <brauner@kernel.org>
+Reviewed-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/rw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/rw.c b/io_uring/rw.c
+index 1bce2208b65c4..d61620e080d10 100644
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -332,7 +332,7 @@ static int kiocb_done(struct io_kiocb *req, ssize_t ret,
+ struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw);
+ unsigned final_ret = io_fixup_rw_res(req, ret);
+
+- if (req->flags & REQ_F_CUR_POS)
++ if (ret >= 0 && req->flags & REQ_F_CUR_POS)
+ req->file->f_pos = rw->kiocb.ki_pos;
+ if (ret >= 0 && (rw->kiocb.ki_complete == io_complete_rw)) {
+ if (!__io_complete_rw_common(req, ret)) {
+--
+2.42.0
+
--- /dev/null
+From 5c1c46b9ed23f469499b21a5cf1619bade02b4e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 14:59:26 +0200
+Subject: irqchip/gic-v3: Enable non-coherent redistributors/ITSes DT probing
+
+From: Lorenzo Pieralisi <lpieralisi@kernel.org>
+
+[ Upstream commit 3a0fff0fb6a3861fa05416f21858cf0c75cbf944 ]
+
+The GIC architecture specification defines a set of registers
+for redistributors and ITSes that control the sharebility and
+cacheability attributes of redistributors/ITSes initiator ports
+on the interconnect (GICR_[V]PROPBASER, GICR_[V]PENDBASER,
+GITS_BASER<n>).
+
+Architecturally the GIC provides a means to drive shareability
+and cacheability attributes signals and related IWB/OWB/ISH barriers
+but it is not mandatory for designs to wire up the corresponding
+interconnect signals that control the cacheability/shareability
+of transactions.
+
+Redistributors and ITSes interconnect ports can be connected to
+non-coherent interconnects that are not able to manage the
+shareability/cacheability attributes; this implicitly makes
+the redistributors and ITSes non-coherent observers.
+
+So far, the GIC driver on probe executes a write to "probe" for
+the redistributors and ITSes registers shareability bitfields
+by writing a value (ie InnerShareable - the shareability domain the
+CPUs are in) and check it back to detect whether the value sticks or
+not; this hinges on a GIC programming model behaviour that predates the
+current specifications, that just define shareability bits as writeable
+but do not guarantee that writing certain shareability values
+enable the expected behaviour for the redistributors/ITSes
+memory interconnect ports.
+
+To enable non-coherent GIC designs, introduce the "dma-noncoherent"
+device tree property to allow firmware to describe redistributors and
+ITSes as non-coherent observers on the memory interconnect and use the
+property to force the shareability attributes to be programmed into the
+redistributors and ITSes registers through the GIC quirks mechanism.
+
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20231006125929.48591-3-lpieralisi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-common.h | 4 ++++
+ drivers/irqchip/irq-gic-v3-its.c | 21 +++++++++++++++++----
+ drivers/irqchip/irq-gic-v3.c | 13 +++++++++++++
+ 3 files changed, 34 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-common.h b/drivers/irqchip/irq-gic-common.h
+index 3db4592cda1c0..f407cce9ecaaa 100644
+--- a/drivers/irqchip/irq-gic-common.h
++++ b/drivers/irqchip/irq-gic-common.h
+@@ -29,4 +29,8 @@ void gic_enable_quirks(u32 iidr, const struct gic_quirk *quirks,
+ void gic_enable_of_quirks(const struct device_node *np,
+ const struct gic_quirk *quirks, void *data);
+
++#define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0)
++#define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1)
++#define RDIST_FLAGS_FORCE_NON_SHAREABLE (1 << 2)
++
+ #endif /* _IRQ_GIC_COMMON_H */
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 5e57b605b7c61..75a2dd550625b 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -44,10 +44,6 @@
+ #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2)
+ #define ITS_FLAGS_FORCE_NON_SHAREABLE (1ULL << 3)
+
+-#define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0)
+-#define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1)
+-#define RDIST_FLAGS_FORCE_NON_SHAREABLE (1 << 2)
+-
+ #define RD_LOCAL_LPI_ENABLED BIT(0)
+ #define RD_LOCAL_PENDTABLE_PREALLOCATED BIT(1)
+ #define RD_LOCAL_MEMRESERVE_DONE BIT(2)
+@@ -4754,6 +4750,14 @@ static bool __maybe_unused its_enable_rk3588001(void *data)
+ return true;
+ }
+
++static bool its_set_non_coherent(void *data)
++{
++ struct its_node *its = data;
++
++ its->flags |= ITS_FLAGS_FORCE_NON_SHAREABLE;
++ return true;
++}
++
+ static const struct gic_quirk its_quirks[] = {
+ #ifdef CONFIG_CAVIUM_ERRATUM_22375
+ {
+@@ -4808,6 +4812,11 @@ static const struct gic_quirk its_quirks[] = {
+ .init = its_enable_rk3588001,
+ },
+ #endif
++ {
++ .desc = "ITS: non-coherent attribute",
++ .property = "dma-noncoherent",
++ .init = its_set_non_coherent,
++ },
+ {
+ }
+ };
+@@ -4817,6 +4826,10 @@ static void its_enable_quirks(struct its_node *its)
+ u32 iidr = readl_relaxed(its->base + GITS_IIDR);
+
+ gic_enable_quirks(iidr, its_quirks, its);
++
++ if (is_of_node(its->fwnode_handle))
++ gic_enable_of_quirks(to_of_node(its->fwnode_handle),
++ its_quirks, its);
+ }
+
+ static int its_save_disable(void)
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index eedfa8e9f0772..f59ac9586b7b1 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1857,6 +1857,14 @@ static bool gic_enable_quirk_arm64_2941627(void *data)
+ return true;
+ }
+
++static bool rd_set_non_coherent(void *data)
++{
++ struct gic_chip_data *d = data;
++
++ d->rdists.flags |= RDIST_FLAGS_FORCE_NON_SHAREABLE;
++ return true;
++}
++
+ static const struct gic_quirk gic_quirks[] = {
+ {
+ .desc = "GICv3: Qualcomm MSM8996 broken firmware",
+@@ -1923,6 +1931,11 @@ static const struct gic_quirk gic_quirks[] = {
+ .mask = 0xff0f0fff,
+ .init = gic_enable_quirk_arm64_2941627,
+ },
++ {
++ .desc = "GICv3: non-coherent attribute",
++ .property = "dma-noncoherent",
++ .init = rd_set_non_coherent,
++ },
+ {
+ }
+ };
+--
+2.42.0
+
--- /dev/null
+From ee23f0cc29b3721d4b3540d792be83ae1e71031e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Oct 2023 14:59:27 +0200
+Subject: irqchip/gic-v3-its: Split allocation from initialisation of its_node
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 9585a495ac936049dba141e8f9d99159ca06d46a ]
+
+In order to pave the way for more fancy quirk handling without making
+more of a mess of this terrible driver, split the allocation of the
+ITS descriptor (its_node) from the actual probing.
+
+This will allow firmware-specific hooks to be added between these
+two points.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20231006125929.48591-4-lpieralisi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 149 ++++++++++++++++++-------------
+ 1 file changed, 89 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index e0c2b10d154d6..5e57b605b7c61 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -4952,7 +4952,7 @@ static void __init __iomem *its_map_one(struct resource *res, int *err)
+ return NULL;
+ }
+
+-static int its_init_domain(struct fwnode_handle *handle, struct its_node *its)
++static int its_init_domain(struct its_node *its)
+ {
+ struct irq_domain *inner_domain;
+ struct msi_domain_info *info;
+@@ -4966,7 +4966,7 @@ static int its_init_domain(struct fwnode_handle *handle, struct its_node *its)
+
+ inner_domain = irq_domain_create_hierarchy(its_parent,
+ its->msi_domain_flags, 0,
+- handle, &its_domain_ops,
++ its->fwnode_handle, &its_domain_ops,
+ info);
+ if (!inner_domain) {
+ kfree(info);
+@@ -5017,8 +5017,7 @@ static int its_init_vpe_domain(void)
+ return 0;
+ }
+
+-static int __init its_compute_its_list_map(struct resource *res,
+- void __iomem *its_base)
++static int __init its_compute_its_list_map(struct its_node *its)
+ {
+ int its_number;
+ u32 ctlr;
+@@ -5032,15 +5031,15 @@ static int __init its_compute_its_list_map(struct resource *res,
+ its_number = find_first_zero_bit(&its_list_map, GICv4_ITS_LIST_MAX);
+ if (its_number >= GICv4_ITS_LIST_MAX) {
+ pr_err("ITS@%pa: No ITSList entry available!\n",
+- &res->start);
++ &its->phys_base);
+ return -EINVAL;
+ }
+
+- ctlr = readl_relaxed(its_base + GITS_CTLR);
++ ctlr = readl_relaxed(its->base + GITS_CTLR);
+ ctlr &= ~GITS_CTLR_ITS_NUMBER;
+ ctlr |= its_number << GITS_CTLR_ITS_NUMBER_SHIFT;
+- writel_relaxed(ctlr, its_base + GITS_CTLR);
+- ctlr = readl_relaxed(its_base + GITS_CTLR);
++ writel_relaxed(ctlr, its->base + GITS_CTLR);
++ ctlr = readl_relaxed(its->base + GITS_CTLR);
+ if ((ctlr & GITS_CTLR_ITS_NUMBER) != (its_number << GITS_CTLR_ITS_NUMBER_SHIFT)) {
+ its_number = ctlr & GITS_CTLR_ITS_NUMBER;
+ its_number >>= GITS_CTLR_ITS_NUMBER_SHIFT;
+@@ -5048,75 +5047,50 @@ static int __init its_compute_its_list_map(struct resource *res,
+
+ if (test_and_set_bit(its_number, &its_list_map)) {
+ pr_err("ITS@%pa: Duplicate ITSList entry %d\n",
+- &res->start, its_number);
++ &its->phys_base, its_number);
+ return -EINVAL;
+ }
+
+ return its_number;
+ }
+
+-static int __init its_probe_one(struct resource *res,
+- struct fwnode_handle *handle, int numa_node)
++static int __init its_probe_one(struct its_node *its)
+ {
+- struct its_node *its;
+- void __iomem *its_base;
+- u64 baser, tmp, typer;
++ u64 baser, tmp;
+ struct page *page;
+ u32 ctlr;
+ int err;
+
+- its_base = its_map_one(res, &err);
+- if (!its_base)
+- return err;
+-
+- pr_info("ITS %pR\n", res);
+-
+- its = kzalloc(sizeof(*its), GFP_KERNEL);
+- if (!its) {
+- err = -ENOMEM;
+- goto out_unmap;
+- }
+-
+- raw_spin_lock_init(&its->lock);
+- mutex_init(&its->dev_alloc_lock);
+- INIT_LIST_HEAD(&its->entry);
+- INIT_LIST_HEAD(&its->its_device_list);
+- typer = gic_read_typer(its_base + GITS_TYPER);
+- its->typer = typer;
+- its->base = its_base;
+- its->phys_base = res->start;
+ if (is_v4(its)) {
+- if (!(typer & GITS_TYPER_VMOVP)) {
+- err = its_compute_its_list_map(res, its_base);
++ if (!(its->typer & GITS_TYPER_VMOVP)) {
++ err = its_compute_its_list_map(its);
+ if (err < 0)
+- goto out_free_its;
++ goto out;
+
+ its->list_nr = err;
+
+ pr_info("ITS@%pa: Using ITS number %d\n",
+- &res->start, err);
++ &its->phys_base, err);
+ } else {
+- pr_info("ITS@%pa: Single VMOVP capable\n", &res->start);
++ pr_info("ITS@%pa: Single VMOVP capable\n", &its->phys_base);
+ }
+
+ if (is_v4_1(its)) {
+- u32 svpet = FIELD_GET(GITS_TYPER_SVPET, typer);
++ u32 svpet = FIELD_GET(GITS_TYPER_SVPET, its->typer);
+
+- its->sgir_base = ioremap(res->start + SZ_128K, SZ_64K);
++ its->sgir_base = ioremap(its->phys_base + SZ_128K, SZ_64K);
+ if (!its->sgir_base) {
+ err = -ENOMEM;
+- goto out_free_its;
++ goto out;
+ }
+
+- its->mpidr = readl_relaxed(its_base + GITS_MPIDR);
++ its->mpidr = readl_relaxed(its->base + GITS_MPIDR);
+
+ pr_info("ITS@%pa: Using GICv4.1 mode %08x %08x\n",
+- &res->start, its->mpidr, svpet);
++ &its->phys_base, its->mpidr, svpet);
+ }
+ }
+
+- its->numa_node = numa_node;
+-
+ page = alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO,
+ get_order(ITS_CMD_QUEUE_SZ));
+ if (!page) {
+@@ -5125,12 +5099,9 @@ static int __init its_probe_one(struct resource *res,
+ }
+ its->cmd_base = (void *)page_address(page);
+ its->cmd_write = its->cmd_base;
+- its->fwnode_handle = handle;
+ its->get_msi_base = its_irq_get_msi_base;
+ its->msi_domain_flags = IRQ_DOMAIN_FLAG_ISOLATED_MSI;
+
+- its_enable_quirks(its);
+-
+ err = its_alloc_tables(its);
+ if (err)
+ goto out_free_cmd;
+@@ -5174,7 +5145,7 @@ static int __init its_probe_one(struct resource *res,
+ ctlr |= GITS_CTLR_ImDe;
+ writel_relaxed(ctlr, its->base + GITS_CTLR);
+
+- err = its_init_domain(handle, its);
++ err = its_init_domain(its);
+ if (err)
+ goto out_free_tables;
+
+@@ -5191,11 +5162,8 @@ static int __init its_probe_one(struct resource *res,
+ out_unmap_sgir:
+ if (its->sgir_base)
+ iounmap(its->sgir_base);
+-out_free_its:
+- kfree(its);
+-out_unmap:
+- iounmap(its_base);
+- pr_err("ITS@%pa: failed probing (%d)\n", &res->start, err);
++out:
++ pr_err("ITS@%pa: failed probing (%d)\n", &its->phys_base, err);
+ return err;
+ }
+
+@@ -5356,10 +5324,53 @@ static const struct of_device_id its_device_id[] = {
+ {},
+ };
+
++static struct its_node __init *its_node_init(struct resource *res,
++ struct fwnode_handle *handle, int numa_node)
++{
++ void __iomem *its_base;
++ struct its_node *its;
++ int err;
++
++ its_base = its_map_one(res, &err);
++ if (!its_base)
++ return NULL;
++
++ pr_info("ITS %pR\n", res);
++
++ its = kzalloc(sizeof(*its), GFP_KERNEL);
++ if (!its)
++ goto out_unmap;
++
++ raw_spin_lock_init(&its->lock);
++ mutex_init(&its->dev_alloc_lock);
++ INIT_LIST_HEAD(&its->entry);
++ INIT_LIST_HEAD(&its->its_device_list);
++
++ its->typer = gic_read_typer(its_base + GITS_TYPER);
++ its->base = its_base;
++ its->phys_base = res->start;
++
++ its->numa_node = numa_node;
++ its->fwnode_handle = handle;
++
++ return its;
++
++out_unmap:
++ iounmap(its_base);
++ return NULL;
++}
++
++static void its_node_destroy(struct its_node *its)
++{
++ iounmap(its->base);
++ kfree(its);
++}
++
+ static int __init its_of_probe(struct device_node *node)
+ {
+ struct device_node *np;
+ struct resource res;
++ int err;
+
+ /*
+ * Make sure *all* the ITS are reset before we probe any, as
+@@ -5369,8 +5380,6 @@ static int __init its_of_probe(struct device_node *node)
+ */
+ for (np = of_find_matching_node(node, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
+- int err;
+-
+ if (!of_device_is_available(np) ||
+ !of_property_read_bool(np, "msi-controller") ||
+ of_address_to_resource(np, 0, &res))
+@@ -5383,6 +5392,8 @@ static int __init its_of_probe(struct device_node *node)
+
+ for (np = of_find_matching_node(node, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
++ struct its_node *its;
++
+ if (!of_device_is_available(np))
+ continue;
+ if (!of_property_read_bool(np, "msi-controller")) {
+@@ -5396,7 +5407,17 @@ static int __init its_of_probe(struct device_node *node)
+ continue;
+ }
+
+- its_probe_one(&res, &np->fwnode, of_node_to_nid(np));
++
++ its = its_node_init(&res, &np->fwnode, of_node_to_nid(np));
++ if (!its)
++ return -ENOMEM;
++
++ its_enable_quirks(its);
++ err = its_probe_one(its);
++ if (err) {
++ its_node_destroy(its);
++ return err;
++ }
+ }
+ return 0;
+ }
+@@ -5508,6 +5529,7 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
+ {
+ struct acpi_madt_generic_translator *its_entry;
+ struct fwnode_handle *dom_handle;
++ struct its_node *its;
+ struct resource res;
+ int err;
+
+@@ -5532,11 +5554,18 @@ static int __init gic_acpi_parse_madt_its(union acpi_subtable_headers *header,
+ goto dom_err;
+ }
+
+- err = its_probe_one(&res, dom_handle,
+- acpi_get_its_numa_node(its_entry->translation_id));
++ its = its_node_init(&res, dom_handle,
++ acpi_get_its_numa_node(its_entry->translation_id));
++ if (!its) {
++ err = -ENOMEM;
++ goto node_err;
++ }
++
++ err = its_probe_one(its);
+ if (!err)
+ return 0;
+
++node_err:
+ iort_deregister_domain_token(its_entry->translation_id);
+ dom_err:
+ irq_domain_free_fwnode(dom_handle);
+--
+2.42.0
+
--- /dev/null
+From 5688956cfeb9ecd6385b32c1c3c5fcb9386634ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 10:13:51 +0530
+Subject: irqchip/riscv-intc: Mark all INTC nodes as initialized
+
+From: Anup Patel <apatel@ventanamicro.com>
+
+[ Upstream commit e13cd66bd821be417c498a34928652db4ac6b436 ]
+
+The RISC-V INTC local interrupts are per-HART (or per-CPU) so we
+create INTC IRQ domain only for the INTC node belonging to the boot
+HART. This means only the boot HART INTC node will be marked as
+initialized and other INTC nodes won't be marked which results
+downstream interrupt controllers (such as PLIC, IMSIC and APLIC
+direct-mode) not being probed due to missing device suppliers.
+
+To address this issue, we mark all INTC node for which we don't
+create IRQ domain as initialized.
+
+Reported-by: Dmitry Dunaev <dunaev@tecon.ru>
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230926102801.1591126-1-dunaev@tecon.ru
+Link: https://lore.kernel.org/r/20231003044403.1974628-4-apatel@ventanamicro.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-riscv-intc.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-riscv-intc.c b/drivers/irqchip/irq-riscv-intc.c
+index 4adeee1bc391f..e8d01b14ccdde 100644
+--- a/drivers/irqchip/irq-riscv-intc.c
++++ b/drivers/irqchip/irq-riscv-intc.c
+@@ -155,8 +155,16 @@ static int __init riscv_intc_init(struct device_node *node,
+ * for each INTC DT node. We only need to do INTC initialization
+ * for the INTC DT node belonging to boot CPU (or boot HART).
+ */
+- if (riscv_hartid_to_cpuid(hartid) != smp_processor_id())
++ if (riscv_hartid_to_cpuid(hartid) != smp_processor_id()) {
++ /*
++ * The INTC nodes of each CPU are suppliers for downstream
++ * interrupt controllers (such as PLIC, IMSIC and APLIC
++ * direct-mode) so we should mark an INTC node as initialized
++ * if we are not creating IRQ domain for it.
++ */
++ fwnode_dev_initialized(of_fwnode_handle(node), true);
+ return 0;
++ }
+
+ return riscv_intc_init_common(of_node_to_fwnode(node));
+ }
+--
+2.42.0
+
--- /dev/null
+From c01328adaaa06153bec88a54ebe3a519b5b7aded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 12:20:03 -0400
+Subject: irqchip/stm32-exti: add missing DT IRQ flag translation
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit 8554cba1d6dbd3c74e0549e28ddbaccbb1d6b30a ]
+
+The STM32F4/7 EXTI driver was missing the xlate callback, so IRQ trigger
+flags specified in the device tree were being ignored. This was
+preventing the RTC alarm interrupt from working, because it must be set
+to trigger on the rising edge to function correctly.
+
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20231003162003.1649967-1-ben.wolsieffer@hefring.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-stm32-exti.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c
+index b5fa76ce5046a..cb4b195bc849a 100644
+--- a/drivers/irqchip/irq-stm32-exti.c
++++ b/drivers/irqchip/irq-stm32-exti.c
+@@ -459,6 +459,7 @@ static const struct irq_domain_ops irq_exti_domain_ops = {
+ .map = irq_map_generic_chip,
+ .alloc = stm32_exti_alloc,
+ .free = stm32_exti_free,
++ .xlate = irq_domain_xlate_twocell,
+ };
+
+ static void stm32_irq_ack(struct irq_data *d)
+--
+2.42.0
+
--- /dev/null
+From 21b95a718282aa37d187e77b07cb9b409b45202f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Disable WUC for pgprot_writecombine() like ioremap_wc()
+
+From: Icenowy Zheng <uwu@icenowy.me>
+
+[ Upstream commit 278be83601dd1725d4732241f066d528e160a39d ]
+
+Currently the code disables WUC only disables it for ioremap_wc(), which
+is only used when mapping writecombine pages like ioremap() (mapped to
+the kernel space). But for VRAM mapped in TTM/GEM, it is mapped with a
+crafted pgprot by the pgprot_writecombine() function, in which case WUC
+isn't disabled now.
+
+Disable WUC for pgprot_writecombine() (fallback to SUC) if needed, like
+ioremap_wc().
+
+This improves the AMDGPU driver's stability (solves some misrendering)
+on Loongson-3A5000/3A6000 machines.
+
+Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/io.h | 5 ++---
+ arch/loongarch/include/asm/pgtable-bits.h | 4 +++-
+ arch/loongarch/kernel/setup.c | 10 +++++-----
+ 3 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/arch/loongarch/include/asm/io.h b/arch/loongarch/include/asm/io.h
+index 1c94102200407..0355b64e90ed0 100644
+--- a/arch/loongarch/include/asm/io.h
++++ b/arch/loongarch/include/asm/io.h
+@@ -54,10 +54,9 @@ static inline void __iomem *ioremap_prot(phys_addr_t offset, unsigned long size,
+ * @offset: bus address of the memory
+ * @size: size of the resource to map
+ */
+-extern pgprot_t pgprot_wc;
+-
+ #define ioremap_wc(offset, size) \
+- ioremap_prot((offset), (size), pgprot_val(pgprot_wc))
++ ioremap_prot((offset), (size), \
++ pgprot_val(wc_enabled ? PAGE_KERNEL_WUC : PAGE_KERNEL_SUC))
+
+ #define ioremap_cache(offset, size) \
+ ioremap_prot((offset), (size), pgprot_val(PAGE_KERNEL))
+diff --git a/arch/loongarch/include/asm/pgtable-bits.h b/arch/loongarch/include/asm/pgtable-bits.h
+index de46a6b1e9f11..7b9ac012cd090 100644
+--- a/arch/loongarch/include/asm/pgtable-bits.h
++++ b/arch/loongarch/include/asm/pgtable-bits.h
+@@ -105,13 +105,15 @@ static inline pgprot_t pgprot_noncached(pgprot_t _prot)
+ return __pgprot(prot);
+ }
+
++extern bool wc_enabled;
++
+ #define pgprot_writecombine pgprot_writecombine
+
+ static inline pgprot_t pgprot_writecombine(pgprot_t _prot)
+ {
+ unsigned long prot = pgprot_val(_prot);
+
+- prot = (prot & ~_CACHE_MASK) | _CACHE_WUC;
++ prot = (prot & ~_CACHE_MASK) | (wc_enabled ? _CACHE_WUC : _CACHE_SUC);
+
+ return __pgprot(prot);
+ }
+diff --git a/arch/loongarch/kernel/setup.c b/arch/loongarch/kernel/setup.c
+index 9d830ab4e3025..1351614042d4e 100644
+--- a/arch/loongarch/kernel/setup.c
++++ b/arch/loongarch/kernel/setup.c
+@@ -161,19 +161,19 @@ static void __init smbios_parse(void)
+ }
+
+ #ifdef CONFIG_ARCH_WRITECOMBINE
+-pgprot_t pgprot_wc = PAGE_KERNEL_WUC;
++bool wc_enabled = true;
+ #else
+-pgprot_t pgprot_wc = PAGE_KERNEL_SUC;
++bool wc_enabled = false;
+ #endif
+
+-EXPORT_SYMBOL(pgprot_wc);
++EXPORT_SYMBOL(wc_enabled);
+
+ static int __init setup_writecombine(char *p)
+ {
+ if (!strcmp(p, "on"))
+- pgprot_wc = PAGE_KERNEL_WUC;
++ wc_enabled = true;
+ else if (!strcmp(p, "off"))
+- pgprot_wc = PAGE_KERNEL_SUC;
++ wc_enabled = false;
+ else
+ pr_warn("Unknown writecombine setting \"%s\".\n", p);
+
+--
+2.42.0
+
--- /dev/null
+From 4fcc251faea5e9d0e37d7d5c3dbb5d10f15f3699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Export symbol invalid_pud_table for modules building
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 449c2756c2323c9e32b2a2fa9c8b59ce91b5819d ]
+
+Export symbol invalid_pud_table for modules building (such as the KVM
+module) if 4-level page tables enabled. Otherwise we get:
+
+ERROR: modpost: "invalid_pud_table" [arch/loongarch/kvm/kvm.ko] undefined!
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Tianrui Zhao <zhaotianrui@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/init.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
+index 3b7d8129570b8..51c9a6c90a169 100644
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -267,6 +267,7 @@ pgd_t swapper_pg_dir[_PTRS_PER_PGD] __section(".bss..swapper_pg_dir");
+ pgd_t invalid_pg_dir[_PTRS_PER_PGD] __page_aligned_bss;
+ #ifndef __PAGETABLE_PUD_FOLDED
+ pud_t invalid_pud_table[PTRS_PER_PUD] __page_aligned_bss;
++EXPORT_SYMBOL(invalid_pud_table);
+ #endif
+ #ifndef __PAGETABLE_PMD_FOLDED
+ pmd_t invalid_pmd_table[PTRS_PER_PMD] __page_aligned_bss;
+--
+2.42.0
+
--- /dev/null
+From e9d7677426e5504aa74eda40592ef6c90a6dce84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Replace kmap_atomic() with kmap_local_page() in
+ copy_user_highpage()
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 477a0ebec101359f49d92796e3b609857d564b52 ]
+
+Replace kmap_atomic()/kunmap_atomic() calls with kmap_local_page()/
+kunmap_local() in copy_user_highpage() which can be invoked from both
+preemptible and atomic context [1].
+
+[1] https://lore.kernel.org/all/20201029222652.302358281@linutronix.de/
+
+Suggested-by: Deepak R Varma <drv@mailo.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/mm/init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/loongarch/mm/init.c b/arch/loongarch/mm/init.c
+index 51c9a6c90a169..d967d881c3fef 100644
+--- a/arch/loongarch/mm/init.c
++++ b/arch/loongarch/mm/init.c
+@@ -68,11 +68,11 @@ void copy_user_highpage(struct page *to, struct page *from,
+ {
+ void *vfrom, *vto;
+
+- vto = kmap_atomic(to);
+- vfrom = kmap_atomic(from);
++ vfrom = kmap_local_page(from);
++ vto = kmap_local_page(to);
+ copy_page(vto, vfrom);
+- kunmap_atomic(vfrom);
+- kunmap_atomic(vto);
++ kunmap_local(vfrom);
++ kunmap_local(vto);
+ /* Make sure this page is cleared on other CPU's too before using it */
+ smp_wmb();
+ }
+--
+2.42.0
+
--- /dev/null
+From 021faca6a5a990f7706cb37a3402f9b5c5a0e7ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 08:42:52 +0800
+Subject: LoongArch: Use SYM_CODE_* to annotate exception handlers
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 00c2ca84c680f64b79b5e10a482ca435fd7d98ce ]
+
+As described in include/linux/linkage.h,
+
+ FUNC -- C-like functions (proper stack frame etc.)
+ CODE -- non-C code (e.g. irq handlers with different, special stack etc.)
+
+ SYM_FUNC_{START, END} -- use for global functions
+ SYM_CODE_{START, END} -- use for non-C (special) functions
+
+So use SYM_CODE_* to annotate exception handlers.
+
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/include/asm/linkage.h | 8 +++++++
+ arch/loongarch/kernel/entry.S | 4 ++--
+ arch/loongarch/kernel/genex.S | 16 ++++++-------
+ arch/loongarch/mm/tlbex.S | 36 ++++++++++++++--------------
+ 4 files changed, 36 insertions(+), 28 deletions(-)
+
+diff --git a/arch/loongarch/include/asm/linkage.h b/arch/loongarch/include/asm/linkage.h
+index 81b0c4cfbf4f2..e2eca1a25b4ef 100644
+--- a/arch/loongarch/include/asm/linkage.h
++++ b/arch/loongarch/include/asm/linkage.h
+@@ -33,4 +33,12 @@
+ .cfi_endproc; \
+ SYM_END(name, SYM_T_FUNC)
+
++#define SYM_CODE_START(name) \
++ SYM_START(name, SYM_L_GLOBAL, SYM_A_ALIGN) \
++ .cfi_startproc;
++
++#define SYM_CODE_END(name) \
++ .cfi_endproc; \
++ SYM_END(name, SYM_T_NONE)
++
+ #endif
+diff --git a/arch/loongarch/kernel/entry.S b/arch/loongarch/kernel/entry.S
+index d737e3cf42d3f..1781c6a5befa2 100644
+--- a/arch/loongarch/kernel/entry.S
++++ b/arch/loongarch/kernel/entry.S
+@@ -18,7 +18,7 @@
+ .text
+ .cfi_sections .debug_frame
+ .align 5
+-SYM_FUNC_START(handle_syscall)
++SYM_CODE_START(handle_syscall)
+ csrrd t0, PERCPU_BASE_KS
+ la.pcrel t1, kernelsp
+ add.d t1, t1, t0
+@@ -66,7 +66,7 @@ SYM_FUNC_START(handle_syscall)
+ bl do_syscall
+
+ RESTORE_ALL_AND_RET
+-SYM_FUNC_END(handle_syscall)
++SYM_CODE_END(handle_syscall)
+ _ASM_NOKPROBE(handle_syscall)
+
+ SYM_CODE_START(ret_from_fork)
+diff --git a/arch/loongarch/kernel/genex.S b/arch/loongarch/kernel/genex.S
+index 78f0663846575..2bb3aa2dcfcb2 100644
+--- a/arch/loongarch/kernel/genex.S
++++ b/arch/loongarch/kernel/genex.S
+@@ -31,7 +31,7 @@ SYM_FUNC_START(__arch_cpu_idle)
+ 1: jr ra
+ SYM_FUNC_END(__arch_cpu_idle)
+
+-SYM_FUNC_START(handle_vint)
++SYM_CODE_START(handle_vint)
+ BACKUP_T0T1
+ SAVE_ALL
+ la_abs t1, __arch_cpu_idle
+@@ -46,11 +46,11 @@ SYM_FUNC_START(handle_vint)
+ la_abs t0, do_vint
+ jirl ra, t0, 0
+ RESTORE_ALL_AND_RET
+-SYM_FUNC_END(handle_vint)
++SYM_CODE_END(handle_vint)
+
+-SYM_FUNC_START(except_vec_cex)
++SYM_CODE_START(except_vec_cex)
+ b cache_parity_error
+-SYM_FUNC_END(except_vec_cex)
++SYM_CODE_END(except_vec_cex)
+
+ .macro build_prep_badv
+ csrrd t0, LOONGARCH_CSR_BADV
+@@ -66,7 +66,7 @@ SYM_FUNC_END(except_vec_cex)
+
+ .macro BUILD_HANDLER exception handler prep
+ .align 5
+- SYM_FUNC_START(handle_\exception)
++ SYM_CODE_START(handle_\exception)
+ 666:
+ BACKUP_T0T1
+ SAVE_ALL
+@@ -76,7 +76,7 @@ SYM_FUNC_END(except_vec_cex)
+ jirl ra, t0, 0
+ 668:
+ RESTORE_ALL_AND_RET
+- SYM_FUNC_END(handle_\exception)
++ SYM_CODE_END(handle_\exception)
+ SYM_DATA(unwind_hint_\exception, .word 668b - 666b)
+ .endm
+
+@@ -93,7 +93,7 @@ SYM_FUNC_END(except_vec_cex)
+ BUILD_HANDLER watch watch none
+ BUILD_HANDLER reserved reserved none /* others */
+
+-SYM_FUNC_START(handle_sys)
++SYM_CODE_START(handle_sys)
+ la_abs t0, handle_syscall
+ jr t0
+-SYM_FUNC_END(handle_sys)
++SYM_CODE_END(handle_sys)
+diff --git a/arch/loongarch/mm/tlbex.S b/arch/loongarch/mm/tlbex.S
+index ca17dd3a19153..d5d682f3d29f3 100644
+--- a/arch/loongarch/mm/tlbex.S
++++ b/arch/loongarch/mm/tlbex.S
+@@ -17,7 +17,7 @@
+ #define PTRS_PER_PTE_BITS (PAGE_SHIFT - 3)
+
+ .macro tlb_do_page_fault, write
+- SYM_FUNC_START(tlb_do_page_fault_\write)
++ SYM_CODE_START(tlb_do_page_fault_\write)
+ SAVE_ALL
+ csrrd a2, LOONGARCH_CSR_BADV
+ move a0, sp
+@@ -25,13 +25,13 @@
+ li.w a1, \write
+ bl do_page_fault
+ RESTORE_ALL_AND_RET
+- SYM_FUNC_END(tlb_do_page_fault_\write)
++ SYM_CODE_END(tlb_do_page_fault_\write)
+ .endm
+
+ tlb_do_page_fault 0
+ tlb_do_page_fault 1
+
+-SYM_FUNC_START(handle_tlb_protect)
++SYM_CODE_START(handle_tlb_protect)
+ BACKUP_T0T1
+ SAVE_ALL
+ move a0, sp
+@@ -41,9 +41,9 @@ SYM_FUNC_START(handle_tlb_protect)
+ la_abs t0, do_page_fault
+ jirl ra, t0, 0
+ RESTORE_ALL_AND_RET
+-SYM_FUNC_END(handle_tlb_protect)
++SYM_CODE_END(handle_tlb_protect)
+
+-SYM_FUNC_START(handle_tlb_load)
++SYM_CODE_START(handle_tlb_load)
+ csrwr t0, EXCEPTION_KS0
+ csrwr t1, EXCEPTION_KS1
+ csrwr ra, EXCEPTION_KS2
+@@ -187,16 +187,16 @@ nopage_tlb_load:
+ csrrd ra, EXCEPTION_KS2
+ la_abs t0, tlb_do_page_fault_0
+ jr t0
+-SYM_FUNC_END(handle_tlb_load)
++SYM_CODE_END(handle_tlb_load)
+
+-SYM_FUNC_START(handle_tlb_load_ptw)
++SYM_CODE_START(handle_tlb_load_ptw)
+ csrwr t0, LOONGARCH_CSR_KS0
+ csrwr t1, LOONGARCH_CSR_KS1
+ la_abs t0, tlb_do_page_fault_0
+ jr t0
+-SYM_FUNC_END(handle_tlb_load_ptw)
++SYM_CODE_END(handle_tlb_load_ptw)
+
+-SYM_FUNC_START(handle_tlb_store)
++SYM_CODE_START(handle_tlb_store)
+ csrwr t0, EXCEPTION_KS0
+ csrwr t1, EXCEPTION_KS1
+ csrwr ra, EXCEPTION_KS2
+@@ -343,16 +343,16 @@ nopage_tlb_store:
+ csrrd ra, EXCEPTION_KS2
+ la_abs t0, tlb_do_page_fault_1
+ jr t0
+-SYM_FUNC_END(handle_tlb_store)
++SYM_CODE_END(handle_tlb_store)
+
+-SYM_FUNC_START(handle_tlb_store_ptw)
++SYM_CODE_START(handle_tlb_store_ptw)
+ csrwr t0, LOONGARCH_CSR_KS0
+ csrwr t1, LOONGARCH_CSR_KS1
+ la_abs t0, tlb_do_page_fault_1
+ jr t0
+-SYM_FUNC_END(handle_tlb_store_ptw)
++SYM_CODE_END(handle_tlb_store_ptw)
+
+-SYM_FUNC_START(handle_tlb_modify)
++SYM_CODE_START(handle_tlb_modify)
+ csrwr t0, EXCEPTION_KS0
+ csrwr t1, EXCEPTION_KS1
+ csrwr ra, EXCEPTION_KS2
+@@ -497,16 +497,16 @@ nopage_tlb_modify:
+ csrrd ra, EXCEPTION_KS2
+ la_abs t0, tlb_do_page_fault_1
+ jr t0
+-SYM_FUNC_END(handle_tlb_modify)
++SYM_CODE_END(handle_tlb_modify)
+
+-SYM_FUNC_START(handle_tlb_modify_ptw)
++SYM_CODE_START(handle_tlb_modify_ptw)
+ csrwr t0, LOONGARCH_CSR_KS0
+ csrwr t1, LOONGARCH_CSR_KS1
+ la_abs t0, tlb_do_page_fault_1
+ jr t0
+-SYM_FUNC_END(handle_tlb_modify_ptw)
++SYM_CODE_END(handle_tlb_modify_ptw)
+
+-SYM_FUNC_START(handle_tlb_refill)
++SYM_CODE_START(handle_tlb_refill)
+ csrwr t0, LOONGARCH_CSR_TLBRSAVE
+ csrrd t0, LOONGARCH_CSR_PGD
+ lddir t0, t0, 3
+@@ -521,4 +521,4 @@ SYM_FUNC_START(handle_tlb_refill)
+ tlbfill
+ csrrd t0, LOONGARCH_CSR_TLBRSAVE
+ ertn
+-SYM_FUNC_END(handle_tlb_refill)
++SYM_CODE_END(handle_tlb_refill)
+--
+2.42.0
+
--- /dev/null
+From a92324dd3e71c9ab45924b9f6fe1776be1c3b4b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 09:07:44 +0200
+Subject: media: i2c: ov8858: Don't set fwnode in the driver
+
+From: Ondrej Jirman <megi@xff.cz>
+
+[ Upstream commit c46f16f156ac58afcf4addc850bb5dfbca77b9fc ]
+
+This makes the driver work with the new check in
+v4l2_async_register_subdev() that was introduced recently in 6.6-rc1.
+Without this change, probe fails with:
+
+ov8858 1-0036: Detected OV8858 sensor, revision 0xb2
+ov8858 1-0036: sub-device fwnode is an endpoint!
+ov8858 1-0036: v4l2 async register subdev failed
+ov8858: probe of 1-0036 failed with error -22
+
+This also simplifies the driver a bit.
+
+Signed-off-by: Ondrej Jirman <megi@xff.cz>
+Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov8858.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/ov8858.c b/drivers/media/i2c/ov8858.c
+index 3af6125a2eee8..4d9fd76e2f60f 100644
+--- a/drivers/media/i2c/ov8858.c
++++ b/drivers/media/i2c/ov8858.c
+@@ -1850,9 +1850,9 @@ static int ov8858_parse_of(struct ov8858 *ov8858)
+ }
+
+ ret = v4l2_fwnode_endpoint_parse(endpoint, &vep);
++ fwnode_handle_put(endpoint);
+ if (ret) {
+ dev_err(dev, "Failed to parse endpoint: %d\n", ret);
+- fwnode_handle_put(endpoint);
+ return ret;
+ }
+
+@@ -1864,12 +1864,9 @@ static int ov8858_parse_of(struct ov8858 *ov8858)
+ default:
+ dev_err(dev, "Unsupported number of data lanes %u\n",
+ ov8858->num_lanes);
+- fwnode_handle_put(endpoint);
+ return -EINVAL;
+ }
+
+- ov8858->subdev.fwnode = endpoint;
+-
+ return 0;
+ }
+
+@@ -1913,7 +1910,7 @@ static int ov8858_probe(struct i2c_client *client)
+
+ ret = ov8858_init_ctrls(ov8858);
+ if (ret)
+- goto err_put_fwnode;
++ return ret;
+
+ sd = &ov8858->subdev;
+ sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
+@@ -1964,8 +1961,6 @@ static int ov8858_probe(struct i2c_client *client)
+ media_entity_cleanup(&sd->entity);
+ err_free_handler:
+ v4l2_ctrl_handler_free(&ov8858->ctrl_handler);
+-err_put_fwnode:
+- fwnode_handle_put(ov8858->subdev.fwnode);
+
+ return ret;
+ }
+@@ -1978,7 +1973,6 @@ static void ov8858_remove(struct i2c_client *client)
+ v4l2_async_unregister_subdev(sd);
+ media_entity_cleanup(&sd->entity);
+ v4l2_ctrl_handler_free(&ov8858->ctrl_handler);
+- fwnode_handle_put(ov8858->subdev.fwnode);
+
+ pm_runtime_disable(&client->dev);
+ if (!pm_runtime_status_suspended(&client->dev))
+--
+2.42.0
+
--- /dev/null
+From 5416a66d3f8d6b3cbe9609c253a6d1585eaa16fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 17:27:59 +0800
+Subject: net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 9f771493da935299c6393ad3563b581255d01a37 ]
+
+t4_set_params_timeout() can return -EINVAL if failed, add check
+for this.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 8d719f82854a9..76de55306c4d0 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -3816,6 +3816,8 @@ int t4_load_phy_fw(struct adapter *adap, int win,
+ FW_PARAMS_PARAM_Z_V(FW_PARAMS_PARAM_DEV_PHYFW_DOWNLOAD));
+ ret = t4_set_params_timeout(adap, adap->mbox, adap->pf, 0, 1,
+ ¶m, &val, 30000);
++ if (ret)
++ return ret;
+
+ /* If we have version number support, then check to see that the new
+ * firmware got loaded properly.
+--
+2.42.0
+
--- /dev/null
+From 5fcb4295eb48140cffce968caf6fcd754f1696e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Aug 2023 11:10:57 +0200
+Subject: net/mlx5: Bridge, fix peer entry ageing in LAG mode
+
+From: Vlad Buslov <vladbu@nvidia.com>
+
+[ Upstream commit 7a3ce8074878a68a75ceacec93d9ae05906eec86 ]
+
+With current implementation in single FDB LAG mode all packets are
+processed by eswitch 0 rules. As such, 'peer' FDB entries receive the
+packets for rules of other eswitches and are responsible for updating the
+main entry by sending SWITCHDEV_FDB_ADD_TO_BRIDGE notification from their
+background update wq task. However, this introduces a race condition when
+non-zero eswitch instance decides to delete a FDB entry, sends
+SWITCHDEV_FDB_DEL_TO_BRIDGE notification, but another eswitch's update task
+refreshes the same entry concurrently while its async delete work is still
+pending on the workque. In such case another SWITCHDEV_FDB_ADD_TO_BRIDGE
+event may be generated and entry will remain stuck in FDB marked as
+'offloaded' since no more SWITCHDEV_FDB_DEL_TO_BRIDGE notifications are
+sent for deleting the peer entries.
+
+Fix the issue by synchronously marking deleted entries with
+MLX5_ESW_BRIDGE_FLAG_DELETED flag and skipping them in background update
+job.
+
+Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
+Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../mellanox/mlx5/core/en/rep/bridge.c | 11 ++++++++
+ .../ethernet/mellanox/mlx5/core/esw/bridge.c | 25 ++++++++++++++++++-
+ .../ethernet/mellanox/mlx5/core/esw/bridge.h | 3 +++
+ .../mellanox/mlx5/core/esw/bridge_priv.h | 1 +
+ 4 files changed, 39 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+index 5608002465734..285c13edc09f0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c
+@@ -463,6 +463,17 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb,
+ /* only handle the event on peers */
+ if (mlx5_esw_bridge_is_local(dev, rep, esw))
+ break;
++
++ fdb_info = container_of(info,
++ struct switchdev_notifier_fdb_info,
++ info);
++ /* Mark for deletion to prevent the update wq task from
++ * spuriously refreshing the entry which would mark it again as
++ * offloaded in SW bridge. After this fallthrough to regular
++ * async delete code.
++ */
++ mlx5_esw_bridge_fdb_mark_deleted(dev, vport_num, esw_owner_vhca_id, br_offloads,
++ fdb_info);
+ fallthrough;
+ case SWITCHDEV_FDB_ADD_TO_DEVICE:
+ case SWITCHDEV_FDB_DEL_TO_DEVICE:
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+index f4fe1daa4afd5..de1ed59239da8 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c
+@@ -1748,6 +1748,28 @@ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16
+ entry->lastuse = jiffies;
+ }
+
++void mlx5_esw_bridge_fdb_mark_deleted(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id,
++ struct mlx5_esw_bridge_offloads *br_offloads,
++ struct switchdev_notifier_fdb_info *fdb_info)
++{
++ struct mlx5_esw_bridge_fdb_entry *entry;
++ struct mlx5_esw_bridge *bridge;
++
++ bridge = mlx5_esw_bridge_from_port_lookup(vport_num, esw_owner_vhca_id, br_offloads);
++ if (!bridge)
++ return;
++
++ entry = mlx5_esw_bridge_fdb_lookup(bridge, fdb_info->addr, fdb_info->vid);
++ if (!entry) {
++ esw_debug(br_offloads->esw->dev,
++ "FDB mark deleted entry with specified key not found (MAC=%pM,vid=%u,vport=%u)\n",
++ fdb_info->addr, fdb_info->vid, vport_num);
++ return;
++ }
++
++ entry->flags |= MLX5_ESW_BRIDGE_FLAG_DELETED;
++}
++
+ void mlx5_esw_bridge_fdb_create(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id,
+ struct mlx5_esw_bridge_offloads *br_offloads,
+ struct switchdev_notifier_fdb_info *fdb_info)
+@@ -1810,7 +1832,8 @@ void mlx5_esw_bridge_update(struct mlx5_esw_bridge_offloads *br_offloads)
+ unsigned long lastuse =
+ (unsigned long)mlx5_fc_query_lastuse(entry->ingress_counter);
+
+- if (entry->flags & MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER)
++ if (entry->flags & (MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER |
++ MLX5_ESW_BRIDGE_FLAG_DELETED))
+ continue;
+
+ if (time_after(lastuse, entry->lastuse))
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h
+index c2c7c70d99eb7..d6f5391619930 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.h
+@@ -62,6 +62,9 @@ int mlx5_esw_bridge_vport_peer_unlink(struct net_device *br_netdev, u16 vport_nu
+ void mlx5_esw_bridge_fdb_update_used(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id,
+ struct mlx5_esw_bridge_offloads *br_offloads,
+ struct switchdev_notifier_fdb_info *fdb_info);
++void mlx5_esw_bridge_fdb_mark_deleted(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id,
++ struct mlx5_esw_bridge_offloads *br_offloads,
++ struct switchdev_notifier_fdb_info *fdb_info);
+ void mlx5_esw_bridge_fdb_create(struct net_device *dev, u16 vport_num, u16 esw_owner_vhca_id,
+ struct mlx5_esw_bridge_offloads *br_offloads,
+ struct switchdev_notifier_fdb_info *fdb_info);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h
+index 4911cc32161b4..7c251af566c6f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge_priv.h
+@@ -133,6 +133,7 @@ struct mlx5_esw_bridge_mdb_key {
+ enum {
+ MLX5_ESW_BRIDGE_FLAG_ADDED_BY_USER = BIT(0),
+ MLX5_ESW_BRIDGE_FLAG_PEER = BIT(1),
++ MLX5_ESW_BRIDGE_FLAG_DELETED = BIT(2),
+ };
+
+ enum {
+--
+2.42.0
+
--- /dev/null
+From b7694624bbdaac9601b52268b3307eb7d45cc04e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 15:19:37 +0200
+Subject: net: sched: cls_u32: Fix allocation size in u32_init()
+
+From: Gustavo A. R. Silva <gustavoars@kernel.org>
+
+[ Upstream commit c4d49196ceec80e30e8d981410d73331b49b7850 ]
+
+commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array
+with flexible-array member") incorrecly replaced an instance of
+`sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results
+in a an over-allocation of 8 bytes.
+
+This change is wrong because `hlist` in `struct tc_u_common` is a
+pointer:
+
+net/sched/cls_u32.c:
+struct tc_u_common {
+ struct tc_u_hnode __rcu *hlist;
+ void *ptr;
+ int refcnt;
+ struct idr handle_idr;
+ struct hlist_node hnode;
+ long knodes;
+};
+
+So, the use of `struct_size()` makes no sense: we don't need to allocate
+any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine.
+
+So, `struct_size(tp_c, hlist->ht, 1)` translates to:
+
+sizeof(*tp_c) + sizeof(tp_c->hlist->ht) ==
+sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) ==
+ 144 + 8 == 0x98 (byes)
+ ^^^
+ |
+ unnecessary extra
+ allocation size
+
+$ pahole -C tc_u_common net/sched/cls_u32.o
+struct tc_u_common {
+ struct tc_u_hnode * hlist; /* 0 8 */
+ void * ptr; /* 8 8 */
+ int refcnt; /* 16 4 */
+
+ /* XXX 4 bytes hole, try to pack */
+
+ struct idr handle_idr; /* 24 96 */
+ /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */
+ struct hlist_node hnode; /* 120 16 */
+ /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */
+ long int knodes; /* 136 8 */
+
+ /* size: 144, cachelines: 3, members: 6 */
+ /* sum members: 140, holes: 1, sum holes: 4 */
+ /* last cacheline: 16 bytes */
+};
+
+And with `sizeof(*tp_c)`, we have:
+
+ sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes)
+
+which is the correct and original allocation size.
+
+Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with
+`sizeof(*tp_c)`, and avoid allocating 8 too many bytes.
+
+The following difference in binary output is expected and reflects the
+desired change:
+
+| net/sched/cls_u32.o
+| @@ -6148,7 +6148,7 @@
+| include/linux/slab.h:599
+| 2cf5: mov 0x0(%rip),%rdi # 2cfc <u32_init+0xfc>
+| 2cf8: R_X86_64_PC32 kmalloc_caches+0xc
+|- 2cfc: mov $0x98,%edx
+|+ 2cfc: mov $0x90,%edx
+
+Reported-by: Alejandro Colomar <alx@kernel.org>
+Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/
+Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/cls_u32.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
+index da4c179a4d418..6663e971a13e7 100644
+--- a/net/sched/cls_u32.c
++++ b/net/sched/cls_u32.c
+@@ -366,7 +366,7 @@ static int u32_init(struct tcf_proto *tp)
+ idr_init(&root_ht->handle_idr);
+
+ if (tp_c == NULL) {
+- tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL);
++ tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL);
+ if (tp_c == NULL) {
+ kfree(root_ht);
+ return -ENOBUFS;
+--
+2.42.0
+
--- /dev/null
+From ce0f876d0e24e605844a12834a9ae28b24af6a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 17:06:59 +0200
+Subject: netfilter: nf_tables: audit log object reset once per table
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 1baf0152f7707c6c7e4ea815dcc1f431c0e603f9 ]
+
+When resetting multiple objects at once (via dump request), emit a log
+message per table (or filled skb) and resurrect the 'entries' parameter
+to contain the number of objects being logged for.
+
+To test the skb exhaustion path, perform some bulk counter and quota
+adds in the kselftest.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Acked-by: Paul Moore <paul@paul-moore.com> (Audit)
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 50 +++++++++++--------
+ .../testing/selftests/netfilter/nft_audit.sh | 46 +++++++++++++++++
+ 2 files changed, 74 insertions(+), 22 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index e43d9508e7a9c..6a05bed3cb46d 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -7604,6 +7604,16 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
+ return -1;
+ }
+
++static void audit_log_obj_reset(const struct nft_table *table,
++ unsigned int base_seq, unsigned int nentries)
++{
++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u", table->name, base_seq);
++
++ audit_log_nfcfg(buf, table->family, nentries,
++ AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC);
++ kfree(buf);
++}
++
+ struct nft_obj_filter {
+ char *table;
+ u32 type;
+@@ -7618,8 +7628,10 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ struct net *net = sock_net(skb->sk);
+ int family = nfmsg->nfgen_family;
+ struct nftables_pernet *nft_net;
++ unsigned int entries = 0;
+ struct nft_object *obj;
+ bool reset = false;
++ int rc = 0;
+
+ if (NFNL_MSG_TYPE(cb->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
+ reset = true;
+@@ -7632,6 +7644,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ if (family != NFPROTO_UNSPEC && family != table->family)
+ continue;
+
++ entries = 0;
+ list_for_each_entry_rcu(obj, &table->objects, list) {
+ if (!nft_is_active(net, obj))
+ goto cont;
+@@ -7647,34 +7660,27 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ filter->type != NFT_OBJECT_UNSPEC &&
+ obj->ops->type->type != filter->type)
+ goto cont;
+- if (reset) {
+- char *buf = kasprintf(GFP_ATOMIC,
+- "%s:%u",
+- table->name,
+- nft_net->base_seq);
+-
+- audit_log_nfcfg(buf,
+- family,
+- obj->handle,
+- AUDIT_NFT_OP_OBJ_RESET,
+- GFP_ATOMIC);
+- kfree(buf);
+- }
+
+- if (nf_tables_fill_obj_info(skb, net, NETLINK_CB(cb->skb).portid,
+- cb->nlh->nlmsg_seq,
+- NFT_MSG_NEWOBJ,
+- NLM_F_MULTI | NLM_F_APPEND,
+- table->family, table,
+- obj, reset) < 0)
+- goto done;
++ rc = nf_tables_fill_obj_info(skb, net,
++ NETLINK_CB(cb->skb).portid,
++ cb->nlh->nlmsg_seq,
++ NFT_MSG_NEWOBJ,
++ NLM_F_MULTI | NLM_F_APPEND,
++ table->family, table,
++ obj, reset);
++ if (rc < 0)
++ break;
+
++ entries++;
+ nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+ cont:
+ idx++;
+ }
++ if (reset && entries)
++ audit_log_obj_reset(table, nft_net->base_seq, entries);
++ if (rc < 0)
++ break;
+ }
+-done:
+ rcu_read_unlock();
+
+ cb->args[0] = idx;
+@@ -7779,7 +7785,7 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
+
+ audit_log_nfcfg(buf,
+ family,
+- obj->handle,
++ 1,
+ AUDIT_NFT_OP_OBJ_RESET,
+ GFP_ATOMIC);
+ kfree(buf);
+diff --git a/tools/testing/selftests/netfilter/nft_audit.sh b/tools/testing/selftests/netfilter/nft_audit.sh
+index 5267c88496d51..99ed5bd6e8402 100755
+--- a/tools/testing/selftests/netfilter/nft_audit.sh
++++ b/tools/testing/selftests/netfilter/nft_audit.sh
+@@ -99,6 +99,12 @@ do_test 'nft add counter t1 c1' \
+ do_test 'nft add counter t2 c1; add counter t2 c2' \
+ 'table=t2 family=2 entries=2 op=nft_register_obj'
+
++for ((i = 3; i <= 500; i++)); do
++ echo "add counter t2 c$i"
++done >$rulefile
++do_test "nft -f $rulefile" \
++'table=t2 family=2 entries=498 op=nft_register_obj'
++
+ # adding/updating quotas
+
+ do_test 'nft add quota t1 q1 { 10 bytes }' \
+@@ -107,6 +113,12 @@ do_test 'nft add quota t1 q1 { 10 bytes }' \
+ do_test 'nft add quota t2 q1 { 10 bytes }; add quota t2 q2 { 10 bytes }' \
+ 'table=t2 family=2 entries=2 op=nft_register_obj'
+
++for ((i = 3; i <= 500; i++)); do
++ echo "add quota t2 q$i { 10 bytes }"
++done >$rulefile
++do_test "nft -f $rulefile" \
++'table=t2 family=2 entries=498 op=nft_register_obj'
++
+ # changing the quota value triggers obj update path
+ do_test 'nft add quota t1 q1 { 20 bytes }' \
+ 'table=t1 family=2 entries=1 op=nft_register_obj'
+@@ -156,6 +168,40 @@ done
+ do_test 'nft reset set t1 s' \
+ 'table=t1 family=2 entries=3 op=nft_reset_setelem'
+
++# resetting counters
++
++do_test 'nft reset counter t1 c1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset counters t1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset counters t2' \
++'table=t2 family=2 entries=342 op=nft_reset_obj
++table=t2 family=2 entries=158 op=nft_reset_obj'
++
++do_test 'nft reset counters' \
++'table=t1 family=2 entries=1 op=nft_reset_obj
++table=t2 family=2 entries=341 op=nft_reset_obj
++table=t2 family=2 entries=159 op=nft_reset_obj'
++
++# resetting quotas
++
++do_test 'nft reset quota t1 q1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset quotas t1' \
++'table=t1 family=2 entries=1 op=nft_reset_obj'
++
++do_test 'nft reset quotas t2' \
++'table=t2 family=2 entries=315 op=nft_reset_obj
++table=t2 family=2 entries=185 op=nft_reset_obj'
++
++do_test 'nft reset quotas' \
++'table=t1 family=2 entries=1 op=nft_reset_obj
++table=t2 family=2 entries=314 op=nft_reset_obj
++table=t2 family=2 entries=186 op=nft_reset_obj'
++
+ # deleting rules
+
+ readarray -t handles < <(nft -a list chain t1 c1 | \
+--
+2.42.0
+
--- /dev/null
+From 2b0a3fbd730f25a1ecbb737689783244cc4bda33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Oct 2023 10:53:08 +0200
+Subject: netfilter: nfnetlink_log: silence bogus compiler warning
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 2e1d175410972285333193837a4250a74cd472e6 ]
+
+net/netfilter/nfnetlink_log.c:800:18: warning: variable 'ctinfo' is uninitialized
+
+The warning is bogus, the variable is only used if ct is non-NULL and
+always initialised in that case. Init to 0 too to silence this.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202309100514.ndBFebXN-lkp@intel.com/
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nfnetlink_log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index e57eb168ee130..984f6f106e4ac 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -700,8 +700,8 @@ nfulnl_log_packet(struct net *net,
+ unsigned int plen = 0;
+ struct nfnl_log_net *log = nfnl_log_pernet(net);
+ const struct nfnl_ct_hook *nfnl_ct = NULL;
++ enum ip_conntrack_info ctinfo = 0;
+ struct nf_conn *ct = NULL;
+- enum ip_conntrack_info ctinfo;
+
+ if (li_user && li_user->type == NF_LOG_TYPE_ULOG)
+ li = li_user;
+--
+2.42.0
+
--- /dev/null
+From 904dcf72db870c2a784fbf49d0037ec316b8ddb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 19:02:35 -0400
+Subject: platform/mellanox: mlxbf-tmfifo: Fix a warning message
+
+From: Liming Sun <limings@nvidia.com>
+
+[ Upstream commit 99c09c985e5973c8f0ad976ebae069548dd86f12 ]
+
+This commit fixes the smatch static checker warning in function
+mlxbf_tmfifo_rxtx_word() which complains data not initialized at
+line 634 when IS_VRING_DROP() is TRUE.
+
+Signed-off-by: Liming Sun <limings@nvidia.com>
+Link: https://lore.kernel.org/r/20231012230235.219861-1-limings@nvidia.com
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mellanox/mlxbf-tmfifo.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
+index f3696a54a2bd7..d9615ad600123 100644
+--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
++++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
+@@ -607,24 +607,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring,
+
+ if (vring->cur_len + sizeof(u64) <= len) {
+ /* The whole word. */
+- if (!IS_VRING_DROP(vring)) {
+- if (is_rx)
++ if (is_rx) {
++ if (!IS_VRING_DROP(vring))
+ memcpy(addr + vring->cur_len, &data,
+ sizeof(u64));
+- else
+- memcpy(&data, addr + vring->cur_len,
+- sizeof(u64));
++ } else {
++ memcpy(&data, addr + vring->cur_len,
++ sizeof(u64));
+ }
+ vring->cur_len += sizeof(u64);
+ } else {
+ /* Leftover bytes. */
+- if (!IS_VRING_DROP(vring)) {
+- if (is_rx)
++ if (is_rx) {
++ if (!IS_VRING_DROP(vring))
+ memcpy(addr + vring->cur_len, &data,
+ len - vring->cur_len);
+- else
+- memcpy(&data, addr + vring->cur_len,
+- len - vring->cur_len);
++ } else {
++ data = 0;
++ memcpy(&data, addr + vring->cur_len,
++ len - vring->cur_len);
+ }
+ vring->cur_len = len;
+ }
+--
+2.42.0
+
--- /dev/null
+From b680e0976d31c9948cf3a7f1c42f0785fb97e744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Sep 2023 17:55:51 +0200
+Subject: powerpc/85xx: Fix math emulation exception
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 8e8a12ecbc86700b5e1a3596ce2b3c43dafad336 ]
+
+Booting mpc85xx_defconfig kernel on QEMU leads to:
+
+Bad trap at PC: fe9bab0, SR: 2d000, vector=800
+awk[82]: unhandled trap (5) at 0 nip fe9bab0 lr fe9e01c code 5 in libc-2.27.so[fe5a000+17a000]
+awk[82]: code: 3aa00000 3a800010 4bffe03c 9421fff0 7ca62b78 38a00000 93c10008 83c10008
+awk[82]: code: 38210010 4bffdec8 9421ffc0 7c0802a6 <fc00048e> d8010008 4815190d 93810030
+Trace/breakpoint trap
+WARNING: no useful console
+
+This is because allthough CONFIG_MATH_EMULATION is selected,
+Exception 800 calls unknown_exception().
+
+Call emulation_assist_interrupt() instead.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/066caa6d9480365da9b8ed83692d7101e10ac5f8.1695657339.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_85xx.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/head_85xx.S b/arch/powerpc/kernel/head_85xx.S
+index fdbee1093e2ba..f9634111e82ed 100644
+--- a/arch/powerpc/kernel/head_85xx.S
++++ b/arch/powerpc/kernel/head_85xx.S
+@@ -396,7 +396,7 @@ interrupt_base:
+ #ifdef CONFIG_PPC_FPU
+ FP_UNAVAILABLE_EXCEPTION
+ #else
+- EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, unknown_exception)
++ EXCEPTION(0x0800, FP_UNAVAIL, FloatingPointUnavailable, emulation_assist_interrupt)
+ #endif
+
+ /* System Call Interrupt */
+--
+2.42.0
+
--- /dev/null
+From dad018c522d82bfb2b080d1c093d01fbb1ebc980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 22:25:00 +1100
+Subject: powerpc/mm: Fix boot crash with FLATMEM
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit daa9ada2093ed23d52b4c1fe6e13cf78f55cc85f ]
+
+Erhard reported that his G5 was crashing with v6.6-rc kernels:
+
+ mpic: Setting up HT PICs workarounds for U3/U4
+ BUG: Unable to handle kernel data access at 0xfeffbb62ffec65fe
+ Faulting instruction address: 0xc00000000005dc40
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper/0 Tainted: G T 6.6.0-rc3-PMacGS #1
+ Hardware name: PowerMac11,2 PPC970MP 0x440101 PowerMac
+ NIP: c00000000005dc40 LR: c000000000066660 CTR: c000000000007730
+ REGS: c0000000022bf510 TRAP: 0380 Tainted: G T (6.6.0-rc3-PMacGS)
+ MSR: 9000000000001032 <SF,HV,ME,IR,DR,RI> CR: 44004242 XER: 00000000
+ IRQMASK: 3
+ GPR00: 0000000000000000 c0000000022bf7b0 c0000000010c0b00 00000000000001ac
+ GPR04: 0000000003c80000 0000000000000300 c0000000f20001ae 0000000000000300
+ GPR08: 0000000000000006 feffbb62ffec65ff 0000000000000001 0000000000000000
+ GPR12: 9000000000001032 c000000002362000 c000000000f76b80 000000000349ecd8
+ GPR16: 0000000002367ba8 0000000002367f08 0000000000000006 0000000000000000
+ GPR20: 00000000000001ac c000000000f6f920 c0000000022cd985 000000000000000c
+ GPR24: 0000000000000300 00000003b0a3691d c0003e008030000e 0000000000000000
+ GPR28: c00000000000000c c0000000f20001ee feffbb62ffec65fe 00000000000001ac
+ NIP hash_page_do_lazy_icache+0x50/0x100
+ LR __hash_page_4K+0x420/0x590
+ Call Trace:
+ hash_page_mm+0x364/0x6f0
+ do_hash_fault+0x114/0x2b0
+ data_access_common_virt+0x198/0x1f0
+ --- interrupt: 300 at mpic_init+0x4bc/0x10c4
+ NIP: c000000002020a5c LR: c000000002020a04 CTR: 0000000000000000
+ REGS: c0000000022bf9f0 TRAP: 0300 Tainted: G T (6.6.0-rc3-PMacGS)
+ MSR: 9000000000001032 <SF,HV,ME,IR,DR,RI> CR: 24004248 XER: 00000000
+ DAR: c0003e008030000e DSISR: 40000000 IRQMASK: 1
+ ...
+ NIP mpic_init+0x4bc/0x10c4
+ LR mpic_init+0x464/0x10c4
+ --- interrupt: 300
+ pmac_setup_one_mpic+0x258/0x2dc
+ pmac_pic_init+0x28c/0x3d8
+ init_IRQ+0x90/0x140
+ start_kernel+0x57c/0x78c
+ start_here_common+0x1c/0x20
+
+A bisect pointed to the breakage beginning with commit 9fee28baa601 ("powerpc:
+implement the new page table range API").
+
+Analysis of the oops pointed to a struct page with a corrupted
+compound_head being loaded via page_folio() -> _compound_head() in
+hash_page_do_lazy_icache().
+
+The access by the mpic code is to an MMIO address, so the expectation
+is that the struct page for that address would be initialised by
+init_unavailable_range(), as pointed out by Aneesh.
+
+Instrumentation showed that was not the case, which eventually lead to
+the realisation that pfn_valid() was returning false for that address,
+causing the struct page to not be initialised.
+
+Because the system is using FLATMEM, the version of pfn_valid() in
+memory_model.h is used:
+
+static inline int pfn_valid(unsigned long pfn)
+{
+ ...
+ return pfn >= pfn_offset && (pfn - pfn_offset) < max_mapnr;
+}
+
+Which relies on max_mapnr being initialised. Early in boot max_mapnr is
+zero meaning no PFNs are valid.
+
+max_mapnr is initialised in mem_init() called via:
+
+ start_kernel()
+ mm_core_init() # init/main.c:928
+ mem_init()
+
+But that is too late for the usage in init_unavailable_range() called via:
+
+ start_kernel()
+ setup_arch() # init/main.c:893
+ paging_init()
+ free_area_init()
+ init_unavailable_range()
+
+Although max_mapnr is currently set in mem_init(), the value is actually
+already available much earlier, as soon as mem_topology_setup() has
+completed, which is also before paging_init() is called. So move the
+initialisation there, which causes paging_init() to correctly initialise
+the struct page and fixes the bug.
+
+This bug seems to have been lurking for years, but went unnoticed
+because the pre-folio code was inspecting the uninitialised page->flags
+but not dereferencing it.
+
+Thanks to Erhard and Aneesh for help debugging.
+
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Closes: https://lore.kernel.org/all/20230929132750.3cd98452@yea/
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231023112500.1550208-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/setup-common.c | 2 ++
+ arch/powerpc/mm/mem.c | 1 -
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index d2a446216444f..d35ba3ac218bf 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -948,6 +948,8 @@ void __init setup_arch(char **cmdline_p)
+
+ /* Parse memory topology */
+ mem_topology_setup();
++ /* Set max_mapnr before paging_init() */
++ set_max_mapnr(max_pfn);
+
+ /*
+ * Release secondary cpus out of their spinloops at 0x60 now that
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 8b121df7b08f8..07e8f4f1e07f8 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -288,7 +288,6 @@ void __init mem_init(void)
+ #endif
+
+ high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
+- set_max_mapnr(max_pfn);
+
+ kasan_late_init();
+
+--
+2.42.0
+
--- /dev/null
+From d12099f182165ad170332a15b5c73c2e09707bd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:57 -0700
+Subject: r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit bc65cc42af737a5a35f83842408ef2c6c79ba025 ]
+
+If the adapter is unplugged while we're looping in r8153b_ups_en() /
+r8153c_ups_en() we could end up looping for 10 seconds (20 ms * 500
+loops). Add code similar to what's done in other places in the driver
+to check for unplug and bail.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 1a016eafaf126..b64df36fbb115 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3656,6 +3656,8 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
+@@ -3696,6 +3698,8 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+ break;
+--
+2.42.0
+
--- /dev/null
+From fbf3f1731547b47526a06da568b5d4797cea3b67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:56 -0700
+Subject: r8152: Check for unplug in rtl_phy_patch_request()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit dc90ba37a8c37042407fa6970b9830890cfe6047 ]
+
+If the adapter is unplugged while we're looping in
+rtl_phy_patch_request() we could end up looping for 10 seconds (2 ms *
+5000 loops). Add code similar to what's done in other places in the
+driver to check for unplug and bail.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 14497e5558bf9..1a016eafaf126 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4059,6 +4059,9 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)
+ for (i = 0; wait && i < 5000; i++) {
+ u32 ocp_data;
+
++ if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ break;
++
+ usleep_range(1000, 2000);
+ ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT);
+ if ((ocp_data & PATCH_READY) ^ check)
+--
+2.42.0
+
--- /dev/null
+From 06754e6088e2a23706931b2142218aa90b409cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 14:06:58 -0700
+Subject: r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 715f67f33af45ce2cc3a5b1ef133cc8c8e7787b0 ]
+
+Whenever the RTL8152_UNPLUG is set that just tells the driver that all
+accesses will fail and we should just immediately bail. A future patch
+will use this same concept at a time when the driver hasn't actually
+been unplugged but is about to be reset. Rename the flag in
+preparation for the future patch.
+
+This is a no-op change and just a search and replace.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Grant Grundler <grundler@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 96 ++++++++++++++++++++---------------------
+ 1 file changed, 48 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index b64df36fbb115..212043db5cbe5 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -764,7 +764,7 @@ enum rtl_register_content {
+
+ /* rtl8152 flags */
+ enum rtl8152_flags {
+- RTL8152_UNPLUG = 0,
++ RTL8152_INACCESSIBLE = 0,
+ RTL8152_SET_RX_MODE,
+ WORK_ENABLE,
+ RTL8152_LINK_CHG,
+@@ -1245,7 +1245,7 @@ int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
+ static void rtl_set_unplug(struct r8152 *tp)
+ {
+ if (tp->udev->state == USB_STATE_NOTATTACHED) {
+- set_bit(RTL8152_UNPLUG, &tp->flags);
++ set_bit(RTL8152_INACCESSIBLE, &tp->flags);
+ smp_mb__after_atomic();
+ }
+ }
+@@ -1256,7 +1256,7 @@ static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size,
+ u16 limit = 64;
+ int ret = 0;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ /* both size and indix must be 4 bytes align */
+@@ -1300,7 +1300,7 @@ static int generic_ocp_write(struct r8152 *tp, u16 index, u16 byteen,
+ u16 byteen_start, byteen_end, byen;
+ u16 limit = 512;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ /* both size and indix must be 4 bytes align */
+@@ -1530,7 +1530,7 @@ static int read_mii_word(struct net_device *netdev, int phy_id, int reg)
+ struct r8152 *tp = netdev_priv(netdev);
+ int ret;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ if (phy_id != R8152_PHY_ID)
+@@ -1546,7 +1546,7 @@ void write_mii_word(struct net_device *netdev, int phy_id, int reg, int val)
+ {
+ struct r8152 *tp = netdev_priv(netdev);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (phy_id != R8152_PHY_ID)
+@@ -1751,7 +1751,7 @@ static void read_bulk_callback(struct urb *urb)
+ if (!tp)
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+@@ -1843,7 +1843,7 @@ static void write_bulk_callback(struct urb *urb)
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!skb_queue_empty(&tp->tx_queue))
+@@ -1864,7 +1864,7 @@ static void intr_callback(struct urb *urb)
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+ return;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ switch (status) {
+@@ -2608,7 +2608,7 @@ static void bottom_half(struct tasklet_struct *t)
+ {
+ struct r8152 *tp = from_tasklet(tp, t, tx_tl);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (!test_bit(WORK_ENABLE, &tp->flags))
+@@ -2651,7 +2651,7 @@ int r8152_submit_rx(struct r8152 *tp, struct rx_agg *agg, gfp_t mem_flags)
+ int ret;
+
+ /* The rx would be stopped, so skip submitting */
+- if (test_bit(RTL8152_UNPLUG, &tp->flags) ||
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) ||
+ !test_bit(WORK_ENABLE, &tp->flags) || !netif_carrier_ok(tp->netdev))
+ return 0;
+
+@@ -3051,7 +3051,7 @@ static int rtl_enable(struct r8152 *tp)
+
+ static int rtl8152_enable(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -3138,7 +3138,7 @@ static int rtl8153_enable(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -3170,7 +3170,7 @@ static void rtl_disable(struct r8152 *tp)
+ u32 ocp_data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -3624,7 +3624,7 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired)
+ }
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -3656,7 +3656,7 @@ static void r8153b_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+@@ -3698,7 +3698,7 @@ static void r8153c_ups_en(struct r8152 *tp, bool enable)
+ int i;
+
+ for (i = 0; i < 500; i++) {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) &
+ AUTOLOAD_DONE)
+@@ -4063,8 +4063,8 @@ static int rtl_phy_patch_request(struct r8152 *tp, bool request, bool wait)
+ for (i = 0; wait && i < 5000; i++) {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
+- break;
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
++ return -ENODEV;
+
+ usleep_range(1000, 2000);
+ ocp_data = ocp_reg_read(tp, OCP_PHY_PATCH_STAT);
+@@ -6027,7 +6027,7 @@ static int rtl8156_enable(struct r8152 *tp)
+ u32 ocp_data;
+ u16 speed;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ r8156_fc_parameter(tp);
+@@ -6085,7 +6085,7 @@ static int rtl8156b_enable(struct r8152 *tp)
+ u32 ocp_data;
+ u16 speed;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ set_tx_qlen(tp);
+@@ -6271,7 +6271,7 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u32 speed, u8 duplex,
+
+ static void rtl8152_up(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8152_aldps_en(tp, false);
+@@ -6281,7 +6281,7 @@ static void rtl8152_up(struct r8152 *tp)
+
+ static void rtl8152_down(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6296,7 +6296,7 @@ static void rtl8153_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_u1u2en(tp, false);
+@@ -6336,7 +6336,7 @@ static void rtl8153_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6357,7 +6357,7 @@ static void rtl8153b_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6381,7 +6381,7 @@ static void rtl8153b_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6418,7 +6418,7 @@ static void rtl8153c_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6499,7 +6499,7 @@ static void rtl8156_up(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -6572,7 +6572,7 @@ static void rtl8156_down(struct r8152 *tp)
+ {
+ u32 ocp_data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+@@ -6710,7 +6710,7 @@ static void rtl_work_func_t(struct work_struct *work)
+ /* If the device is unplugged or !netif_running(), the workqueue
+ * doesn't need to wake the device, and could return directly.
+ */
+- if (test_bit(RTL8152_UNPLUG, &tp->flags) || !netif_running(tp->netdev))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags) || !netif_running(tp->netdev))
+ return;
+
+ if (usb_autopm_get_interface(tp->intf) < 0)
+@@ -6749,7 +6749,7 @@ static void rtl_hw_phy_work_func_t(struct work_struct *work)
+ {
+ struct r8152 *tp = container_of(work, struct r8152, hw_phy_work.work);
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (usb_autopm_get_interface(tp->intf) < 0)
+@@ -6876,7 +6876,7 @@ static int rtl8152_close(struct net_device *netdev)
+ netif_stop_queue(netdev);
+
+ res = usb_autopm_get_interface(tp->intf);
+- if (res < 0 || test_bit(RTL8152_UNPLUG, &tp->flags)) {
++ if (res < 0 || test_bit(RTL8152_INACCESSIBLE, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ rtl_stop_rx(tp);
+ } else {
+@@ -6909,7 +6909,7 @@ static void r8152b_init(struct r8152 *tp)
+ u32 ocp_data;
+ u16 data;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ data = r8152_mdio_read(tp, MII_BMCR);
+@@ -6953,7 +6953,7 @@ static void r8153_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_u1u2en(tp, false);
+@@ -6964,7 +6964,7 @@ static void r8153_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -7093,7 +7093,7 @@ static void r8153b_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -7104,7 +7104,7 @@ static void r8153b_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ break;
+ }
+
+@@ -7175,7 +7175,7 @@ static void r8153c_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_u1u2en(tp, false);
+@@ -7195,7 +7195,7 @@ static void r8153c_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -8024,7 +8024,7 @@ static void r8156_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP);
+@@ -8045,7 +8045,7 @@ static void r8156_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -8120,7 +8120,7 @@ static void r8156b_init(struct r8152 *tp)
+ u16 data;
+ int i;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ ocp_data = ocp_read_byte(tp, MCU_TYPE_USB, USB_ECM_OP);
+@@ -8154,7 +8154,7 @@ static void r8156b_init(struct r8152 *tp)
+ break;
+
+ msleep(20);
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+ }
+
+@@ -9183,7 +9183,7 @@ static int rtl8152_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+ struct mii_ioctl_data *data = if_mii(rq);
+ int res;
+
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return -ENODEV;
+
+ res = usb_autopm_get_interface(tp->intf);
+@@ -9285,7 +9285,7 @@ static const struct net_device_ops rtl8152_netdev_ops = {
+
+ static void rtl8152_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ if (tp->version != RTL_VER_01)
+@@ -9294,7 +9294,7 @@ static void rtl8152_unload(struct r8152 *tp)
+
+ static void rtl8153_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153_power_cut_en(tp, false);
+@@ -9302,7 +9302,7 @@ static void rtl8153_unload(struct r8152 *tp)
+
+ static void rtl8153b_unload(struct r8152 *tp)
+ {
+- if (test_bit(RTL8152_UNPLUG, &tp->flags))
++ if (test_bit(RTL8152_INACCESSIBLE, &tp->flags))
+ return;
+
+ r8153b_power_cut_en(tp, false);
+--
+2.42.0
+
--- /dev/null
+From ac0b02cd3004f6f56416ccb3a6589d7bb86fe612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Sep 2023 15:22:32 +0800
+Subject: riscv: dts: thead: set dma-noncoherent to soc bus
+
+From: Jisheng Zhang <jszhang@kernel.org>
+
+[ Upstream commit 759426c758c7053a941a4c06c7571461439fcff6 ]
+
+riscv select ARCH_DMA_DEFAULT_COHERENT by default, and th1520 isn't
+dma coherent, so set dma-noncoherent to reflect this fact.
+
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Tested-by: Drew Fustini <dfustini@baylibre.com>
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/thead/th1520.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/boot/dts/thead/th1520.dtsi b/arch/riscv/boot/dts/thead/th1520.dtsi
+index 56a73134b49e6..58108f0eb3fdc 100644
+--- a/arch/riscv/boot/dts/thead/th1520.dtsi
++++ b/arch/riscv/boot/dts/thead/th1520.dtsi
+@@ -139,6 +139,7 @@
+ interrupt-parent = <&plic>;
+ #address-cells = <2>;
+ #size-cells = <2>;
++ dma-noncoherent;
+ ranges;
+
+ plic: interrupt-controller@ffd8000000 {
+--
+2.42.0
+
--- /dev/null
+From c16d9ee3df1091dc2e0b2c920f4e99429d6b323d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 11:06:21 +0200
+Subject: s390/kasan: handle DCSS mapping in memory holes
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 327899674eef18f96644be87aa5510b7523fe4f6 ]
+
+When physical memory is defined under z/VM using DEF STOR CONFIG, there
+may be memory holes that are not hotpluggable memory. In such cases,
+DCSS mapping could be placed in one of these memory holes. Subsequently,
+attempting memory access to such DCSS mapping would result in a kasan
+failure because there is no shadow memory mapping for it.
+
+To maintain consistency with cases where DCSS mapping is positioned after
+the kernel identity mapping, which is then covered by kasan zero shadow
+mapping, handle the scenario above by populating zero shadow mapping
+for memory holes where DCSS mapping could potentially be placed.
+
+Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
+Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/vmem.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/boot/vmem.c b/arch/s390/boot/vmem.c
+index c67f59db7a512..f66d642251fe8 100644
+--- a/arch/s390/boot/vmem.c
++++ b/arch/s390/boot/vmem.c
+@@ -57,6 +57,7 @@ static void kasan_populate_shadow(void)
+ pmd_t pmd_z = __pmd(__pa(kasan_early_shadow_pte) | _SEGMENT_ENTRY);
+ pud_t pud_z = __pud(__pa(kasan_early_shadow_pmd) | _REGION3_ENTRY);
+ p4d_t p4d_z = __p4d(__pa(kasan_early_shadow_pud) | _REGION2_ENTRY);
++ unsigned long memgap_start = 0;
+ unsigned long untracked_end;
+ unsigned long start, end;
+ int i;
+@@ -101,8 +102,12 @@ static void kasan_populate_shadow(void)
+ * +- shadow end ----+---------+- shadow end ---+
+ */
+
+- for_each_physmem_usable_range(i, &start, &end)
++ for_each_physmem_usable_range(i, &start, &end) {
+ kasan_populate(start, end, POPULATE_KASAN_MAP_SHADOW);
++ if (memgap_start && physmem_info.info_source == MEM_DETECT_DIAG260)
++ kasan_populate(memgap_start, start, POPULATE_KASAN_ZERO_SHADOW);
++ memgap_start = end;
++ }
+ if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
+ untracked_end = VMALLOC_START;
+ /* shallowly populate kasan shadow for vmalloc and modules */
+--
+2.42.0
+
--- /dev/null
+From c039a8921765cec138cce937f6fb5465151fa822 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Oct 2023 13:45:29 +0200
+Subject: scsi: mpt3sas: Fix in error path
+
+From: Tomas Henzl <thenzl@redhat.com>
+
+[ Upstream commit e40c04ade0e2f3916b78211d747317843b11ce10 ]
+
+The driver should be deregistered as misc driver after PCI registration
+failure.
+
+Signed-off-by: Tomas Henzl <thenzl@redhat.com>
+Link: https://lore.kernel.org/r/20231015114529.10725-1-thenzl@redhat.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index c3c1f466fe01d..605013d3ee83a 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -12913,8 +12913,10 @@ _mpt3sas_init(void)
+ mpt3sas_ctl_init(hbas_to_enumerate);
+
+ error = pci_register_driver(&mpt3sas_driver);
+- if (error)
++ if (error) {
++ mpt3sas_ctl_exit(hbas_to_enumerate);
+ scsih_exit();
++ }
+
+ return error;
+ }
+--
+2.42.0
+
--- /dev/null
+asoc-intel-sof_sdw-add-support-for-sku-0b14.patch
+asoc-simple-card-fixup-asoc_simple_probe-error-handl.patch
+coresight-tmc-etr-disable-warnings-for-allocation-fa.patch
+asoc-fsl-asoc-card-use-integer-type-for-fll_id-and-p.patch
+asoc-core-do-not-call-link_exit-on-uninitialized-rtd.patch
+asoc-tlv320adc3xxx-bug-correct-micbias-setting.patch
+net-sched-cls_u32-fix-allocation-size-in-u32_init.patch
+arm64-dts-imx93-add-the-flex-can-stop-mode-by-gpr.patch
+can-flexcan-remove-the-auto-stop-mode-for-imx93.patch
+irqchip-gic-v3-its-split-allocation-from-initialisat.patch
+irqchip-gic-v3-enable-non-coherent-redistributors-it.patch
+irqchip-riscv-intc-mark-all-intc-nodes-as-initialize.patch
+irqchip-stm32-exti-add-missing-dt-irq-flag-translati.patch
+dmaengine-ste_dma40-fix-pm-disable-depth-imbalance-i.patch
+ata-pata_parport-add-custom-version-of-wait_after_re.patch
+ata-pata_parport-fit3-implement-ide-command-set-regi.patch
+powerpc-85xx-fix-math-emulation-exception.patch
+media-i2c-ov8858-don-t-set-fwnode-in-the-driver.patch
+input-synaptics-rmi4-handle-reset-delay-when-using-s.patch
+fbdev-atyfb-only-use-ioremap_uc-on-i386-and-ia64.patch
+fs-ntfs3-add-ckeck-in-ni_update_parent.patch
+fs-ntfs3-write-immediately-updated-ntfs-state.patch
+fs-ntfs3-use-kvmalloc-instead-of-kmalloc-.-__gfp_now.patch
+fs-ntfs3-add-more-attributes-checks-in-mi_enum_attr.patch
+fs-ntfs3-fix-alternative-boot-searching.patch
+fs-ntfs3-add-more-info-into-proc-fs-ntfs3-dev-volinf.patch
+fs-ntfs3-do-not-allow-to-change-label-if-volume-is-r.patch
+fs-ntfs3-fix-possible-null-ptr-deref-in-ni_readpage_.patch
+fs-ntfs3-fix-null-pointer-dereference-on-error-in-at.patch
+fs-ntfs3-fix-directory-element-type-detection.patch
+fs-ntfs3-avoid-possible-memory-leak.patch
+spi-npcm-fiu-fix-uma-reads-when-dummy.nbytes-0.patch
+asoc-soc-dapm-add-helper-for-comparing-widget-name.patch
+netfilter-nfnetlink_log-silence-bogus-compiler-warni.patch
+net-mlx5-bridge-fix-peer-entry-ageing-in-lag-mode.patch
+x86-efistub-don-t-try-to-print-after-exitbootservice.patch
+efi-fix-memory-leak-in-krealloc-failure-handling.patch
+asoc-rt5650-fix-the-wrong-result-of-key-button.patch
+asoc-codecs-tas2780-fix-log-of-failed-reset-via-i2c.patch
+s390-kasan-handle-dcss-mapping-in-memory-holes.patch
+drm-ttm-reorder-sys-manager-cleanup-step.patch
+fbdev-omapfb-fix-some-error-codes.patch
+fbdev-uvesafb-call-cn_del_callback-at-the-end-of-uve.patch
+scsi-mpt3sas-fix-in-error-path.patch
+asoc-da7219-correct-the-process-of-setting-up-gnd-sw.patch
+drm-amdgpu-unset-context-priority-is-now-invalid.patch
+gpu-drm-eliminate-drm_sched_priority_unset.patch
+loongarch-use-sym_code_-to-annotate-exception-handle.patch
+loongarch-export-symbol-invalid_pud_table-for-module.patch
+loongarch-replace-kmap_atomic-with-kmap_local_page-i.patch
+loongarch-disable-wuc-for-pgprot_writecombine-like-i.patch
+netfilter-nf_tables-audit-log-object-reset-once-per-.patch
+platform-mellanox-mlxbf-tmfifo-fix-a-warning-message.patch
+drm-amdgpu-reserve-fences-for-vm-update.patch
+riscv-dts-thead-set-dma-noncoherent-to-soc-bus.patch
+net-chelsio-cxgb4-add-an-error-code-check-in-t4_load.patch
+r8152-check-for-unplug-in-rtl_phy_patch_request.patch
+r8152-check-for-unplug-in-r8153b_ups_en-r8153c_ups_e.patch
+r8152-rename-rtl8152_unplug-to-rtl8152_inaccessible.patch
+powerpc-mm-fix-boot-crash-with-flatmem.patch
+io_uring-kiocb_done-should-not-trust-ki_pos-if-read-.patch
+ceph_wait_on_conflict_unlink-grab-reference-before-d.patch
--- /dev/null
+From 50fd79e436bfac4ee18e75b49288c3571b9dadbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Sep 2023 11:28:12 -0700
+Subject: spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
+
+From: William A. Kennington III <william@wkennington.com>
+
+[ Upstream commit 2ec8b010979036c2fe79a64adb6ecc0bd11e91d1 ]
+
+We don't want to use the value of ilog2(0) as dummy.buswidth is 0 when
+dummy.nbytes is 0. Since we have no dummy bytes, we don't need to
+configure the dummy byte bits per clock register value anyway.
+
+Signed-off-by: "William A. Kennington III" <william@wkennington.com>
+Link: https://lore.kernel.org/r/20230922182812.2728066-1-william@wkennington.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-npcm-fiu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
+index eb353561509a8..01a2b9de18b7f 100644
+--- a/drivers/spi/spi-npcm-fiu.c
++++ b/drivers/spi/spi-npcm-fiu.c
+@@ -353,8 +353,9 @@ static int npcm_fiu_uma_read(struct spi_mem *mem,
+ uma_cfg |= ilog2(op->cmd.buswidth);
+ uma_cfg |= ilog2(op->addr.buswidth)
+ << NPCM_FIU_UMA_CFG_ADBPCK_SHIFT;
+- uma_cfg |= ilog2(op->dummy.buswidth)
+- << NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
++ if (op->dummy.nbytes)
++ uma_cfg |= ilog2(op->dummy.buswidth)
++ << NPCM_FIU_UMA_CFG_DBPCK_SHIFT;
+ uma_cfg |= ilog2(op->data.buswidth)
+ << NPCM_FIU_UMA_CFG_RDBPCK_SHIFT;
+ uma_cfg |= op->dummy.nbytes << NPCM_FIU_UMA_CFG_DBSIZ_SHIFT;
+--
+2.42.0
+
--- /dev/null
+From ec9ab9048622ed295ccf498c5a5b2be4f622b9e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Oct 2023 22:25:28 +0300
+Subject: x86/efistub: Don't try to print after ExitBootService()
+
+From: Nikolay Borisov <nik.borisov@suse.com>
+
+[ Upstream commit ff07186b4d774ac22a5345d30763045af4569416 ]
+
+setup_e820() is executed after UEFI's ExitBootService has been called.
+This causes the firmware to throw an exception because the Console IO
+protocol is supposed to work only during boot service environment. As
+per UEFI 2.9, section 12.1:
+
+ "This protocol is used to handle input and output of text-based
+ information intended for the system user during the operation of code
+ in the boot services environment."
+
+So drop the diagnostic warning from this function. We might add back a
+warning that is issued later when initializing the kernel itself.
+
+Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/efi/libstub/x86-stub.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
+index 146477da2b98c..a5a856a7639e1 100644
+--- a/drivers/firmware/efi/libstub/x86-stub.c
++++ b/drivers/firmware/efi/libstub/x86-stub.c
+@@ -648,11 +648,8 @@ setup_e820(struct boot_params *params, struct setup_data *e820ext, u32 e820ext_s
+ break;
+
+ case EFI_UNACCEPTED_MEMORY:
+- if (!IS_ENABLED(CONFIG_UNACCEPTED_MEMORY)) {
+- efi_warn_once(
+-"The system has unaccepted memory, but kernel does not support it\nConsider enabling CONFIG_UNACCEPTED_MEMORY\n");
++ if (!IS_ENABLED(CONFIG_UNACCEPTED_MEMORY))
+ continue;
+- }
+ e820_type = E820_TYPE_RAM;
+ process_unaccepted_memory(d->phys_addr,
+ d->phys_addr + PAGE_SIZE * d->num_pages);
+--
+2.42.0
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
